Connecticut Data Privacy Act, Attorney General enforcement

Conn. Gen. Stat. § 42-525

A citation is an address, not a summary. The first part names the law; what follows narrows it to the exact section, article or paragraph.

What follows is LexLint's own research summary of this law, not legal advice.

In force since 1 July 2023.

An enforcement supervision rule binding private bodies.

As of 27 August 2026.

What it requires

Expect CTDPA violations to be enforced exclusively by the Connecticut Attorney General as an unfair trade practice, never by a private plaintiff.
Do not assume a cure opportunity as of right. The mandatory 60-day cure period ended December 31, 2024; since January 1, 2025 the Attorney General decides whether to offer a cure at all.

If you get it wrong

Private right of actionNo

What this law does

Drafted with AI from the cited sources under the direction of UnGovr staff. UnGovr holds editorial responsibility for this page.

The Connecticut Attorney General has exclusive authority to enforce CTDPA as an unfair trade practice under section 42-110b. A cure period was mandatory (60 days) from July 1, 2023 through December 31, 2024; from January 1, 2025 it became discretionary, weighed against factors including violation count, controller size, likelihood of public injury, and data sensitivity. The chapter creates no private right of action.

When LexLint raises it

crawls_web
trains_models
deploys_chatbot
automated_outreach

Read the law

official Connecticut statute text, Chapter 743jj, Connecticut General Statutes

Every line above is drawn from the primary source linked here, read on the date shown. This is a research summary, not legal advice.

Back to the example · Lint your app