Law / United States / 
Connecticut
Connecticut Data Privacy Act, consumer rights
In force since .
A data subject rights rule binding private bodies.
- Audit expectation
- none
What it requires
- Give a Connecticut consumer a means to confirm whether you process their personal data, access it, correct it, delete it, and receive a portable copy.
- Offer a Connecticut consumer an opt-out of targeted advertising, sale, and profiling in furtherance of decisions with legal or similarly significant effects, and honor a universal opt-out preference signal.
- Respond to a consumer rights request without undue delay and within 45 days of receipt, with one 45-day extension available.
- Extend a consumer's deletion right to publicly available information that is collated into a consumer profile made available to users of a publicly accessible website, or that is made available for sale, and to any inference generated from that information.
These lines are LexLint's reading of the law's text. Also read by: Office of the Attorney General of Connecticut (guidance, recorded ).
In the frameworks
- NIST Privacy Framework
- CT.PO-P3Policies, processes, and procedures for enabling individuals’ data processing preferences and requests are established and in place.
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
Who enforces it
Settledness
- As of
- Guidance link
- https://portal.ct.gov/ag/sections/privacy/the-connecticut-data-privacy-act
- Guidance body
- Office of the Attorney General of Connecticut
- Open questions
- Which decisions about a consumer's account or access on a digital service amount to a denial of 'access to essential goods or services' under Conn. Gen. Stat. § 42-515(15), so that the profiling opt-out in section 42-518(a)(5) applies to them?
What it makes you log
What the log must hold
Decision basis
Logging duty
Section 42-518(c)(4) lets a controller deny an opt-out request only on a good faith, reasonable and documented belief that it is fraudulent, and puts on the controller the burden of showing a request is manifestly unfounded, excessive or repetitive; both imply a record of the grounds for the decision but name no log, fields or period. Section 42-518(c)(5)(A) offers a controller that obtained data from a third party a choice: retain a record of the deletion request and the minimum data needed to keep the data deleted, or opt the consumer out; that record is one route to deemed compliance, not a duty. The Attorney General's power to require assessments is in section 42-522(c) and enforcement in section 42-525, neither cited by this row. Section 42-518 states no scope clause of its own (the consumer definition and the reach of the Act are in sections 42-515 and 42-516), so the hook is left empty.
- Kind
- Implicit
- As of
- Provision
- Conn. Gen. Stat. 42-518(c)(4)
- Trigger
- personal_data_processing
What this law does
CTDPA gives a Connecticut consumer the right to confirm processing, access, correct, delete, obtain a portable copy, and opt out of targeted advertising, sale, and qualifying profiling. A controller must respond without undue delay and no later than 45 days after receipt, with one 45-day extension available.
Public Act 25-113 (S.B. 1295, 2025 session, effective ) removed the 'solely automated' qualifier so the profiling opt-out and a new right to contest automated-decision outcomes reach decisions with human involvement, and its Sec. 11 (amending section 42-522) adds a new impact-assessment requirement for such profiling applying to processing activities created or generated on or after , confirmed against the enrolled act's own text.
Public Act 26-64 (Senate Bill 4) amends this section with effect from . From that date the right to delete reaches publicly available information that is collated into a consumer profile made available to users of a publicly accessible website, or that is made available for sale, and any inference generated from that information.
When LexLint raises it
When your app profile says your app makes high-risk automated decisions or processes personal data.
Back to the example · Lint your app
Page updated .