Law / United States / 
Connecticut
Connected device provider's duty to protect recorded personal information with reasonable security measures
Public Act No. 25-44, Sec. 2(c) (2025)
In force since .
A security baseline statutes rule binding private bodies.
What it requires
- This binds a 'provider': a connected device manufacturer (a person doing business in Connecticut who manufactures an Internet-connected home appliance, television or toy that includes a camera or microphone), and any person under contract with the manufacturer who gets access to the camera or microphone, or to any image, video or sound it collects, records, stores, analyzes, interprets or transmits.
- Implement and maintain reasonable security measures to protect any personally identifying information collected through the connected device's camera or microphone from unauthorized access, acquisition, destruction, disclosure, modification or use.
- A violation is an unfair or deceptive trade practice under Conn. Gen. Stat. Sec. 42-110b; the enforcement clause for this subsection does not exclude Section 42-110g the way several of this Public Act's other sections do, so a person who suffers an ascertainable loss appears to retain Connecticut's ordinary CUTPA private right of action for a violation of this duty.
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- PR.DS-P5Protections against data leaks are implemented.
- NIST CSF 2.0
- PR.DS-01The confidentiality, integrity, and availability of data-at-rest are protected
- CIS Controls
- FINOS AIGF
- AIR-PREV-007Legal and Contractual Frameworks for AI Systems
- AIR-PREV-008Quality of Service (QoS) and DDoS Prevention for AI Systems
- AIR-PREV-012Role-Based Access Control for AI Data
- AIR-PREV-014Encryption of AI Data at Rest
- AIR-PREV-017AI Firewall Implementation and Management
- AIR-PREV-020MCP Server Security Governance
1 more
- AIR-DET-001AI Data Leakage Prevention and Detection
- ENISA NIS2 guidance
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
CIS Critical Security Controls® (CIS Controls®) v8.1 © Center for Internet Security, Inc. Safeguard numbers are used under a CIS Controls Supporter License; the one-line descriptions beside them are our own, not CIS text.
If you get it wrong
Criminal exposureNo
Private right of actionYes
Penalty structure
Civil penalty under Conn. Gen. Stat. 42-110o(b), reached because a violation of Public Act 25-44, Sec. 2(c) is deemed an unfair or deceptive trade practice under section 42-110b(a). It applies where the court finds a wilful violation in an action under section 42-110m, and the Attorney General recovers it for the state. A person who violates a temporary restraining order or injunction under section 42-110o(a) pays up to $25,000 per violation.
- Rule
- Per violation only
- As of
- Currency
- USD
- Per violation unit
- Violation
- Per violation amount
- 5,000
Who enforces it
Enforcement body
The Commissioner of Consumer Protection may investigate and enforce a violation as an unfair or deceptive trade practice under the Connecticut Unfair Trade Practices Act (chapter 735a), or request the Attorney General to apply to the Superior Court for an injunction or restitution.
Settledness
- As of
- Open questions
- What counts as "reasonable security measures" under Public Act 25-44, Sec. 2(c), for personally identifying information collected through a connected device's camera or microphone?
- Does "personally identifying information collected through a camera or microphone" in Sec. 2(c) reach an image or sound recording that identifies no one by itself but could be linked to an individual?
What it reaches
Obligation class
Security
Applicability criteria
Sec. 2(a)(2) defines a connected device manufacturer as a person doing business in this state who manufactures a connected device, and Sec. 2(a)(1) defines a connected device as an Internet-connected home appliance, television or toy that includes a camera or microphone.
- As of
- Combinator
- Any of
- Criteria
- a connected device manufacturer
- any person who (i) enters into a contract with a connected device manufacturer, and (ii) receives access to (I) any camera or microphone included in a connected device manufactured by the connected device manufacturer, (II) any image or video collected, recorded, stored, analyzed, interpreted or transmitted by way of any camera included in any connected device manufactured by the connected device manufacturer, or (III) any spoken word or other sound collected, recorded, stored, analyzed, interpreted or transmitted by way of any microphone included in any connected device manufactured by the connected device manufacturer
What this law does
Public Act 25-44 defines a connected device as an Internet-connected home appliance, television or toy that includes a camera or microphone. It defines a 'provider' as the device's manufacturer or any person under contract with the manufacturer who gets access to the camera, microphone, or the images, video or sound they collect.
Each provider must implement and maintain reasonable security measures to protect any personally identifying information collected through a connected device's camera or microphone from unauthorized access, acquisition, destruction, disclosure, modification or use.
A violation of this subsection is an unfair or deceptive trade practice under the Connecticut Unfair Trade Practices Act, and unlike several of this same Public Act's other sections, the enforcement clause covering it does not exclude Section 42-110g, so it appears to carry that chapter's ordinary private right of action for a person who suffers an ascertainable loss.
When LexLint raises it
When your app profile says your app distributes a software product.
Back to the example · Lint your app
Page updated .