Law / United States / 
Connecticut
SB 5 (2026), An Act Concerning Online Safety, social media protections for minors
Public Act No. 26-15, Sec. 39 (2026)
A social media and minors rule binding private bodies.
- Age threshold
- 18
- How the hook was established
- express
- What makes it apply
- User location
- Verification methods
- Parental consent, Third party service
- Audit expectation
- none
What it requires
- As an operator of a covered platform, do not show a user personalized algorithmic recommendations unless you use commercially reasonable and technically feasible methods to determine the user is not a minor under 18, or obtain verifiable parental consent for a minor.NIST Privacy FrameworkCT.PO-P1
- Do not send notifications to minors between 9:00 p.m. and 8:00 a.m. without parental consent.no control in the NIST Privacy Framework
- Set protective defaults for minor accounts, including a one hour per day limit on algorithmic feeds.no control in the NIST Privacy Framework
- Delete age determination data.NIST Privacy FrameworkCT.DM-P5
- Make annual public disclosures.no control in the NIST Privacy Framework
These lines are LexLint's reading of the law's text.
In the frameworks
Our reading of where this law's duties sit in each framework, and in the NIST Privacy Framework, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
If you get it wrong
Private right of actionNo
Penalties
Enforced solely by the Attorney General as an unfair trade practice; no private right of action.
Who enforces it
Enforcement body
Connecticut Attorney General
Settledness
- As of
- Open questions
- Which methods are 'commercially reasonable and technically feasible' to determine that a covered user is not a covered minor under Section 39(b)(1)(A)(i) of Public Act 26-15, and does a self-declared birth date qualify?
- Does 'based, in whole or in part, on any information associated with the covered user' in Section 39(b)(1) of Public Act 26-15 reach a feed ranked on the covered user's location or language settings?
What it makes you log
What the log must hold
Age assurance result, Consent or opt-out state, Event time
Log retention
No period is stated; deletion follows the single use.
- As of
- Basis
- Purpose bound
- Prohibits retaining
- information collected to determine a covered user's age or to obtain verifiable parental consent, which may not be used for another purpose and is deleted immediately after the attempt, unless a federal or Connecticut law or regulation requires keeping it
Logging duty
The section names no log or record; the four disclosures cannot be made without a record of each user's age status, parental consent, settings and time of use. Section 39(b)(3) goes the other way for age determination data: it is deleted immediately after the attempt.
- Kind
- Implicit
- As of
- Provision
- Public Act 26-15, Sec. 39(e): publicly disclose each year the number of covered users, the portion for whom verifiable parental consent was obtained, the portion with the default settings enabled and not enabled, and the average time per day covered users used the platform by user age and hour of day
- Trigger
- age_assurance
- consent_or_optout
What this law does
Part of a 39 section omnibus online safety and artificial intelligence act signed .
Section 39 bars covered platforms from showing a user personalized algorithmic recommendations unless the operator uses commercially reasonable and technically feasible methods to determine the user is not a minor under 18, or obtains verifiable parental consent for a minor; bars notifications to minors between 9:00 p.m. and 8:00 a.m. absent parental consent; requires protective defaults for minor accounts including a one hour per day limit on algorithmic feeds; requires deletion of age determination data; and requires annual public disclosures.
When LexLint raises it
When your app profile says your app operates a social platform.
Back to the example · Lint your app
Page updated .