Law / United States / 
Connecticut
SB 3 (2023), online privacy, data and safety protections for minors
Conn. Gen. Stat. ch. 743jj (Public Act 23-56)
In force since .
A social media and minors rule binding private bodies.
- Private right of action
- No
- Penalties
- Enforced solely as an unfair trade practice by the Attorney General.
- Age threshold
- 18
- How the hook was established
- express
- What makes it apply
- User location
- Audit expectation
- continuous
- Who audits it
- Self
- Where the report goes
- Kept
What it requires
- As a social media platform, honour a minor's request to unpublish or delete their account (effective ).
- If you are a controller offering services to known minors under 18, use reasonable care against heightened risk of harm, including a bar on processing their data for targeted advertising or sale, limits on certain profiling, and precise geolocation collection only where strictly necessary (effective , amended effective ).
These lines are LexLint's reading of the law's text. Also read by: Connecticut Office of the Attorney General (guidance, recorded ).
In the frameworks
- NIST Privacy Framework
- CT.DM-P4Data elements can be accessed for deletion.
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
Who enforces it
Enforcement body
Connecticut Attorney General
Settledness
- As of
- Guidance link
- https://portal.ct.gov/ag/sections/privacy/the-connecticut-data-privacy-act
- Guidance body
- Connecticut Office of the Attorney General
- Open questions
- What facts show that a controller 'wilfully disregards' that a consumer is a minor under Section 9(a) of Public Act 23-56?
- Which design choices fail the duty to 'use reasonable care to avoid any heightened risk of harm to minors' under Section 9(a) of Public Act 23-56, beyond completing the data protection assessment that Section 10 requires?
What it makes you log
Log retention
The period is the longer of three years from the date the processing operations cease or as long as the controller offers the service, product or feature.
- Unit
- Years
- As of
- Basis
- Fixed
- Minimum value
- 3
Logging duty
The duty is to document and keep the assessment of a service offered to known minors, not a log of age checks. The act as cited states no Attorney General access clause for the assessment; Sec. 10(f) makes it confidential and refers only to disclosure to the Attorney General.
- Kind
- Implicit
- As of
- Provision
- Public Act 23-56, Sec. 10(b)(2): maintain documentation concerning a data protection assessment for the longer of three years from the date the processing operations cease or as long as the controller offers the service
- Trigger
- personal_data_processing
What this law does
Amends the Connecticut Data Privacy Act so social media platforms must honor a minor's request to unpublish or delete their account (effective ), and requires controllers offering services to known minors under 18 to use reasonable care against heightened risk of harm, including limits on targeted advertising, certain profiling, and precise geolocation collection (effective ).
Public Act 25-113 amended these duties effective , to bar a controller from processing a known minor's personal data for targeted advertising or any sale of personal data. It also limits a controller's collection of a minor's precise geolocation data to cases where the data are strictly necessary to provide the service.
When LexLint raises it
When your app profile says your app operates a social platform or serves under-18s.
Back to the example · Lint your app
Page updated .