Página traducida y verificada automáticamente. Prevalece la versión en inglés. Algunas partes siguen en inglés mientras se verifica su traducción. Ver en inglés · Informar un error de traducción
Regulaciones › Estados de EE. UU. › Connecticut
CTDPA
Ley de Privacidad de Datos de Connecticut
CuándoEn vigor desde el 1 de julio de 2023
Quién la aplicaFiscal General del estado
A quién se aplicaEmpresas que tratan datos personales de residentes del estado por encima de los umbrales de la ley. Los umbrales, las exenciones y las reglas sobre datos sensibles varían según el estado.
UmbralesDesde el 1 de julio de 2026: 35,000+ consumidores, o cualquier responsable que trate datos sensibles u ofrez…
Exclusión voluntaria universalLos responsables deben respetar las señales universales de preferencia de exclusión voluntaria para publicidad dirigida y ventas desde j…
Periodo de subsanaciónLa subsanación obligatoria de 60 días terminó el 2024 de diciembre de 31
Plazo de solicitudes45 días, prorrogable una vez 45 días
Sanción máximaHasta $5,000 por infracción dolosa según la CUTPA, más restitución, devolución de ganancias y medidas cautelares
Acción privadaSin derecho de acción privada según la CTDPA.
Every requirement we score, with the rule in plain words and the section it comes from. Darker means more demanding. See every law side by side →
A quién se aplica
Umbrales
3
From July 1, 2026: 35,000+ consumers, or any controller that processes sensitive data or offers personal data for sale, regardless of volume.Conn. Gen. Stat. § 42-516 · secondary source · source ↗
Public Act 25-113 (SB 1295), effective July 1, 2026; statute and Act text could not be fetched this session (cga.ct.gov URL blocked), so subsection numbers are unconfirmed. Previously 100,000, or 25,000 plus 25% revenue.
Exenciones
2
GLBA exemption narrowed to data level in 2026; HIPAA entity exemption and nonprofit exemption appear to remain.Conn. Gen. Stat. § 42-517 · secondary source · source ↗
Public Act 25-113 (SB 1295), effective July 1, 2026; statute and Act text could not be fetched this session (cga.ct.gov URL blocked), so subsection numbers are unconfirmed. AG's 2024 report confirmed nonprofit and entity-level GLBA/HIPAA exemptions before the amendment; HIPAA and nonprofit status after July 2026 not confirmed.
Datos sensibles y menores
Datos sensibles
2
Consent plus reasonable necessity for sensitive data, which now includes consumer health, neural, financial account and government ID data and transgender/nonbinary status.Conn. Gen. Stat. §§ 42-515, 42-520 · secondary source · source ↗
Public Act 25-113 (SB 1295), effective July 1, 2026; statute and Act text could not be fetched this session (cga.ct.gov URL blocked), so subsection numbers are unconfirmed.
Menores y adolescentes
3
Minors 13 to 17: targeted advertising and sale banned regardless of consent, engagement-extending design barred, heightened assessments; under 13 per COPPA.Conn. Gen. Stat. § 42-529a et seq. · secondary source · source ↗
Public Act 25-113 (SB 1295), effective July 1, 2026; statute and Act text could not be fetched this session (cga.ct.gov URL blocked), so subsection numbers are unconfirmed.
Minimización de datos
2
Collection must be reasonably necessary and proportionate to disclosed purposes; material new secondary uses need fresh consent.Conn. Gen. Stat. § 42-520 · secondary source · source ↗
Public Act 25-113 (SB 1295), effective July 1, 2026; statute and Act text could not be fetched this session (cga.ct.gov URL blocked), so subsection numbers are unconfirmed.
Derechos de los consumidores
Derechos
3
Access (incl. inferences), correct, delete, portability, three opt-outs, list of third parties sold to, and explanation and review of profiling decisions.Conn. Gen. Stat. § 42-518 · secondary source · source ↗
Public Act 25-113 (SB 1295), effective July 1, 2026; statute and Act text could not be fetched this session (cga.ct.gov URL blocked), so subsection numbers are unconfirmed.
