Connecticut Data Privacy Law Now Covers More Small Teams

If you thought Connecticut's data privacy law did not apply to your small team, check again. Since July 1, 2026, amendments passed in 2025 (SB 1295, Public Act 25-113) have expanded who must comply with the Connecticut Data Privacy Act. The threshold drops by almost two thirds and two new no-threshold triggers kick in. A second law, SB 4 (Public Act 26-64, signed May 27, 2026), adds data broker, geolocation and other rules from October 1, 2026 through 2028.

This is not a hypothetical future requirement. It is in effect now.

What Changed and When

The changes come from two laws with different start dates. Here is the full timeline:

July 1, 2026 (Public Act 25-113):

• Coverage threshold drops from 100,000 to 35,000 Connecticut residents
• Two new no-threshold triggers: any entity that processes sensitive data or offers personal data for sale is now covered regardless of volume
• Expanded sensitive data categories apply
• Updated privacy notice requirements apply
• New consumer rights provisions take effect

October 1, 2026 (SB 4, Public Act 26-64):

• Precise geolocation sale ban takes effect
• Data broker registration framework activates
• Facial recognition and genetic testing protections apply
• Surveillance pricing rules take effect

January 1, 2027:

• Data brokers must be registered with the Connecticut Department of Consumer Protection
• Initial registration fee: $2,500 (annual renewal also $2,500)

July 1, 2028 and October 1, 2028:

• The state's deletion request mechanism must be built by July 1, 2028
• From October 1, 2028, registered data brokers must check it at least every 45 days and honor verified deletion requests

The July 1 changes are the ones that catch small teams off guard. The threshold cut and the no-threshold triggers mean thousands of companies that were previously exempt are now covered before breakfast.

Am I Now Covered? A Decision Tool

Work through these questions in order. If you answer yes to any of them, you are subject to the CTDPA as of July 1, 2026.

Question 1: Do you process personal data of 35,000 or more Connecticut residents per year?

This is the primary threshold. "Process" includes collecting, storing, using, disclosing, or otherwise handling personal data. If your product or service has Connecticut customers and you handle their data in any of these ways, count them. If the count is 35,000 or above, you are covered.

Note: the prior threshold was 100,000. If you previously evaluated coverage and concluded you were exempt because you had fewer than 100,000 Connecticut users, you need to rerun that calculation today.

Question 2: Did you rely on the old 25,000-consumer, 25 percent sale revenue test?

That test is gone. Public Act 25-113 replaced it with the no-threshold sale trigger in Question 4, so a business that sells any personal data is covered whatever its revenue share.

Question 3: Do you process sensitive data about Connecticut residents, regardless of volume?

This is a new no-threshold trigger effective July 1. If you process any of the following categories about Connecticut residents, you are covered with no minimum volume:

• Health and medical data
• Racial or ethnic origin
• Religious beliefs
• Mental or physical disability or treatment (newly added)
• Sexual orientation
• Nonbinary or transgender status (newly added)
• Citizenship or immigration status
• Genetic data
• Neural data (newly added)
• Biometric data used for identification
• Financial account information (newly added)
• Government-issued identification numbers such as Social Security numbers, driver's licenses, or passports (newly added)
• Precise geolocation data (location accurate within 1,750 feet)
• Personal data of a known child

If your AI tools process any of these categories about Connecticut users -- even a handful -- you are covered as of today.

Question 4: Do you sell personal data about Connecticut residents, regardless of volume?

This is the second new no-threshold trigger. "Sell" means exchanging personal data for monetary or other valuable consideration. If your business model involves selling any personal data to third parties, you are now covered in Connecticut regardless of how many Connecticut residents are in your dataset.

If you answered no to all four questions, you are not subject to the CTDPA. Keep this on record and re-evaluate whenever your user base or data practices change.

What You Must Do If You Are Covered

Update Your Privacy Notice

The CTDPA requires a privacy notice that includes, at minimum:

• Categories of personal data you process
• Purposes for processing
• How consumers can exercise their rights (opt-out, access, deletion, correction, portability)
• Categories of personal data you share with third parties and the identity of those third parties
• An active email address or online mechanism for submitting consumer rights requests

If you updated your privacy notice to cover the original CTDPA thresholds, check whether your current draft captures the new sensitive data categories and the updated opt-out triggers. If you are newly covered as of July 1, you need a compliant notice now.

Honor Consumer Rights Requests

Connecticut residents have the right to:

• Access: Know what personal data you hold about them
• Correction: Fix inaccurate personal data
• Deletion: Request you delete their personal data
• Portability: Receive their data in a portable format
• Opt-out: Opt out of targeted advertising, the sale of personal data, and profiling used to make decisions with legal or similarly significant effects

You have 45 days to respond to consumer rights requests, with a single 45-day extension allowed when reasonably necessary. The CTDPA does not set a maximum penalty per violation in the statute but grants the Connecticut Attorney General exclusive enforcement authority with civil penalties up to $5,000 per willful violation.

