Connecticut Data Privacy Act (CTDPA) Reference Guide

The CTDPA covers people doing business in Connecticut or producing products or services targeted to residents when the statutory conditions apply. Since July 1, 2026, the general threshold includes processing personal data of at least 35,000 consumers in the previous year, excluding data processed solely to complete a payment transaction. The law also reaches entities that process consumers’ sensitive data or offer personal data for sale in trade or commerce, without using that 35,000 threshold as the only gate. Attorney General: who is covered General Assembly: § 42-516

A consumer health data controller doing business in the state or targeting its residents has a separate coverage path without a general size or data-volume threshold, and the ordinary nonprofit exemption does not automatically apply to that role. Other exemptions for organizations or specific data remain relevant. Attorney General: consumer health data FAQ

Counsel should confirm which entity handles each dataset, whether it is sensitive or consumer health data, and whether the statutory data-level or entity-level exemptions apply. A scan can observe tracking; it cannot decide that legal scope.

Eligible residents can seek access, correction, deletion, a portable copy, and a list of third parties to which their data was sold. They may opt out of sales, targeted advertising, and specified profiling. Covered controllers must explain how to exercise rights and provide an accessible website or app opt-out link for targeting and sales. Attorney General: consumer rights and requests

Controllers generally have 45 days to respond to a request, with a permitted 45-day extension in specified circumstances. A denied request has an appeal route, with a response generally due within 60 days. Sensitive-data processing requires consent, and defined high-risk processing requires an assessment. Attorney General: controller duties

A website may record a visitor’s choice and still send identifiers to advertising platforms. A tag fired through Tag Manager, a hard-coded script, an embedded form, or a server-side route can each produce observable traffic. A technical review follows the signal through those paths instead of treating the banner display as proof of enforcement.

The Attorney General’s enforcement report describes cookie banners that undermined or overrode privacy choices. Connecticut also joined a multistate investigation of Global Privacy Control compliance in 2025. These are reasons to test real post-choice behavior; neither event means every request to an ad vendor is automatically a legal violation. Connecticut Attorney General: joint GPC sweep Connecticut Attorney General: CTDPA report

Since January 1, 2025, covered controllers must honor qualifying universal opt-out preference signals for sales and targeted advertising. The Attorney General identifies Global Privacy Control (GPC) as an example. The signal must come from a platform or mechanism that lets the controller accurately determine Connecticut residency. A conflicting earlier preference does not override the signal; the controller may notify the visitor and seek confirmation in the circumstances described by the law. Connecticut Attorney General: universal opt-out FAQ

Test an actual Connecticut visitor path: the browser sends the signal, the site interprets it, the preference reaches every relevant tag or server rule, and the post-choice traffic reflects the result. Direct website opt-out controls also need to work.

Connecticut’s Attorney General has exclusive CTDPA enforcement authority. Under the Connecticut Unfair Trade Practices Act, civil penalties can reach $5,000 per violation, alongside possible injunctive relief, restitution, or disgorgement. The CTDPA does not create a private cause of action. The stated maximum is not a per-pageview estimate. Attorney General: enforcement FAQ

The 2025 multistate sweep focused on browser opt-out signals. The Attorney General’s 2026 report describes ongoing investigations and expanded attention to minors’ privacy. These activities make clear why a working control and evidence of its effect matter. Connecticut Attorney General: joint sweep Connecticut Attorney General: 2026 report

A privacy team establishes whether the CTDPA applies to the organization and each data use. Technical owners translate that determination into tag triggers, consent states, and scripts. A shared record avoids an opt-out that works on one page but fails on another.

Use separate browser sessions to compare the site’s initial behavior, its response to a direct opt-out, and its response to Global Privacy Control where relevant to your review. Record the page URL, test time, browser settings and exact choice made so the result can be reproduced.

Inspect cookies and network requests before and after each choice. Record which requests continue, their destinations and the controls involved. Browser evidence can help diagnose an implementation; it cannot establish statutory applicability, the legal purpose of every transfer or organization-wide compliance.

Legal interpretation, applicability, exemptions, notices, vendor contracts, rights requests, sensitive and health data, minors, and governance should be handled by qualified privacy counsel.

This guide relies on the Connecticut General Assembly’s 2026 statutory supplement and the Attorney General’s CTDPA guidance, enforcement reports, and September 2026 notice. It reflects the October 1 amendments now in force, distinguishes later data-broker registration, and does not infer legal scope from a browser scan.

Prepared by Etalon Editorial Team. Last reviewed October 9, 2026. Material corrections may be sent to contact@etalondata.com.

Etalon is not a law firm and does not provide legal advice. A passing scan or certificate does not guarantee that an organization satisfies every legal obligation.

Technical testing records observable website behavior. Your legal and privacy team remains responsible for CTDPA applicability, exemptions, vendor classification, notices, consumer requests, sensitive and health data, minors, contracts, assessments, and governance.