Plazo de solicitudes
2
45 days, extendable once by 45 days.Conn. Gen. Stat. § 42-518 · secondary source · source ↗
Deadline from pre-amendment statute knowledge; not read this session.
Apelaciones
2
Internal appeal answered within 60 days, with an online way to contact the Attorney General if denied.Conn. Gen. Stat. § 42-518 · secondary source · source ↗
Appeal timing from statute knowledge; AG report mentions appeal duties but not timing.
Exclusión voluntaria universal
2
Controllers must honor universal opt-out preference signals for targeted ads and sales since January 1, 2025.Conn. Gen. Stat. § 42-518 · source ↗
Subsection not confirmed.
Obligaciones de las empresas
Evaluaciones
3
Data protection assessments plus a separate profiling impact assessment for significant decisions, for processing created on or after August 1, 2026; AG may request them.Conn. Gen. Stat. § 42-522 · secondary source · source ↗
Public Act 25-113 (SB 1295), effective July 1, 2026; statute and Act text could not be fetched this session (cga.ct.gov URL blocked), so subsection numbers are unconfirmed. Scored 3 for algorithmic (profiling) impact assessments.
Contratos con encargados
3
Contract with instructions, confidentiality, deletion, compliance info, assessments, and subcontractor flow-down after notice and chance to object.Conn. Gen. Stat. § 42-521 · secondary source · source ↗
Terms from statute knowledge (Virginia model with Connecticut objection right); not read this session.
Aviso de privacidad
2
Notice must disclose LLM training use, profiling and targeted ads, be linked with the word 'privacy', translated and accessible.Conn. Gen. Stat. § 42-520 · secondary source · source ↗
Public Act 25-113 (SB 1295), effective July 1, 2026; statute and Act text could not be fetched this session (cga.ct.gov URL blocked), so subsection numbers are unconfirmed.
Programas de fidelización
1
Different prices allowed for voluntary participation in bona fide loyalty or rewards programs.Conn. Gen. Stat. § 42-520 · secondary source · source ↗
From statute knowledge; not read this session.
Datos desidentificados
3
Public commitment, reasonable measures and contract flow-down for deidentified data; pseudonymous data rules mirror Virginia.Conn. Gen. Stat. § 42-523 · secondary source · source ↗
From statute knowledge; not read this session.
Aplicación de la ley
Quién la aplica
1
Attorney General enforces as an unfair trade practice under CUTPA.Conn. Gen. Stat. § 42-525; § 42-110a et seq. · source ↗
Periodo de subsanación
1
Mandatory 60-day cure ended December 31, 2024; the AG may still allow a cure at its discretion.Conn. Gen. Stat. § 42-525 · source ↗
Sanción máxima
1
Up to $5,000 per willful violation under CUTPA, plus restitution, disgorgement and injunctions.Conn. Gen. Stat. § 42-110o(b) · source ↗
Section 42-110o not named in AG report; cite from statute knowledge. Snell & Wilmer notes $2,500 for non-willful violations.
Acción privada
0
No private right of action under the CTDPA.Conn. Gen. Stat. § 42-525 · secondary source · source ↗
Facultad reglamentaria
0
No rulemaking authority.Conn. Gen. Stat. § 42-515 et seq. · secondary source · source ↗
No rulemaking provision reported.
Scores are our reading on the published rubric, checked 18 October 2026. Not legal advice.
Biblioteca de regulaciones
Todas las leyes estatales de privacidad de EE. UU., en un mapa
24 estados tienen una ley integral de privacidad en la biblioteca, junto con las leyes de la UE, del Reino Unido, federales de EE. UU. y globales: 102 en total, cada una explicada en palabras sencillas con sus fuentes. Seleccione un estado para ver qué se aplica allí.
- En vigor
- Entrada en vigor
- Leyes sectoriales