Connecticut

In effect since October 1, 2024. Connecticut's definition of child sexual abuse material, which governs the promoting, importing, and possessing offenses at Conn. Gen. Stat. Secs. 53a-196a to 53a-196f, was amended to cover a computer-generated image or picture, made or produced by electronic, digital, mechanical, or other means, of sexually explicit conduct, where a person under sixteen was used in producing the depiction.

The 2024 amendment also renamed the term from child pornography to child sexual abuse material throughout the definition.

In effect since October 1, 2025.

A person commits unlawful dissemination of an intimate synthetically created image by intentionally disseminating, without the depicted person's consent, an image that is not wholly recorded by a camera or is partially or wholly computer-generated, depicts a person's genitals, pubic area, buttocks, breast, or sexual intercourse, and is virtually indistinguishable from what a reasonable person would believe is an actual depiction of an identifiable person, where the depicted person suffers harm from the dissemination.

Dissemination to one person is a class D misdemeanor, or a class A misdemeanor if the person created or acquired the image intending to cause harm; dissemination to more than one person through an interactive computer, information, or telecommunications service is a class C misdemeanor, or a class D felony with that same intent. An interactive computer service, information service, or telecommunications service provider is not liable for content provided by another person.

Enacted effective October 1, 2026, binding a deployment of automated employment-related decision technology, technology that processes personal data to produce an output that is a substantial factor in a decision to hire, promote, discipline, discharge, or set the terms of someone's employment, on or after October 1, 2027. A developer must give a deployer the information the deployer needs to meet its own duties.

A deployer must ensure an employee or applicant is told when they are interacting with the technology, unless that would be obvious, and before an employment-related decision is made must give written notice naming the technology, its purpose, the categories and sources of personal data it analyzes, and contact information, subject to a trade-secret withholding notice.

A companion amendment to the state's employment discrimination statute, Conn. Gen. Stat. Sec. 46a-60(b)(1), provides that using such technology is not a defense to a discrimination complaint, though anti-bias testing may be considered as evidence. Violations are enforced solely by the Attorney General as an unfair trade practice, with a sixty-day cure period available for violations occurring on or before December 31, 2027, and create no private right of action.

Takes effect January 1, 2027.

An operator of an artificial intelligence companion, an AI system with a natural language interface designed to sustain a relationship across multiple interactions, that would cause a reasonable user to believe they are speaking with a human must give a clear and conspicuous notice that the user is communicating with an artificial intelligence companion, repeated at least hourly for a user under eighteen and at least every three hours for an adult user, and must respond to a direct question about whether it is human by disclosing that it is not.

A violation of the disclosure duty is enforced solely by the Attorney General as an unfair trade practice and creates no private right of action.

Separately, an operator that knows or has reason to believe a user is a minor may not let the companion encourage self-harm, suicide, or violence, offer mental-health services outside narrow exceptions, discourage the user from seeking help from a professional or a trusted adult, engage in romantic or sexually explicit interaction, or use enumerated manipulative engagement techniques, and must give minor users and their parents tools to manage screen time and account settings.

A person who owns, licenses, or maintains computerized data including personal information must notify each affected Connecticut resident of a breach without unreasonable delay, and no later than 60 days after discovery unless federal law requires a shorter time. 'Personal information' excludes publicly available information lawfully made available to the general public from government records or widely distributed media.

This breach-notification section deems a failure to comply an unfair trade practice for purposes of section 42-110b and provides that it shall be enforced by the Attorney General; it grants no cause of action to a private person of its own. The provisions this entry describes came into force on different days.

Under section 38a-38, a licensee is any person licensed, authorized to operate or registered, or required to be licensed, authorized to operate or registered, under the insurance laws of Connecticut. Each licensee must notify the Insurance Commissioner that a cybersecurity event has occurred as promptly as possible and no later than three business days after first determining that it has occurred, in the circumstances section 38a-38(e)(1) describes.

Under section 38a-38, notice is also due when the licensee reasonably believes the nonpublic information involved is of 250 or more Connecticut consumers and the other conditions of subparagraph (B) are met. Under section 38a-38, a licensee that notifies the commissioner must provide as much as possible of the listed information in an electronic form the commissioner prescribes and has a continuing obligation to update and supplement it.

Under section 38a-38, the licensee must comply with section 36a-701b on notice to consumers and give the commissioner a copy of the consumer notice, if it is required to notify the commissioner. After a hearing the commissioner may impose a civil penalty of not more than $50,000 for each violation of section 38a-38.

Public Act 21-157, effective July 12, 2021, changed the deadline in section 38a-38(e)(1) to run from the date on which the licensee first determines that a cybersecurity event has occurred. Public Act 19-196 changed the effective date of section 38a-38, added by Public Act 19-117, from October 1, 2019, to October 1, 2020.

Section 38a-38(d)(4) requires each licensee subject to subsection (d) to maintain records concerning each cybersecurity event for a period of at least five years from the date of the event. The licensee must produce those records to the Insurance Commissioner upon demand by the commissioner.

Subsection (d) applies when a licensee learns that a cybersecurity event has, or may have, occurred, and it requires a prompt investigation by the licensee or by an outside vendor or service provider designated to act on its behalf. Under section 38a-38, a licensee is any person licensed, authorized to operate or registered, or required to be licensed, authorized to operate or registered, under the insurance laws of Connecticut.

The Insurance Commissioner has power to examine and investigate into the affairs of a licensee to determine whether the licensee is, or has been, engaged in conduct in this state that violates section 38a-38. After a hearing the commissioner may impose a civil penalty of not more than $50,000 for each violation of section 38a-38. Public Act 19-196 changed the effective date of section 38a-38, added by Public Act 19-117, from October 1, 2019, to October 1, 2020.

CTDPA governs private-sector processing of Connecticut residents' personal data. Enacted as Public Act 22-15 (S.B. 6, 2022), effective July 1, 2023. Controller and processor duties are allocated at sections 42-515 to 42-524. S.B. 1295, enacted as Public Act 25-113 (approved June 24, 2025), substantially amended the Act, with amendments effective July 1, 2026, including a lower applicability threshold and an expanded profiling opt-out.

