Page traduite et vérifiée automatiquement. La version anglaise fait foi. Certaines parties restent en anglais le temps que leur traduction soit vérifiée. Voir en anglais · Signaler une erreur de traduction
Réglementations › États américains › Connecticut
CTDPA
Connecticut Data Privacy Act
QuandEn vigueur depuis le 1er juillet 2023
Qui en assure l’applicationProcureur général de l’État
À qui elle s’appliqueEntreprises qui traitent des données personnelles des résidents de l’État au-delà des seuils fixés par la loi. Les seuils, les exemptions et les règles relatives aux données sensibles varient d’un État à l’autre.
SeuilsÀ partir du 1er juillet 2026 : 35,000+ consommateurs, ou tout responsable du traitement qui traite des données sensibles ou propo…
Opposition universelleLes responsables du traitement doivent respecter les signaux universels de préférence de refus pour la publicité ciblée et les ventes depuis j…
Période de régularisationLe délai de régularisation obligatoire de 60 jours a pris fin le 31 décembre 2024
Délai de réponse aux demandes45 jours, prolongeable une fois de 45 jours
Sanction maximaleJusqu’à $5,000 par violation délibérée en vertu du CUTPA, plus restitution, remise des gains et injonctions
Action privéeAucun droit d’action privé au titre du CTDPA.
Every requirement we score, with the rule in plain words and the section it comes from. Darker means more demanding. See every law side by side →
Champ d'application
Seuils
3
From July 1, 2026: 35,000+ consumers, or any controller that processes sensitive data or offers personal data for sale, regardless of volume.Conn. Gen. Stat. § 42-516 · secondary source · source ↗
Public Act 25-113 (SB 1295), effective July 1, 2026; statute and Act text could not be fetched this session (cga.ct.gov URL blocked), so subsection numbers are unconfirmed. Previously 100,000, or 25,000 plus 25% revenue.
Exemptions
2
GLBA exemption narrowed to data level in 2026; HIPAA entity exemption and nonprofit exemption appear to remain.Conn. Gen. Stat. § 42-517 · secondary source · source ↗
Public Act 25-113 (SB 1295), effective July 1, 2026; statute and Act text could not be fetched this session (cga.ct.gov URL blocked), so subsection numbers are unconfirmed. AG's 2024 report confirmed nonprofit and entity-level GLBA/HIPAA exemptions before the amendment; HIPAA and nonprofit status after July 2026 not confirmed.
Données sensibles et mineurs
Données sensibles
2
Consent plus reasonable necessity for sensitive data, which now includes consumer health, neural, financial account and government ID data and transgender/nonbinary status.Conn. Gen. Stat. §§ 42-515, 42-520 · secondary source · source ↗
Public Act 25-113 (SB 1295), effective July 1, 2026; statute and Act text could not be fetched this session (cga.ct.gov URL blocked), so subsection numbers are unconfirmed.
Enfants et adolescents
3
Minors 13 to 17: targeted advertising and sale banned regardless of consent, engagement-extending design barred, heightened assessments; under 13 per COPPA.Conn. Gen. Stat. § 42-529a et seq. · secondary source · source ↗
Public Act 25-113 (SB 1295), effective July 1, 2026; statute and Act text could not be fetched this session (cga.ct.gov URL blocked), so subsection numbers are unconfirmed.
Minimisation des données
2
Collection must be reasonably necessary and proportionate to disclosed purposes; material new secondary uses need fresh consent.Conn. Gen. Stat. § 42-520 · secondary source · source ↗
Public Act 25-113 (SB 1295), effective July 1, 2026; statute and Act text could not be fetched this session (cga.ct.gov URL blocked), so subsection numbers are unconfirmed.
Droits des consommateurs
Droits
3
Access (incl. inferences), correct, delete, portability, three opt-outs, list of third parties sold to, and explanation and review of profiling decisions.Conn. Gen. Stat. § 42-518 · secondary source · source ↗
Public Act 25-113 (SB 1295), effective July 1, 2026; statute and Act text could not be fetched this session (cga.ct.gov URL blocked), so subsection numbers are unconfirmed.
