The Connecticut Data Privacy Act (CTDPA) is Connecticut's comprehensive consumer privacy law. It gives Connecticut residents rights over their personal data and establishes privacy obligations for covered businesses. The law took effect on July 1, 2023.

Who needs to comply with the CTDPA?

The CTDPA generally applies to organizations conducting business in Connecticut or targeting Connecticut residents that meet specified data-processing or sales thresholds. The Act also includes specific provisions covering certain consumer health data controllers and exemptions for particular organizations and types of data.

What rights does the CTDPA provide?

Connecticut consumers have rights including access to their personal data, correction of inaccurate personal data, deletion of personal data, data portability, information regarding certain third-party sales, opting out of the sale of personal data, opting out of targeted advertising and opting out of certain profiling activities. These rights are subject to applicable conditions and exceptions.

Does the CTDPA require consent?

The CTDPA requires consent before processing a consumer's sensitive data. Not all processing activities require consent, so organizations should determine the applicable legal requirements for each processing activity.

What is sensitive data under the CTDPA?

Sensitive data includes certain categories of personal data such as racial or ethnic origin, religious beliefs, health information, sex life or sexual orientation, citizenship or immigration status, genetic or biometric data and certain precise location information. The CTDPA also contains specific protections relating to children's and minors' data.

Does the CTDPA regulate targeted advertising?

Yes. Connecticut consumers have the right to opt out of the processing of their personal data for targeted advertising.

Does the CTDPA regulate the sale of personal data?

Yes. Consumers have the right to opt out of the sale of their personal data. Covered businesses must provide appropriate mechanisms for consumers to exercise this right.

Does the CTDPA regulate profiling?

Yes. Consumers can opt out of profiling in furtherance of decisions that produce legal or similarly significant effects concerning the consumer.

What is a Universal Opt-Out Preference Signal?

A Universal Opt-Out Preference Signal allows consumers to communicate certain privacy preferences across websites and businesses through a browser or other privacy mechanism. Beginning January 1, 2025, businesses subject to the CTDPA must honor applicable opt-out preference signals from Connecticut consumers.

Does Connecticut recognize Global Privacy Control?

Yes. The Connecticut Attorney General identifies Global Privacy Control (GPC) as an example of an opt-out preference signal that consumers can use to communicate their privacy preferences. ConsentX supports GPC to help organizations operationalize applicable universal opt-out requirements.

Does the CTDPA apply to cookies?

The CTDPA regulates personal data processing rather than cookies specifically. Where cookies, trackers or similar technologies collect or process information that qualifies as personal data, organizations should evaluate the applicable CTDPA requirements and implement appropriate privacy controls.

Does the CTDPA provide a right to appeal?

Yes. Consumers have the right to appeal a controller's decision denying a consumer-rights request. A controller generally has 60 days after receiving an appeal to respond with the outcome and reasons for its decision.

Does the CTDPA require data protection assessments?

Yes. Controllers must conduct data protection assessments for certain processing activities that present a heightened risk of harm to consumers. These assessments can apply to activities involving sensitive data, targeted advertising, profiling and the sale of personal data.

What are the penalties for CTDPA violations?

The Connecticut Attorney General has exclusive enforcement authority under the CTDPA. Violations may result in civil penalties of up to $5,000 per violation, along with other available remedies such as injunctive relief, restitution or disgorgement.

Connecticut, United States

Connecticut Data Privacy Act Compliance with ConsentX

Simplify Connecticut Data Privacy Act Compliance

ConsentX helps organizations operationalize the Connecticut Data Privacy Act (CTDPA) with consent management, privacy preference controls, Universal Opt-Out support, tracker discovery, consumer rights workflows and audit-ready privacy records.

The CTDPA gives Connecticut consumers greater control over their personal data and establishes obligations for businesses that collect and process it. ConsentX helps organizations provide transparent privacy choices, honor consumer preferences and maintain evidence of privacy decisions across digital experiences.

Region

Connecticut, United States

Status

In force

Group

United States

Who it applies to

The Connecticut Data Privacy Act generally applies to organizations conducting business in Connecticut or targeting products or services to Connecticut residents that meet applicable thresholds under the Act.

The CTDPA generally covers organizations that control or process personal data of at least 35,000 consumers, excluding certain payment-only processing, or control or process sensitive data or offer consumers' personal data for sale, subject to the Act's requirements and exemptions.

The CTDPA also contains specific provisions for consumer health data controllers and protections for children and minors.