The base chapter as published at cga.ct.gov's 'current' text has not yet folded this Public Act in, directing readers to a separate 2026 Supplement instead; the July 1, 2026 effective date and the amendment's substance are confirmed against the enrolled Public Act 25-113 text itself. Public Act 26-64 (Senate Bill 4) was approved on May 27, 2026. Its section 12 amends section 42-515 with effect from October 1, 2026. From that date no controller may sell any consumer's precise geolocation data.

No third party may sell any consumer's precise geolocation data either. A controller that uses facial recognition technology on its premises to prevent, detect or respond to security incidents, fraud or similar activity must use it exclusively to match images against a database that the controller itself maintains.

That controller must also post signage at each entrance to the premises, other than an entrance to an area restricted to authorized employees, that links to its facial recognition technology policy. The definition of publicly available information is rewritten and excludes, among other things, an intimate image known to be nonconsensual.

Under section 5(a) of Public Act 26-64, the Commissioner of Consumer Protection must establish, not later than July 1, 2028, an accessible deletion mechanism program through which a consumer can submit a deletion request to all registered data brokers. Under section 5(c) of Public Act 26-64, on and after October 1, 2028 each registered data broker must access the accessible deletion mechanism at least once every forty-five days to examine each deletion request or update.

Under section 5(c)(1)(B)(i) of Public Act 26-64, for each verified deletion request that does not exclude it, a registered data broker must delete the personal data it maintains about the participating consumer and direct its data service providers to delete that data.

Under section 5(c)(4) of Public Act 26-64, a registered data broker that deletes a participating consumer's data, and its data service providers, may not maintain, use or disclose personal data they subsequently acquire about the consumer, except as the exceptions in section 5(c)(5) permit.

Under section 5(c)(5) of Public Act 26-64, a registered data broker need not delete a participating consumer's personal data to the extent maintaining it is reasonably necessary for a purpose the paragraph lists, the first being compliance with federal, state or municipal law.

Under section 7(a) of Public Act 26-64, the data broker provisions do not apply to a consumer reporting agency, furnisher or user of a consumer report to the extent it is subject to the Fair Credit Reporting Act, a financial institution to the extent it is subject to Title V of the Gramm-Leach-Bliley Act, a business that collects information about a consumer who is or was in a contractual, investor, donor or similar relationship with it, a business acting for such a business or a governmental entity, a business collecting data for the regulation of listed chemicals, a political committee, or a Health Insurance Portability and Accountability Act (HIPAA) covered entity or business associate.

Under section 10 of Public Act 26-64, the Commissioner of Consumer Protection may, after notice and a hearing, impose a civil penalty of not more than $200 per day for each violation of sections 2 to 8 of the act. Public Act 26-64 was approved on May 27, 2026.

Under section 6 of Public Act 26-64, not later than July 1, 2029 and annually after that, each business that was a registered data broker during the preceding calendar year must post a statement on its primary web site disclosing the number of deletion requests it accessed and how it responded.

Under section 7(a) of Public Act 26-64, the data broker provisions do not apply to a consumer reporting agency, furnisher or user of a consumer report to the extent it is subject to the Fair Credit Reporting Act, a financial institution to the extent it is subject to Title V of the Gramm-Leach-Bliley Act, a business that collects information about a consumer who is or was in a contractual, investor, donor or similar relationship with it, a business acting for such a business or a governmental entity, a business collecting data for the regulation of listed chemicals, a political committee, or a Health Insurance Portability and Accountability Act (HIPAA) covered entity or business associate.

Under section 10 of Public Act 26-64, the Commissioner of Consumer Protection may, after notice and a hearing, impose a civil penalty of not more than $200 per day for each violation of sections 2 to 8 of the act. Public Act 26-64 was approved on May 27, 2026.

Under section 1 of Public Act 26-64, a data broker is any business, or portion of a business, that sells or licenses brokered personal data to another person. Section 2 of Public Act 26-64 takes effect on October 1, 2026, and under section 2(a) no data broker may sell or license brokered personal data in Connecticut on or after January 1, 2027 unless it is actively registered with the Department of Consumer Protection.

Under section 7(a) of Public Act 26-64, the data broker provisions do not apply to a consumer reporting agency, furnisher or user of a consumer report to the extent it is subject to the Fair Credit Reporting Act, a financial institution to the extent it is subject to Title V of the Gramm-Leach-Bliley Act, a business that collects information about a consumer who is or was in a contractual, investor, donor or similar relationship with it, a business acting for such a business or a governmental entity, a business collecting data for the regulation of listed chemicals, a political committee, or a Health Insurance Portability and Accountability Act (HIPAA) covered entity or business associate.

Under section 10 of Public Act 26-64, the Commissioner of Consumer Protection may, after notice and a hearing, impose a civil penalty of not more than $200 per day for each violation of sections 2 to 8 of the act. Public Act 26-64 was approved on May 27, 2026.

Under section 5(d)(1) of Public Act 26-64, not later than July 1, 2031 and triennially after that, each registered data broker must at its own expense retain an independent auditor to audit its compliance with the deletion duties in section 5(c), have the auditor prepare a report, and keep each report for at least six years.

Under section 5(d)(2) of Public Act 26-64, a registered data broker must submit an audit report to the Department of Consumer Protection not later than five business days after the department notifies it that the department requires the report.

Under section 7(a) of Public Act 26-64, the data broker provisions do not apply to a consumer reporting agency, furnisher or user of a consumer report to the extent it is subject to the Fair Credit Reporting Act, a financial institution to the extent it is subject to Title V of the Gramm-Leach-Bliley Act, a business that collects information about a consumer who is or was in a contractual, investor, donor or similar relationship with it, a business acting for such a business or a governmental entity, a business collecting data for the regulation of listed chemicals, a political committee, or a Health Insurance Portability and Accountability Act (HIPAA) covered entity or business associate.