Délai de réponse aux demandes
2
45 days, extendable once by 45 days.Conn. Gen. Stat. § 42-518 · secondary source · source ↗
Deadline from pre-amendment statute knowledge; not read this session.
Recours
2
Internal appeal answered within 60 days, with an online way to contact the Attorney General if denied.Conn. Gen. Stat. § 42-518 · secondary source · source ↗
Appeal timing from statute knowledge; AG report mentions appeal duties but not timing.
Opposition universelle
2
Controllers must honor universal opt-out preference signals for targeted ads and sales since January 1, 2025.Conn. Gen. Stat. § 42-518 · source ↗
Subsection not confirmed.
Obligations des entreprises
Évaluations
3
Data protection assessments plus a separate profiling impact assessment for significant decisions, for processing created on or after August 1, 2026; AG may request them.Conn. Gen. Stat. § 42-522 · secondary source · source ↗
Public Act 25-113 (SB 1295), effective July 1, 2026; statute and Act text could not be fetched this session (cga.ct.gov URL blocked), so subsection numbers are unconfirmed. Scored 3 for algorithmic (profiling) impact assessments.
Contrats de sous-traitance
3
Contract with instructions, confidentiality, deletion, compliance info, assessments, and subcontractor flow-down after notice and chance to object.Conn. Gen. Stat. § 42-521 · secondary source · source ↗
Terms from statute knowledge (Virginia model with Connecticut objection right); not read this session.
Politique de confidentialité
2
Notice must disclose LLM training use, profiling and targeted ads, be linked with the word 'privacy', translated and accessible.Conn. Gen. Stat. § 42-520 · secondary source · source ↗
Public Act 25-113 (SB 1295), effective July 1, 2026; statute and Act text could not be fetched this session (cga.ct.gov URL blocked), so subsection numbers are unconfirmed.
Programmes de fidélité
1
Different prices allowed for voluntary participation in bona fide loyalty or rewards programs.Conn. Gen. Stat. § 42-520 · secondary source · source ↗
From statute knowledge; not read this session.
Données désidentifiées
3
Public commitment, reasonable measures and contract flow-down for deidentified data; pseudonymous data rules mirror Virginia.Conn. Gen. Stat. § 42-523 · secondary source · source ↗
From statute knowledge; not read this session.
Application
Autorité de contrôle
1
Attorney General enforces as an unfair trade practice under CUTPA.Conn. Gen. Stat. § 42-525; § 42-110a et seq. · source ↗
Période de régularisation
1
Mandatory 60-day cure ended December 31, 2024; the AG may still allow a cure at its discretion.Conn. Gen. Stat. § 42-525 · source ↗
Sanction maximale
1
Up to $5,000 per willful violation under CUTPA, plus restitution, disgorgement and injunctions.Conn. Gen. Stat. § 42-110o(b) · source ↗
Section 42-110o not named in AG report; cite from statute knowledge. Snell & Wilmer notes $2,500 for non-willful violations.
Action privée
0
No private right of action under the CTDPA.Conn. Gen. Stat. § 42-525 · secondary source · source ↗
Pouvoir réglementaire
0
No rulemaking authority.Conn. Gen. Stat. § 42-515 et seq. · secondary source · source ↗
No rulemaking provision reported.
Scores are our reading on the published rubric, checked 18 October 2026. Not legal advice.
Bibliothèque des réglementations
Toutes les lois des États américains sur la vie privée, sur une seule carte
24 États disposent d’une loi générale sur la vie privée dans la bibliothèque, aux côtés des lois de l’UE, du Royaume-Uni, des lois fédérales américaines et des lois du reste du monde : 102 au total, chacune expliquée en termes simples avec ses sources. Sélectionnez un État pour voir ce qui s’y applique.
- En vigueur
- Entrée en vigueur prochaine
- Lois sectorielles