Key obligations

Provide clear and meaningful privacy notices
Limit personal data collection to what is reasonably necessary
Specify the purposes for processing personal data
Obtain consent before processing sensitive data
Provide consumers with access rights
Provide correction rights
Provide deletion rights
Provide data portability
Allow consumers to opt out of the sale of personal data
Allow consumers to opt out of targeted advertising
Allow consumers to opt out of certain profiling activities
Honor Universal Opt-Out Preference Signals
Conduct data protection assessments for certain high-risk processing
Maintain reasonable data security practices
Protect consumer rights without unlawful discrimination

The CTDPA requires covered businesses to limit data collection, provide transparency, obtain consent for sensitive-data processing and honor applicable consumer privacy choices.

How ConsentX helps

Prior-Script Blocking

Prevent configured non-essential cookies, trackers and scripts from firing before the applicable consent or privacy preference has been established.

Transparent Consent Management

Create clear privacy experiences that explain how personal data may be collected and used.

Sensitive Data Consent

The CTDPA requires consumer consent before processing sensitive data.

Tracker & Technology Discovery

Use xScan-AI to discover cookies, trackers, scripts and third-party technologies operating across your website.

Geo-Aware Compliance

Apply Connecticut-specific privacy rules while managing multiple U.S. state privacy laws and global regulations from a single platform.

Opt-Out Management

Provide consumers with accessible controls to opt out of:

Universal Opt-Out & GPC

The CTDPA requires covered businesses to honor applicable Universal Opt-Out Preference Signals beginning January 1, 2025.

Data Protection Assessment Support

The CTDPA requires controllers to conduct data protection assessments for certain processing activities that present a heightened risk of harm to consumers.

Consent Records & Audit Evidence

Maintain an evidence trail of privacy choices and consent activity, including:

Purpose-Based Privacy Choices

Configure privacy preferences around specific processing activities, including:

Consumer Rights Management

The CTDPA provides Connecticut consumers with rights including access, correction, deletion and data portability, along with rights to opt out of the sale of personal data, targeted advertising and certain profiling activities.

Disclaimer: This page is a plain-English summary for general informational purposes and is not legal advice. CTDPA requirements can vary depending on an organization's activities, data processing, exemptions and applicable amendments or regulations. Organizations should obtain appropriate legal or privacy advice for their specific obligations.

CTDPA Compliance, Made Practical

DiscoverNotifyCapture ConsentOpt OutEnforceRecordRespond

ConsentX brings consent management, universal opt-out support, privacy preferences, technology discovery and consumer-rights workflows together in one platform.

Give privacy, legal, marketing and technology teams greater visibility and control over how consumer privacy choices are implemented across digital experiences.

Start Free Book a Demo

Frequently asked questions

ConsentX provides technology that can support important CTDPA privacy operations, including consent management, sensitive-data consent, consumer opt-outs, GPC support, tracker discovery, prior-script blocking, consumer-rights workflows and privacy evidence. However, ConsentX alone does not guarantee CTDPA compliance. Organizations must assess their complete data-processing activities, privacy notices, security controls, contracts, data protection assessments and other applicable legal obligations.

Related on ConsentX

Free Cookie Scanner Scan your website to discover cookies, trackers, scripts and third-party technologies that may collect or process personal data.Privacy Policy Generator Create privacy documentation based on your organization's data practices and applicable jurisdictions.Consent Management Platform Collect, manage and demonstrate consumer privacy preferences across websites and regions.

Other frameworks

GDPR UK GDPR CCPA / CPRA VCDPA Colorado CPA UCPA TDPSA Oregon OCPA Montana MCDPA Florida FDBR LGPD PIPEDA DPDPA PDPA POPIA FADP Law 25 LFPDPPP PDPL Law 21.719 Law 1581 Law 29733 Law 18.331 LOPDP

ConsentX

Who it applies to

The CTDPA also contains specific provisions for consumer health data controllers and protections for children and minors.

Key obligations

Provide clear and meaningful privacy notices

Limit personal data collection to what is reasonably necessary

Specify the purposes for processing personal data

Obtain consent before processing sensitive data

Provide consumers with access rights

Provide correction rights

Provide deletion rights

Provide data portability

Allow consumers to opt out of the sale of personal data

Allow consumers to opt out of targeted advertising

Allow consumers to opt out of certain profiling activities

Honor Universal Opt-Out Preference Signals

Conduct data protection assessments for certain high-risk processing

Maintain reasonable data security practices

Protect consumer rights without unlawful discrimination

The CTDPA requires covered businesses to limit data collection, provide transparency, obtain consent for sensitive-data processing and honor applicable consumer privacy choices.

Frequently asked questions

Connecticut Data Privacy Act Compliance with ConsentX

Who it applies to

Key obligations