Under section 10 of Public Act 26-64, the Commissioner of Consumer Protection may, after notice and a hearing, impose a civil penalty of not more than $200 per day for each violation of sections 2 to 8 of the act. Public Act 26-64 was approved on May 27, 2026.

Under section 20-7c, except as subsection (e) allows, a provider must supply to a patient on request complete and current information the provider possesses about any diagnosis, treatment and prognosis of the patient, and notify the patient of any test results the provider has or requested for diagnosis, treatment or prognosis.

Under section 20-7b, for purposes of sections 20-7b to 20-7e a patient is a natural person who has received health care services from a provider for treatment of a medical condition, or a person the patient designates in writing as the patient's representative, and a provider is any person or organization that furnishes health care services and is licensed or certified to furnish them under the chapters the section lists.

Under section 20-7c(b), a clinical laboratory must on the request of a patient or of a provider who ordered the tests provide medical test results to the patient or to any other provider treating the patient. Under section 20-7c, upon a written request of a patient, a patient's attorney or authorized representative, or on a written authorization, a provider must furnish a copy of the patient's health record, including bills, x-rays and copies of laboratory reports.

Under section 20-7c, a provider must furnish a requested health record within thirty days of the request and may not charge more than sixty-five cents per page, including any research fees, handling fees or related costs, and the cost of first class postage, if applicable.

Under section 20-7c, a provider may withhold information if the provider reasonably determines that it is detrimental to the physical or mental health of the patient or likely to cause the patient to harm himself, herself or another. Under section 20-7c, a person aggrieved by a refusal may, within thirty days, petition the superior court for an order requiring the provider to disclose the information.

Section 20-7c does not apply to any information relative to any psychiatric or psychological problems or conditions. The provisions this entry describes came into force on different days.

The section binds a communications company as section 53-421 defines that term, a coverage test this law carries separately. It is unlawful for a communications company to provide any person or organization with a list containing the name of a subscriber, unless it gives the subscriber notice and the subscriber does not object to the disclosure, or the recipient is acting as its agent, servant or employee.

A communications company that violates the section is fined not more than ten thousand dollars for each violation. A person who has been injured by a violation has a right of action against the communications company to recover damages for the injury, and if the court awards damages the plaintiff is awarded costs.

CTDPA gives a Connecticut consumer the right to confirm processing, access, correct, delete, obtain a portable copy, and opt out of targeted advertising, sale, and qualifying profiling. A controller must respond without undue delay and no later than 45 days after receipt, with one 45-day extension available.

Public Act 25-113 (S.B. 1295, 2025 session, effective July 1, 2026) removed the 'solely automated' qualifier so the profiling opt-out and a new right to contest automated-decision outcomes reach decisions with human involvement, and its Sec. 11 (amending section 42-522) adds a new impact-assessment requirement for such profiling applying to processing activities created or generated on or after August 1, 2026, confirmed against the enrolled act's own text.

Public Act 26-64 (Senate Bill 4) amends this section with effect from October 1, 2026. From that date the right to delete reaches publicly available information that is collated into a consumer profile made available to users of a publicly accessible website, or that is made available for sale, and any inference generated from that information.

The obligations of the Connecticut Insurance Information and Privacy Protection Act apply to insurance institutions, agents and insurance-support organizations that, on or after October 1, 1982, for life, health or disability insurance collect, receive or maintain information about Connecticut residents or engage in transactions with Connecticut residents.

Under the Connecticut Insurance Information and Privacy Protection Act, no insurance institution, agent or insurance-support organization may use or authorize a pretext interview to obtain information in connection with an insurance transaction, except to investigate a claim on the terms section 38a-978 sets.

Under the Connecticut Insurance Information and Privacy Protection Act, an insurance institution or agent must give all applicants or policyholders a written notice of information practices at the times section 38a-979 sets.

Under the Connecticut Insurance Information and Privacy Protection Act, within thirty business days of a written request after proper identification, the holder must tell the individual the nature and substance of recorded personal information, let the individual see and copy it, disclose to whom it was disclosed within two years, and summarize the correction procedures.

Under the Connecticut Insurance Information and Privacy Protection Act, not later than thirty business days after a written request to correct, amend or delete recorded personal information, the holder must either do so or notify the individual of its refusal, the reasons and the right to file a statement.

Under the Connecticut Insurance Information and Privacy Protection Act, after an adverse underwriting decision, the insurance institution or agent responsible must provide the specific reason in writing or advise that it may be had in writing on request, together with a summary of the individual's rights.

Under the Connecticut Insurance Information and Privacy Protection Act, an insurance institution, agent or insurance-support organization may not disclose personal or privileged information about an individual collected or received in connection with an insurance transaction unless the disclosure falls within one of the grounds section 38a-988 lists, the first being the individual's written authorization.

Under the Connecticut Insurance Information and Privacy Protection Act, after a hearing the commissioner may order a penalty of not more than $5,000 for each intentional violation of the act, up to $50,000 in the aggregate, and not more than $2,000 for each negligent violation, up to $20,000 in the aggregate.

Under the Connecticut Insurance Information and Privacy Protection Act, a person whose rights under sections 38a-983, 38a-984 or 38a-985 are violated may bring an action for equitable relief. Under the Connecticut Insurance Information and Privacy Protection Act, an insurance institution, agent or insurance-support organization that discloses information in violation of section 38a-988 is liable for the damages the individual sustains, which may not exceed actual damages.

Section 38a-988a, which lies within the range of sections 38a-975 to 38a-998, binds any person, including health care professionals, medical care centers and pharmacies, and not only insurance institutions, agents and insurance-support organizations.

Under the Connecticut Insurance Information and Privacy Protection Act, a person who knowingly and wilfully obtains information about an individual from an insurance institution, agent or insurance-support organization under false pretenses is fined not more than $20,000.

