CTDPA: The Complete Guide
The Connecticut Data Privacy Act, signed into law in May 2022 and effective July 1, 2023, represents Connecticut's entry into the growing landscape of US state privacy legislation. The CTDPA draws heavily from the Virginia and Colorado privacy laws while incorporating several consumer-friendly provisions.
What the CTDPA Covers
The CTDPA grants Connecticut consumers the right to access, correct, delete, and obtain a portable copy of their personal data. Consumers may opt out of targeted advertising, the sale of personal data, and profiling that produces legal or similarly significant effects.
Like the Colorado Privacy Act, the CTDPA requires controllers to recognize universal opt-out mechanisms beginning January 1, 2025. This means businesses must detect and honor signals such as the Global Privacy Control without requiring consumers to submit individual requests.
Processing of sensitive data — including racial or ethnic origin, religious beliefs, health information, biometric data, precise geolocation, and data concerning children — requires opt-in consent. The CTDPA also includes specific transparency requirements for loyalty and rewards programs.
Who Needs to Comply
The CTDPA applies to entities that conduct business in Connecticut or produce products or services targeted to Connecticut residents and that, during the prior calendar year, either controlled or processed personal data of at least 100,000 consumers (excluding payment transaction data), or controlled or processed data of at least 25,000 consumers while deriving more than 25% of gross revenue from the sale of personal data.
Entities and data covered by HIPAA, GLBA, FERPA, and certain other federal laws are exempt.
Enforcement
The Connecticut Attorney General holds exclusive enforcement authority. An initial 60-day cure period applied until December 31, 2024. Civil penalties are assessed under the Connecticut Unfair Trade Practices Act, reaching up to $5,000 per willful violation.
Practical Compliance Steps
- Applicability assessment — Evaluate processing thresholds against Connecticut consumer data
- Universal opt-out — Implement GPC and similar signal recognition
- Sensitive data consent — Deploy opt-in consent flows for sensitive personal data categories
- Rights fulfillment — Establish 45-day response processes for consumer requests with a 45-day extension if needed
- Loyalty programs — Ensure transparency in how personal data is used in rewards and loyalty programs
- Vendor contracts — Update processor agreements to include CTDPA-required provisions