CTDPA

Connecticut's law took effect July 1, 2023 and has been amended three times. The 2025 amendment, in force since July 1, 2026, dropped the threshold to 35,000 consumers and added no-threshold triggers: any controller that processes sensitive data or sells personal data is in scope. SB 4 (Public Act 26-64) restricts the sale of precise geolocation data from October 1, 2026 and requires data brokers to register by January 1, 2027. Controllers must honor opt-outs of targeted advertising and sale, obtain consent for sensitive data, and, since January 1, 2025, recognize universal opt-out signals such as Global Privacy Control. Separate provisions limit targeted advertising to anyone under 18. The Attorney General enforces; the automatic cure period ended after 2024, and willful violations reach $5,000 each under the state unfair trade practices act. The AG's enforcement reports describe cure notices over non-functioning opt-outs, the defect an outside scan finds first.