The Connecticut Attorney General has exclusive authority to enforce CTDPA as an unfair trade practice under section 42-110b. A cure period was mandatory (60 days) from July 1, 2023 through December 31, 2024; from January 1, 2025 it became discretionary, weighed against factors including violation count, controller size, likelihood of public injury, and data sensitivity. The chapter creates no private right of action.

A communications company is any person or organization which owns, controls, operates or manages any company which provides information or entertainment electronically to a household, including but not limited to a cable or community antenna television system. It is unlawful for a communications company to disclose the television viewing habits of any individual subscriber without the consent of the subscriber.

A communications company that violates the section is fined not more than ten thousand dollars for each violation. A person who has been injured by a violation has a right of action against the communications company to recover damages for the injury, and if the court awards damages the plaintiff is awarded costs.

CTDPA classifies data revealing racial or ethnic origin, religious beliefs, mental or physical health condition or diagnosis, sex life, sexual orientation, citizenship or immigration status, consumer health data, the processing of genetic or biometric data to uniquely identify an individual, a known child's data, victim-of-crime status, and precise geolocation data as sensitive data.

'Biometric data' means data from automatic measurement of biological characteristics used to identify a person, such as a fingerprint or voiceprint, and the raw photograph or recording is excluded, but data generated from it (a faceprint, a voiceprint) is brought back inside 'biometric data' the moment it is generated to identify a specific individual.

This clawback is the material finding for Connecticut: a voiceprint or faceprint manufactured from a public-facing recording for identification purposes is covered biometric and sensitive data here.

Under section 38a-999a, no person may disclose individually identifiable medical record information with the malicious intent to damage an individual's reputation or character. A person who violates section 38a-999a is fined not more than $500 or imprisoned not more than three months or both for a first offense, and fined not more than $2,000 or imprisoned not more than one year or both for each subsequent offense. Section 38a-999a took effect on July 1, 2000.

Under section 46a-60(b)(11), it is a discriminatory practice for an employer, an employment agency or a labor organization to request or require genetic information from an employee, a person seeking employment or a member. Under section 46a-60(b)(11), it is also a discriminatory practice to discharge, expel or otherwise discriminate against any person on the basis of genetic information.

Under section 46a-60(b)(11), genetic information means the information about genes, gene products or inherited characteristics that may derive from an individual or a family member. Under section 46a-60(b)(11), an employer includes the state and all political subdivisions of the state and means any person or employer with one or more persons in the person's or employer's employ.

Under section 46a-60(b)(11), a person who has filed a complaint with the commission and obtained a release of jurisdiction may bring an action in the superior court. Under section 46a-60(b)(11), the court may grant such a complainant legal and equitable relief, including injunctive relief, punitive damages, attorney's fees and court costs.

Under section 38a-833, no insurer, health care center or fraternal benefit society doing business in Connecticut may, in connection with issuing, withholding, extending or renewing an annuity or a life, credit life, disability, long-term care, accidental injury, specified disease, hospital indemnity or credit accident insurance policy, request, require, purchase or use information obtained from an entity providing direct-to-consumer genetic testing without the informed written consent of the individual who has been tested.

Under section 38a-833, such an insurer may not condition insurance rates, the provision or renewal of coverage or other conditions of insurance on a requirement that the individual undergo genetic testing, or on the results of genetic testing of a family member unless the results are in the individual's medical record. Section 38a-816 of the Connecticut General Statutes lists any violation of section 38a-833 among the unfair practices it defines.

Section 2 of Public Act 21-137 added section 38a-833 and takes effect on October 1, 2021. Under section 38a-833, after a hearing the Insurance Commissioner may order a monetary penalty of not more than $5,000 for each act or violation, up to $50,000 in the aggregate, and for a person who knew or should have known of the violation not more than $25,000 for each act, up to $250,000 in any six-month period.

Section 42-470 binds any individual, firm, partnership, association, corporation, limited liability company, organization or other entity, but not the state, its political subdivisions or their agencies. Under section 42-470, no person may publicly post or publicly display an individual's Social Security number in any manner, or print it on any card the individual must use to access products or services the person provides.

Under section 42-470, no person may require an individual to transmit a Social Security number over the Internet unless the connection is secure or the number is encrypted, or to use one to access an Internet web site unless a password, unique personal identification number or other authentication device is also required.

Under section 42-470(c), the prohibitions apply to group and individual health insurance policies of the types named in section 38a-469 that are delivered, issued for delivery, amended, renewed or continued on and after July 1, 2005. Section 42-470 does not prevent the collection, use or release of a Social Security number as required by state or federal law, or its use for internal verification or administrative purposes.

Under section 42-470, a person who wilfully violates subsection (b) is fined not more than $100 for a first offense, not more than $500 for a second offense, and not more than $1,000 or imprisoned not more than six months, or both, for each subsequent offense. Under section 42-470, a person who wilfully violates subsection (b) is also subject to a civil penalty of $500 for each violation, not to exceed $500,000 for any single event.

Under section 42-470, the prohibitions applied as first enacted on and after January 1, 2005, a limit that Public Act 09-239 removed when it added the civil penalty in subsection (f). Under sections 42-472 and 42-472a, the Commissioner of Consumer Protection may investigate and hold hearings on any matter under section 42-470 and the privacy protection guaranty and enforcement account receives its civil penalties.

Under section 38a-988a, no person, including an insurance institution, agent, insurance support organization, health care professional, medical care center, pharmacy, pharmaceutical company, school or university, or any person's agent, contractor or employee, may sell or offer for sale individually identifiable medical record information.

Under section 38a-988a, no person may disclose individually identifiable medical record information for purposes of marketing without the prior written consent of the individual or, for a minor, of the minor's parent or guardian. Under section 38a-988a, an individual harmed by a violation may bring an action for equitable relief, damages or both. A person who violates section 38a-988a is liable to the individual harmed for double damages, costs and reasonable attorneys' fees.

