Connecticut Data Privacy Act Compliance with ConsentX

The Connecticut Data Privacy Act (CTDPA) is Connecticut's comprehensive consumer privacy law. It gives Connecticut residents rights over their personal data and establishes privacy obligations for covered businesses. The law took effect on July 1, 2023.

The CTDPA generally applies to organizations conducting business in Connecticut or targeting Connecticut residents that meet specified data-processing or sales thresholds. The Act also includes specific provisions covering certain consumer health data controllers and exemptions for particular organizations and types of data.

Connecticut consumers have rights including access to their personal data, correction of inaccurate personal data, deletion of personal data, data portability, information regarding certain third-party sales, opting out of the sale of personal data, opting out of targeted advertising and opting out of certain profiling activities. These rights are subject to applicable conditions and exceptions.

The CTDPA requires consent before processing a consumer's sensitive data. Not all processing activities require consent, so organizations should determine the applicable legal requirements for each processing activity.

Sensitive data includes certain categories of personal data such as racial or ethnic origin, religious beliefs, health information, sex life or sexual orientation, citizenship or immigration status, genetic or biometric data and certain precise location information. The CTDPA also contains specific protections relating to children's and minors' data.

Yes. Connecticut consumers have the right to opt out of the processing of their personal data for targeted advertising.

Yes. Consumers have the right to opt out of the sale of their personal data. Covered businesses must provide appropriate mechanisms for consumers to exercise this right.

Yes. Consumers can opt out of profiling in furtherance of decisions that produce legal or similarly significant effects concerning the consumer.

A Universal Opt-Out Preference Signal allows consumers to communicate certain privacy preferences across websites and businesses through a browser or other privacy mechanism. Beginning January 1, 2025, businesses subject to the CTDPA must honor applicable opt-out preference signals from Connecticut consumers.

Yes. The Connecticut Attorney General identifies Global Privacy Control (GPC) as an example of an opt-out preference signal that consumers can use to communicate their privacy preferences. ConsentX supports GPC to help organizations operationalize applicable universal opt-out requirements.

The CTDPA regulates personal data processing rather than cookies specifically. Where cookies, trackers or similar technologies collect or process information that qualifies as personal data, organizations should evaluate the applicable CTDPA requirements and implement appropriate privacy controls.

Yes. Consumers have the right to appeal a controller's decision denying a consumer-rights request. A controller generally has 60 days after receiving an appeal to respond with the outcome and reasons for its decision.

Yes. Controllers must conduct data protection assessments for certain processing activities that present a heightened risk of harm to consumers. These assessments can apply to activities involving sensitive data, targeted advertising, profiling and the sale of personal data.

The Connecticut Attorney General has exclusive enforcement authority under the CTDPA. Violations may result in civil penalties of up to $5,000 per violation, along with other available remedies such as injunctive relief, restitution or disgorgement.

ConsentX provides technology that can support important CTDPA privacy operations, including consent management, sensitive-data consent, consumer opt-outs, GPC support, tracker discovery, prior-script blocking, consumer-rights workflows and privacy evidence. However, ConsentX alone does not guarantee CTDPA compliance. Organizations must assess their complete data-processing activities, privacy notices, security controls, contracts, data protection assessments and other applicable legal obligations.