Conduct a Data Inventory Focused on New Categories

The no-threshold sensitive data trigger makes a data inventory urgent. You need to know whether any Connecticut resident data you process falls into the newly added categories: mental/physical disability, nonbinary/transgender status, neural data, financial accounts, or government IDs. Many teams have this data without realizing it. HR software, benefits platforms, and AI tools that ingest employee or customer data frequently touch these categories.

Practical steps:

1. List every tool that collects or processes data from Connecticut users or employees
2. For each tool, identify whether it processes any newly covered sensitive data category
3. If yes, confirm you have a legal basis for processing (consent for sensitive data is required)
4. Update vendor contracts to include data processing agreements where missing

Review AI Tool Data Flows

If you use AI tools -- and most small teams do -- check whether those tools process Connecticut user data. Under the CTDPA, you are a controller and your AI vendor is a processor. That relationship requires a data processing agreement. The CTDPA mandates that processor agreements include:

• Instructions for processing
• Nature and purpose of processing
• Type of personal data involved
• Duration of processing
• Rights and obligations of both parties

Many AI vendor agreements do not include all of these terms by default. The vendor privacy comparison table in our article on AI vendor data retention policies lists which major vendors have compliant DPA language and which require negotiation.

What Changed October 1, 2026

For most small teams, two SB 4 changes from October 1, 2026 matter most, plus a reminder about the sensitive data rules already in force.

Geolocation Sale Ban

Since October 1, selling a Connecticut resident's precise geolocation data (location accurate within 1,750 feet) is prohibited. This affects mobile apps, location-based services, advertising technology, and any platform that sells location signals to data brokers or ad networks. Review your third-party data sharing agreements now.

Sensitive Data Rules Already Apply

The expanded sensitive data categories listed above have applied since July 1, 2026, together with the no-threshold coverage trigger. If you haven't documented consent and your purpose for each sensitive data flow, do it now.

Data Broker Framework Activates

If your business sells or licenses personal data to third parties as a primary activity, you likely qualify as a data broker under SB 4. The registration framework activates October 1, with the actual registration deadline of January 1, 2027. Start now:

1. Determine whether your business meets the SB 4 definition of a data broker
2. Identify the Connecticut Department of Consumer Protection as the registration authority
3. Budget $2,500 for the initial registration fee plus $2,500 annually
4. Prepare the required disclosures: how consumers can exercise CTDPA rights, which personal data categories you collect, and your regulatory exemptions under FCRA, GLBA, or HIPAA if applicable

How This Stacks Against Other State Laws

Connecticut SB 4 is part of a broader wave of state privacy law tightening in 2026. For context:

• Colorado: The original Colorado AI Act (SB 205) was replaced by SB 26-189 signed May 14, 2026. The new Colorado law sets notice, explanation and human review duties for automated tools used in consequential decisions (employment, lending, housing and others) from January 1, 2027. See our Colorado SB 26-189 guide.
• Connecticut SB 5 (AI law): Separate from SB 4, Connecticut's AI-specific law covers automated employment decision tools and has its own October 2026 requirements. See our Connecticut SB 5 checklist.
• Multi-state compliance: If you have users in multiple states, the CTDPA joins California (CCPA/CPRA), Virginia (VCDPA), Colorado (CPA), and a growing list of states with active consumer data rights laws. The multi-state compliance strategy guide covers how to build a single framework that covers the common requirements across all of them.

Action Checklist Before End of Day

Today (July 1, 2026):

• Run the four coverage questions above. Document your answer and the data that supports it.
• If covered: confirm you have a compliant privacy notice live on your website
• If covered: confirm you have a mechanism for consumers to submit rights requests (email or web form)
• If covered: confirm at least one person owns the CTDPA response queue

This week:

• Audit AI tool vendor agreements for CTDPA-compliant DPA language
• Identify any data flows touching newly expanded sensitive data categories
• For sensitive data processing: document the legal basis (consent is required for most categories)

Before October 1, 2026:

• Review and update any geolocation data sharing or selling arrangements
• Complete sensitive data processing documentation
• Evaluate whether your business qualifies as a data broker

Before January 1, 2027:

• If you are a data broker: register with the Connecticut Department of Consumer Protection and pay the $2,500 fee

Correction (October 20, 2026): Earlier versions credited the July 1, 2026 threshold changes to SB 4 (Public Act 26-64), said the expanded sensitive data categories become enforceable October 1, described the geolocation rule as a ban "without express opt-in consent," and kept the old 25,000-consumer revenue test. The July 1 changes, including the sensitive data categories, come from Public Act 25-113 (Connecticut Attorney General); SB 4's rules start October 1, 2026 (Attorney General, September 16, 2026), and the revenue test was replaced by the sale trigger.

Related Reading

• AI Data Privacy for Small Teams
• Multi-State AI Compliance Strategy 2026
• Connecticut AI Law (SB 5) Compliance Checklist
• Connecticut SB 5 October 2026 Employer Checklist
• GDPR AI Fines 2026: Enforcement Cases