Section 38a-993(b)(2) lets the commissioner, after a hearing under section 38a-990 finds an intentional violation of section 38a-988a, order a penalty of not more than $20,000 for each violation, up to $100,000 in the aggregate. Section 38a-988a took effect on July 1, 2000.

Under sections 10-234aa to 10-234dd, an operator is a person who operates an Internet web site, online service or mobile application with actual knowledge that it is used for school purposes and was designed and marketed for school purposes, to the extent it collects, maintains or uses student information.

Under sections 10-234aa to 10-234dd, a contractor is an operator or consultant that is in possession of or has access to student information, student records or student-generated content as a result of a contract with a local or regional board of education.

Under sections 10-234aa to 10-234dd, an operator must implement and maintain security procedures and practices that meet or exceed industry standards to protect student information, student records and student-generated content from unauthorized access, destruction, use, modification or disclosure.

Under sections 10-234aa to 10-234dd, an operator may not knowingly engage in targeted advertising on its own service or on any other service based on student information or persistent unique identifiers acquired through school use. An operator may not knowingly collect, store and use student information for purposes other than the furtherance of school purposes, or sell, rent or trade it except in an acquisition where the successor operator remains subject to sections 10-234aa to 10-234dd.

Under sections 10-234aa to 10-234dd, a contractor must implement and maintain security procedures and practices designed to protect student information, student records and student-generated content from unauthorized access, destruction, use, modification or disclosure.

Under sections 10-234aa to 10-234dd, a contractor may not use student information, student records or student-generated content for any purpose other than those the contract authorizes, or use personally identifiable information in them to engage in targeted advertising.

Under sections 10-234aa to 10-234dd, a local or regional board of education must enter into a written contract with a contractor whenever it shares or provides access to student information, student records or student-generated content, and a contract that lacks a required provision is void if the contractor fails within a reasonable time after notice to amend it.

Under sections 10-234aa to 10-234dd, on discovering a breach of security that results in unauthorized release, disclosure or acquisition of student information, a contractor must notify the board of education without unreasonable delay and within thirty days.

Under sections 10-234aa to 10-234dd, an operator that holds student data from a student's use of its service must notify the student or the student's parents or guardians of such a breach without unreasonable delay and within thirty days for student information, and within sixty days for directory information, student records or student-generated content.

Public Act 17-200 replaced October 1, 2016 with July 1, 2018 in subsections (a), (e) and (f) of section 10-234bb, so the contract requirements apply to contracts entered into on or after July 1, 2018. Public Act 16-189, which added sections 10-234aa to 10-234dd, took effect on October 1, 2016.

Under section 38a-999, an insurance institution, agent or insurance support organization that regularly collects, uses or discloses medical record information must develop and implement written policies, standards and procedures for its management, transfer and security.

Under section 38a-999, the policies must limit access to those who need it for their jobs, provide training and disciplinary measures, and give additional protection to sensitive health information on sexually transmitted diseases, mental health, substance abuse, HIV and AIDS, and genetic testing. Under section 38a-999, the policies, standards and procedures must be available for review by the Insurance Commissioner, and a summary must be available to enrollees on enrollment and on request. Section 38a-999 took effect on July 1, 2000.

Section 53a-251(b)(1) criminalizes unauthorized access to a computer system when a person, knowing that he is not authorized to do so, accesses or causes to be accessed any computer system without authorization.

Section 53a-251(b)(2) makes it an affirmative defense that the person reasonably believed the owner of the computer system, or a person empowered to license access, had authorized the access, reasonably believed the owner would have authorized it without payment of any consideration, or reasonably could not have known that the access was unauthorized.

The Appellate Court has read subsection (b) as directed at knowingly unauthorized access, and the first defense as exempting improper access made with a reasonable belief that it is authorized (Brantley v. City of New Haven, decided in 2007).

Section 53a-251(e)(1) separately reaches a person who, as a result of accessing a computer system, intentionally makes or causes to be made an unauthorized display, use, disclosure or copy of data residing in, communicated by or produced by a computer system. Computer crime in the fifth degree, which applies where the damage to or the value of the property or computer services is five hundred dollars or less, is a class B misdemeanor (section 53a-256).

Grading turns on the dollar value of damage or of computer services, and the statute fixes the value of private personal data at $1,500 for grading purposes (section 53a-259(c)), which matters specifically for personal-data scraping. Section 53a-251 was added by Public Act 84-206 and carries no History note in the official statute text, meaning it has never been amended since.

Its official source line records no effective date of its own, so the general rule for the effective date of a Connecticut public act applies (section 2-32 of the General Statutes: the first day of October following the session at which it was passed), and the section commenced October 1, 1984.

Section 53-451(b) makes it unlawful for any person to use a computer or computer network without authority and with the intent to do any of several things. One of them is to make or cause to be made an unauthorized copy, in any form, of computer data, computer programs or computer software residing in, communicated by or produced by a computer or computer network.

A person is without authority when the person has no right or permission of the owner to use a computer or uses a computer in a manner exceeding such right or permission (subsection (a)(14)(A)), a test that turns on the owner's permission and states no knowledge element. A person uses a computer or computer network when the person attempts to cause or causes it to perform or to stop performing computer operations (subsection (a)(13)(A)).

A violation is a class B misdemeanor, with higher grades where reckless or malicious actions cause damage of more than $2,500 to the property of another person (subsection (d)). Nothing in the section is to be construed to interfere with or prohibit terms or conditions in a contract or license related to computers, computer data or computer services (subsection (e)).

Section 53-452 gives a person whose property or person is injured by a violation a civil action in the Superior Court to enjoin further violations and to recover actual damages, which include loss of profits, and the costs of the action. That action must be brought within two years from the date of the act complained of (section 53-452(f)). The official annotations to section 53-451 list no decision construing it.

Public Act 99-160 enacted the section, and its official source line records no effective date of its own, so the general rule for the effective date of a Connecticut public act applies (section 2-32 of the General Statutes: the first day of October following the session at which it was passed), and the section commenced October 1, 1999.

