Key Facts
Overview
The CTDPA features two unique elements among US state privacy laws: a consent revocation mechanism for sensitive data, and a prohibition on selling children's data or using it for targeted advertising even with consent (2025 amendment). The cure period was eliminated January 2025.
What This Means for Your Website
- GPC signals must be honored since January 2025
- Sensitive data requires opt-in consent with a unique revocation mechanism
- Sale of data from minors under 18 is prohibited even with consent
- Children under 13 require parental consent
- No cure period: the AG can take immediate enforcement action
- An age-appropriate design code for children's online services takes effect in 2026
Key Requirements
The Connecticut AG enforces the CTDPA with penalties up to $5,000 per willful violation, plus potential actual and punitive damages. Consumer requests must be fulfilled within 45 days. The 2025 amendments significantly strengthened protections for children's data, with active investigations targeting messaging, gaming, and chatbot platforms.
How ConsentStack Handles This
ConsentStack applies the CTDPA's opt-out model for Connecticut visitors with opt-in for sensitive data and enhanced protections for minors, including blocking data sales for under-18 visitors.
Penalties
Up to $5,000 per willful violation; courts may also award actual and punitive damages.
Key Requirements
- Honor GPC/universal opt-out signals since January 2025
- Opt-in consent for sensitive data with revocation mechanism
- Privacy notice with categories, purposes, and third parties
- Consumer rights: access, correct, delete, port, opt-out
- Data protection assessments for high-risk processing
Notable Provisions
- Cure period eliminated January 2025
- Unique consent revocation mechanism for sensitive data
- Children data sale/advertising prohibited even with consent (2025)
- Age-appropriate design code coming 2026
Data Subject Rights
Confirm whether a controller is processing your personal data and access it, including inferences drawn from it and whether it is used for profiling to make decisions with legal or similarly significant effects.
Correct inaccuracies in your personal data, taking into account the nature of the data and the purposes of the processing.
Delete personal data you provided or that was obtained about you, plus publicly available information compiled into a consumer profile offered on a public website or made available for sale, and any inference generated from that public information.
Obtain a copy of your personal data in a portable and, where technically feasible, readily usable format you can transmit to another controller, where the processing is automated.
Opt out of the processing of your personal data for targeted advertising, including through an opt-out preference signal such as a browser setting or extension.
Opt out of the sale of your personal data, including through an opt-out preference signal such as a browser setting or extension.
Opt out of profiling in furtherance of any automated decision with legal or similarly significant effects, such as decisions about financial or lending services, housing, insurance, education, criminal justice, employment or health care.
If profiling led to an automated decision with legal or similarly significant effects about you, then where feasible question the result, learn the reason for it and review the data used; for housing decisions, also correct inaccurate data and have the decision reevaluated.
Obtain a list of the third parties a controller sold your personal data to or, if it keeps no consumer-specific list, a list of all third parties it has sold personal data to.
Appeal a controller's refusal to act on your request through an appeal process that must be conspicuously available and similar to the request process, and receive a written decision with reasons.
If your appeal is denied, the controller must give you an online mechanism, if available, or another method to contact the Connecticut Attorney General and submit a complaint.
Designate another person, including through a technology such as an Internet link, browser setting, browser extension or global device setting, to opt out on your behalf; this agent right covers opt-outs only.
Revoke consent you gave a controller, such as consent to process your sensitive data, through a mechanism at least as easy as the one you used to give it, after which processing must stop.
A controller may not discriminate against you for exercising your rights, including by denying goods or services, charging different prices or providing a different level of quality, except for bona fide loyalty programs.
US State Specifics
Other North America Regulations
Frequently Asked Questions
CTDPA requires you to recognize an opt-out preference signal such as Global Privacy Control. Check whether GPC is working on your site to confirm the signal reaches you and that trackers actually stop firing when it does.
Stay compliant with CTDPA
ConsentStack helps you implement Opt-out consent for Connecticut, United States automatically.