Law / United States / 
Connecticut
Connecticut Data Privacy Act (CTDPA), publicly available information exemption
Conn. Gen. Stat. §§ 42-515 to 42-526 (Public Act 22-15, as amended)
In force since .
A personal data rule binding private bodies.
- How the hook was established
- express
- What makes it apply
- Operator establishment, Market targeting
- Audit expectation
- on_request
- Who audits it
- Self
- Where the report goes
- Kept, Produced on request
What it requires
- Personal data that is made available through a government record or to the general public from widely distributed media, or that a controller or processor has a reasonable basis to believe the consumer has lawfully made available to the general public, falls outside the CTDPA's definition of personal data entirely, so scraping it does not by itself trigger the Act's duties, unless it is biometric data about a consumer collected by a business without the consumer's knowledge, or information the consumer provided on a public web site or online service while restricting it to a specific audience.
- If you meet the CTDPA's applicability thresholds (since , the personal data of at least 35,000 consumers, any processing of consumers' sensitive data, or offering personal data for sale), personal data you collect that is not publicly available in the Act's own sense still triggers the Act's business obligations, including when it feeds AI training, and your privacy notice must state whether you collect, use or sell personal data to train large language models.
- Do not assume a court will read the reasonable-basis-to-believe standard broadly; no Connecticut case has tested it.
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST AI RMF
- MEASURE 2.8Risks associated with transparency and accountability – as identified in the MAP function – are examined and documented.
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
Who enforces it
Settledness
- As of
- Open questions
- Does a controller that collects a consumer's public social media post have "a reasonable basis to believe" that the consumer "has lawfully made available to the general public" the post under section 42-515(35)(A)(ii), when the consumer set no audience restriction?
- When has a consumer "maintained a reasonable expectation of privacy" in information provided on a publicly accessible web site under section 42-515(35)(B)(v)(II), if the consumer did not restrict the audience?
What it makes you log
Who may demand the log
Regulator
What the log must hold
Input reference, Output reference
Logging duty
Section 42-522(b)(1) requires a controller to conduct and document a data protection assessment for each processing activity that presents a heightened risk of harm to a consumer (targeted advertising, sale, certain profiling, sensitive data), and 42-522(c) requires an impact assessment for profiling that produces legal or similarly significant effects, which must describe the categories of data used as inputs, the outputs, performance metrics and post-deployment monitoring. The Attorney General may require a controller to disclose an assessment relevant to an investigation, and assessments are confidential and exempt from the Freedom of Information Act (42-522(d)). Section 42-521(b)(3) and (5) has a processor make compliance information available to the controller and give it an assessment report on request. The data protection assessment requirement applies to processing activities created or generated after and the impact assessment requirement to those created or generated on or after (42-522(g)). The row's scraping-specific text is the publicly available information exclusion in 42-515(35), which states no record duty; these duties bind a scraper that is a controller within section 42-516. The section states no retention period.
- Kind
- Implicit
- As of
- Provision
- Conn. Gen. Stat. § 42-522(b)(1) and (c)
- Trigger
- personal_data_processing
What this law does
Section 42-515(28) defines personal data to exclude de-identified data or publicly available information outright, and section 42-515(35), as amended by Public Act 26-64 effective , defines publicly available information as information that is made available through federal, state or local government records or to the general public from widely distributed media, or that a controller or processor, or an affiliate of a controller or processor, has a reasonable basis to believe the consumer has lawfully made available to the general public.
It does not include biometric data about a consumer collected by a business without the consumer's knowledge. It also does not include information a consumer provided on a publicly accessible web site or online service where the consumer has maintained a reasonable expectation of privacy, including by restricting the information to a specific audience.
Because the exclusion operates on the definition of personal data itself, most scraped public-record or publicly posted personal data falls outside the CTDPA's scope entirely, not merely outside a narrower carve-out from an otherwise-applicable duty.
Since the Act applies to persons that conduct business in Connecticut or produce products or services targeted to its residents and, in the preceding calendar year, controlled or processed the personal data of not fewer than 35,000 consumers (excluding personal data processed solely to complete a payment transaction), and to persons that control or process consumers' sensitive data or offer consumers' personal data for sale in trade or commerce.
Also from , a controller's privacy notice must include a statement disclosing whether the controller collects, uses or sells personal data for the purpose of training large language models.
Two other amendments made by Public Act 25-113, effective , added a right to question the result of profiling behind an automated decision with a legal or similarly significant effect and a duty to conduct an impact assessment for such profiling that applies to processing activities created or generated on or after ; neither of those two changes the publicly-available exemption itself. CTDPA was enacted as Public Act 22-15 and, per its own effective-date history note, took effect .
When LexLint raises it
When your app profile says your app crawls the web, trains models or processes biometric data.
Back to the example · Lint your app
Page updated .