Section 42-515(28) defines personal data to exclude de-identified data or publicly available information outright, and section 42-515(35), as amended by Public Act 26-64 effective October 1, 2026, defines publicly available information as information that is made available through federal, state or local government records or to the general public from widely distributed media, or that a controller or processor, or an affiliate of a controller or processor, has a reasonable basis to believe the consumer has lawfully made available to the general public.

It does not include biometric data about a consumer collected by a business without the consumer's knowledge. It also does not include information a consumer provided on a publicly accessible web site or online service where the consumer has maintained a reasonable expectation of privacy, including by restricting the information to a specific audience.

Because the exclusion operates on the definition of personal data itself, most scraped public-record or publicly posted personal data falls outside the CTDPA's scope entirely, not merely outside a narrower carve-out from an otherwise-applicable duty.

Since July 1, 2026 the Act applies to persons that conduct business in Connecticut or produce products or services targeted to its residents and, in the preceding calendar year, controlled or processed the personal data of not fewer than 35,000 consumers (excluding personal data processed solely to complete a payment transaction), and to persons that control or process consumers' sensitive data or offer consumers' personal data for sale in trade or commerce.

Also from July 1, 2026, a controller's privacy notice must include a statement disclosing whether the controller collects, uses or sells personal data for the purpose of training large language models.

Two other amendments made by Public Act 25-113, effective July 1, 2026, added a right to question the result of profiling behind an automated decision with a legal or similarly significant effect and a duty to conduct an impact assessment for such profiling that applies to processing activities created or generated on or after August 1, 2026; neither of those two changes the publicly-available exemption itself. CTDPA was enacted as Public Act 22-15 and, per its own effective-date history note, took effect July 1, 2023.

Each licensee must, not later than October 1, 2021, develop, implement and maintain a comprehensive written information security program that is based on its risk assessment and contains administrative, technical and physical safeguards for nonpublic information and its information systems.

A licensee is any person licensed, authorized to operate or registered, or required to be, under the insurance laws of Connecticut, including a fraternal benefit society, an interlocal risk management agency and an employers' mutual association, but not a purchasing group or risk retention group chartered and licensed in another state, a person acting as an assuming insurer and domiciled in another state or jurisdiction, or a commissioner of the Superior Court acting as a title agent.

Each licensee must, as part of its information security program, establish a written incident response plan designed to promptly respond to, and recover from, any cybersecurity event that compromises the confidentiality, integrity or availability of nonpublic information, its information systems or the continuing functionality of any aspect of its business or operations.

Each licensee must exercise due diligence in selecting its third-party service providers and, not later than October 1, 2022, require each of them to implement appropriate administrative, technical and physical measures to protect and secure the information systems and nonpublic information accessible to, or held by, them.

Each insurer, health care center or fraternal benefit society domiciled in Connecticut must submit to the Insurance Commissioner a written statement, not later than April fifteenth annually, certifying that it is in compliance with the information security program requirements. On and after October 1, 2022, a licensee with fewer than ten employees, counting independent contractors who have access to the nonpublic information, is exempt from the information security program requirements.

A licensee that is subject to the federal Health Insurance Portability and Accountability Act and maintains an information security program under it is deemed to satisfy the requirements if it complies and submits to the Insurance Commissioner, not later than April fifteenth annually, a written statement certifying its compliance.

A licensee that maintains an information security program in compliance with Part 500 of Chapter I of Title 23 of the New York Codes, Rules and Regulations is deemed to satisfy the requirements if it complies and submits to the commissioner, not later than April fifteenth annually, a written statement certifying its compliance.

After a hearing, the Insurance Commissioner may, in addition to or in lieu of suspending, revoking or refusing to reissue or renew a license, impose on a licensee a civil penalty of not more than fifty thousand dollars for each violation of the section.

Every written agreement that authorizes a state contracting agency to share confidential information with a contractor must require the contractor to meet the minimum requirements of Section 4e-70(b). One of those requirements is to implement and maintain a comprehensive data-security program for the protection of confidential information.

A contractor must not store data constituting confidential information on stand-alone computer or notebook hard disks or portable storage devices such as external or removable hard drives, flash cards, flash drives, compact disks or digital video disks, except as provided for in the agreement. A contractor must not copy, reproduce or transmit data constituting confidential information, except as necessary for the completion of the contracted services or provision of the contracted goods.

The Attorney General may bring a civil action in the superior court for the judicial district of Hartford, in the name of the state, against a contractor that has violated the section. The section took effect on July 1, 2015.

Public Act 21-119 (2021) shields a 'covered entity', any business that accesses, maintains, communicates or processes personal or restricted information through a system, network or service located in or outside Connecticut, from punitive damages in a tort action alleging that a failure to implement reasonable cybersecurity controls caused a data breach, where the entity created, maintained and complied with a written cybersecurity program with administrative, technical and physical safeguards that conforms to a named industry framework.

The shield does not apply where the failure was the result of gross negligence or wilful or wanton conduct. The section creates no duty to adopt a program of its own and does not limit the Attorney General's or the Commissioner of Consumer Protection's authority to seek other relief. It leaves undisturbed the process for certifying a class action founded in tort. It also leaves undisturbed the requirements of the state's breach-notification statute at Section 36a-701b.

Public Act 25-44 defines a connected device as an Internet-connected home appliance, television or toy that includes a camera or microphone. It defines a 'provider' as the device's manufacturer or any person under contract with the manufacturer who gets access to the camera, microphone, or the images, video or sound they collect.

Each provider must implement and maintain reasonable security measures to protect any personally identifying information collected through a connected device's camera or microphone from unauthorized access, acquisition, destruction, disclosure, modification or use.

A violation of this subsection is an unfair or deceptive trade practice under the Connecticut Unfair Trade Practices Act, and unlike several of this same Public Act's other sections, the enforcement clause covering it does not exclude Section 42-110g, so it appears to carry that chapter's ordinary private right of action for a person who suffers an ascertainable loss.

