Law / United States / 
Connecticut
Connecticut Data Privacy Act, Attorney General enforcement
In force since .
An enforcement supervision rule binding private bodies.
- Private right of action
- No
- Audit expectation
- none
What it requires
- Expect CTDPA violations to be enforced exclusively by the Connecticut Attorney General as an unfair trade practice, never by a private plaintiff.
- Do not assume a cure opportunity as of right. The mandatory 60-day cure period ended ; since the Attorney General decides whether to offer a cure at all.
These lines are LexLint's reading of the law's text. Also read by: Office of the Attorney General of Connecticut (guidance, recorded ).
Who enforces it
Settledness
- As of
- Guidance link
- https://portal.ct.gov/ag/sections/privacy/the-connecticut-data-privacy-act
- Guidance body
- Office of the Attorney General of Connecticut
- Open questions
- Can a private plaintiff sue under Conn. Gen. Stat. § 42-110g for conduct that violates the CTDPA, such as a deceptive-pattern consent flow, by pleading it as an independent unfair trade practice under section 42-110b, given that section 42-525(e) disapplies section 42-110g only for 'such violation' of the CTDPA?
What it makes you log
Logging duty
Section 42-525 gives the Attorney General exclusive enforcement of sections 42-515 to 42-524 and 42-526, sets the notice of violation and cure steps, and requires the Attorney General's own report to the legislative committee. It imposes no log or record duty on a controller. The Attorney General's power to require disclosure of a data protection assessment is in section 42-522(c), which this row does not cite. The section states no territorial clause, so the hook is left empty.
- Kind
- None
- As of
What this law does
The Connecticut Attorney General has exclusive authority to enforce CTDPA as an unfair trade practice under section 42-110b. A cure period was mandatory (60 days) from through ; from it became discretionary, weighed against factors including violation count, controller size, likelihood of public injury, and data sensitivity. The chapter creates no private right of action.
When LexLint raises it
When your app profile says your app processes personal data.
Back to the example · Lint your app
Page updated .