Each employer must obtain and retain employment applications in a secure manner. Each employer must employ reasonable measures to destroy or make unreadable such employment applications upon disposal. Disposal measures must, at a minimum, include the shredding or other means of permanent destruction of such employment applications in a secure setting. The section does not apply to any agency or political subdivision of the state.

Any person or entity that violates the section is subject to a civil penalty of five hundred dollars for each violation, which may not exceed five hundred thousand dollars for any single event. The section took effect on October 1, 2009.

Any person in possession of another person's personal information must safeguard the data, computer files and documents containing it from misuse by third parties, and destroy, erase or make it unreadable before disposal. Any person who collects Social Security numbers in the course of business must create and publish a privacy protection policy that protects their confidentiality, prohibits unlawful disclosure and limits access.

The section does not apply to a state agency or political subdivision of the state. A financial institution that has adopted safeguards complying with the Gramm-Leach-Bliley Act's Section 501(b) standards is deemed compliant with this section.

A confidential information breach includes an instance in which an unauthorized person or entity accesses confidential information that is subject to or otherwise used in conjunction with any part of a written agreement with a state contracting agency.

A contractor must notify the state contracting agency and the Attorney General as soon as practical after the contractor becomes aware of or has reason to believe that any confidential information that the contractor possesses or controls has been subject to a confidential information breach.

A contractor must also submit to the office of the Attorney General and the state contracting agency either a report detailing the breach or suspected breach, including a plan to mitigate the effects of any breach and specifying the steps taken to ensure future breaches do not occur, or a report detailing why, upon further investigation, the contractor believes no breach has occurred. Each such written agreement must include a proposed timetable for submittal of that report.

Each such written agreement must also specify how the cost of any notification about, or investigation into, a confidential information breach is to be apportioned when the state contracting agency or contractor is the subject of such a breach. If notice is delayed, the contractor must give notification to the applicable state contracting agency as soon as reasonably feasible. The section took effect on July 1, 2015.

No person may send unsolicited advertising material by electronic mail, or cause it to be sent, to an electronic mail address held by a Connecticut resident unless the email identifies a toll-free telephone number or a valid return email address the recipient can use to unsubscribe, and the subject line begins with the letters ADV. A sender must also honor a recipient's request to stop sending further such material.

The section excludes an electronic mail service provider or an Internet access provider from the definition of a covered sender. Electronic mail is not unsolicited advertising material if the sender has the recipient's consent, or if the sender has a prior or existing business relationship formed by voluntary communication with the recipient, with or without an exchange of consideration, arising from the recipient's inquiry, application, purchase or use of the sender's products or services.

The provisions do not apply to tax-exempt nonprofit organizations or to political or candidate committees, candidates or solicitors. Any person aggrieved, including an email service provider, may bring a civil action in the Superior Court to enjoin further violations and for five hundred dollars for each violating email, together with costs and a reasonable attorney's fee, brought within two years of the act complained of.

The CAN-SPAM Act's preemption clause leaves in force a state email rule against falsity or deception; neither of these duties is framed that way.

A communications company is any person or organization which owns, controls, operates or manages any company which provides information or entertainment electronically to a household, including but not limited to a cable or community antenna television system.

It is unlawful for a communications company to install and use any equipment which would allow it to visually observe or listen to what is occurring in the household of an individual subscriber without the knowledge or permission of the subscriber.

It is unlawful for a communications company to provide any person or organization with a list containing the name of a subscriber, unless it gives the subscriber notice and the subscriber does not object, or the recipient is acting as its agent, servant or employee. It is unlawful for a communications company to disclose the television viewing habits of any individual subscriber without the consent of the subscriber.

It is unlawful for a communications company to install or maintain a home-protection scanning device in a dwelling as part of a communication service without the express written consent of the occupant. A communications company that violates the section is fined not more than ten thousand dollars for each violation.

A person who has been injured by a violation has a right of action against the communications company to recover damages for the injury, and if the court awards damages the plaintiff is awarded costs. Public Act 84-304 enacted the chapter.

No person may use an instrument, device or equipment to record an oral private telephonic communication unless the recording is preceded by the consent of all parties to the communication, obtained in writing or as part of, and at the start of, the recording, or is preceded by verbal notification recorded at the beginning and made part of the communication, or is accompanied by an automatic tone-warning device that produces a distinct signal repeated at approximately fifteen-second intervals throughout the use of the instrument.

This civil duty reaches a party to the call, unlike the wiretapping and mechanical-overhearing offenses of sections 53a-187 to 53a-189, which apply only to a non-party. It does not apply to a federal, state or local law enforcement official acting in the lawful performance of duty. It does not apply to a public or private safety agency employee recording a call of an emergency nature.

It does not apply to a person who, as the recipient, records a call conveying threats of extortion, bodily harm or other unlawful demands. It does not apply to a person who, as the recipient, records a call that occurs repeatedly or at an extremely inconvenient hour.

Further exceptions reach a communication common carrier's employee performing lawful duties or providing facilities to law enforcement under a wiretapping order, an FCC-licensed broadcast station employee recording solely for broadcast, a United States Secret Service employee recording calls concerning the safety of the President or the White House, and an FCC broadcast licensee's employee recording as part of a broadcast network or cooperative programming effort solely for broadcast.

Connecticut carves out no general exception for a business recording its own customer or sales calls. Such a business must rely on one of the three consent, notice or tone-warning mechanisms like any other recording party. Any person aggrieved by a violation may bring a civil action in the Superior Court to recover damages, together with costs and a reasonable attorney's fee. The section names no fixed statutory-damages amount.

No source stating the specific day Public Act 90-305 came into force has been located. Connecticut's general rule for public acts, General Statutes section 2-32, places the effective date on October 1 of the year of passage absent a stated date in the act itself.

Wiretapping is the intentional overhearing or recording of a telephonic, telegraphic or cellular radio telephone communication by a person other than a sender or receiver of it, without the consent of either the sender or the receiver. Mechanical overhearing of a conversation is the intentional overhearing or recording of a conversation or discussion, without the consent of at least one party to it, by a person not present.

Both offenses therefore reach only a person who is not a sender, receiver or participant, and the consent of any one party takes the conduct outside them; a participant who records their own call or conversation commits neither offense. A person who unlawfully engages in wiretapping or mechanical overhearing of a conversation is guilty of eavesdropping, a class D felony.

Tampering with private communications is a separate offense, committed by a person who, without the sender's or receiver's consent, obtains from a telephone or telegraph corporation's employee, officer or representative information about the contents or nature of a telephonic or telegraphic communication, or who, being such an employee, officer or representative, divulges that information; it is a class A misdemeanor.

These sections do not apply to wiretapping by criminal law enforcement officials in the lawful performance of their duties. Recording of a private telephone call by a party to it is governed instead by the civil statute, section 52-570d.

No person may use a machine that electronically transmits facsimiles through connection with a telephone network, or a device that automatically transmits a recorded telephone message, to transmit unsolicited advertising material or an unsolicited telephone message offering to sell goods or services. The provisions do not apply to tax-exempt nonprofit organizations or to political or candidate committees, candidates or solicitors.

Any person aggrieved by a violation may bring a civil action in the Superior Court to enjoin further violations and for five hundred dollars for each violation, together with costs and a reasonable attorney's fee, brought within two years of the act complained of. The provisions this entry groups came into force on different days.

No telemarketer may make, or cause to be made, a telephonic sales call to a consumer without the consumer's prior express written consent. In addition, no telemarketer may make a telephonic sales call for a marketing or sales solicitation to a consumer's mobile telephone number unless that number is not on the state's quarterly “no sales solicitation calls” listing or the telemarketer has the consumer's prior express written consent.

A telephonic sales call reaches a live voice call, an automated dialing system, a recorded message, soundboard technology, an over-the-top message, or a text or media message. A text or media message does not include electronic mail sent to an electronic mail address.

A telephonic sales call does not include a call or message answering the consumer's own request or inquiry, including one about an item the consumer bought from the telemarketer in the preceding twelve months, a nonprofit's call to its bona fide or active members, a call limited to polling or soliciting votes or an opinion, a business-to-business contact, a call made with the consumer's prior express written consent, a call primarily about an existing debt or contract not yet completed, a call to an existing customer who has not told the telemarketer they no longer want such calls, or a call for a religious, charitable, political or other noncommercial purpose.

Prior express written consent is a written agreement, signed by the consumer, that discloses the means by which the telemarketer will contact the consumer and the telephone number to be contacted, and clearly and conspicuously authorizes advertisements or telemarketing messages by those means. A telephonic sales call not otherwise prohibited is limited to between nine a.m. and eight p.m. local time.

The caller must disclose their identity, the purpose of the call and, if any, the entity on whose behalf they call, within ten seconds after the call begins. The caller must also ask at the beginning whether the consumer wishes to continue, end the call or be removed from the caller's list, and must end the call within ten seconds of the consumer indicating a wish to end it.

If the consumer asks not to receive future calls or to be removed from the list, the caller must confirm the removal, end the call within ten seconds, not call that consumer again at any associated number, and not give, sell, or receive value for the consumer's name, number or other personally identifying information. No telemarketer may install or use a device or service to circumvent a consumer's caller identification, or transmit inaccurate or misleading caller identification information.

A violation of the federal Telephone Consumer Protection Act's implementing rules or the Telemarketing Sales Rule against calling a number on the National Do Not Call Registry or a number that has requested no further calls from a particular entity is also a violation of these sections.

Separately, no person, including but not limited to a telemarketer, may knowingly, or while avoiding knowledge, provide substantial assistance or support to the initiator of a voice communication or telephonic sales call that enables the initiator to initiate, originate, route or transmit it, if the person knows or avoids knowing that the initiator is engaged, or intends to engage, in fraud or a violation of these sections or the Connecticut Unfair Trade Practices Act.

This anti-assistance duty does not prohibit designing, manufacturing or distributing a component, product or technology with a commercially significant use beyond circumventing these rules, a provider offering general Internet access, or a terminating network provider completing a call.

A violation of these sections is an unfair or deceptive trade practice under the Connecticut Unfair Trade Practices Act, section 42-110b, whose private action lets a person who suffers an ascertainable loss of money or property recover actual damages, with punitive damages and equitable relief in the court's discretion. In addition to any penalty under that Act, a person liable under section 42-288a is subject to a fine of not more than twenty thousand dollars for each violation.

A telecommunications company may call its own existing customer without charge about an existing debt, an existing contract, a federally authorized wireless emergency alert, or a prior customer-initiated service request. Public Act 24-75 later broadened the mobile-number consent duty from calls made “for the purpose of marketing, selling or soliciting sales of consumer goods” to any “telephonic sales call for the purpose of a marketing or sales solicitation of consumer goods or services.”

Amends the Connecticut Data Privacy Act so social media platforms must honor a minor's request to unpublish or delete their account (effective July 1, 2024), and requires controllers offering services to known minors under 18 to use reasonable care against heightened risk of harm, including limits on targeted advertising, certain profiling, and precise geolocation collection (effective October 1, 2024).

Public Act 25-113 amended these duties effective July 1, 2026, to bar a controller from processing a known minor's personal data for targeted advertising or any sale of personal data. It also limits a controller's collection of a minor's precise geolocation data to cases where the data are strictly necessary to provide the service.

Part of a 39 section omnibus online safety and artificial intelligence act signed May 27, 2026.

Section 39 bars covered platforms from showing a user personalized algorithmic recommendations unless the operator uses commercially reasonable and technically feasible methods to determine the user is not a minor under 18, or obtains verifiable parental consent for a minor; bars notifications to minors between 9:00 p.m. and 8:00 a.m. absent parental consent; requires protective defaults for minor accounts including a one hour per day limit on algorithmic feeds; requires deletion of age determination data; and requires annual public disclosures.