Connecticut

Takes effect October 1, 2026.

A frontier developer, defined as anyone who trains or intends to train a foundation model using more than ten to the twenty-sixth power of computing operations, may not retaliate against a covered employee for reporting a reasonable belief that the developer's activity poses a specific and substantial danger to public health or safety through a catastrophic risk, defined to include contributing to more than fifty deaths or serious injuries or more than one billion dollars of property damage or loss from a single incident.

A large frontier developer, one with annual gross revenues over five hundred million dollars, must by January 1, 2027 establish an internal process for a covered employee to anonymously report such concerns, share reports with officers and directors at least quarterly, and give employees notice of their rights under the section.

A frontier developer that violates the notice or anti-retaliation provisions is liable to the state for a civil penalty of up to one thousand dollars per violation, recoverable by the Attorney General in Superior Court for the judicial district of Hartford.

Signed May 26, 2026 and taking effect October 1, 2026.

An individual harmed by the unlawful dissemination of a synthetically created intimate image, defined the same way as in Conn. Gen. Stat. Sec. 53a-189d, may bring a civil action for an injunction and for economic, emotional-distress, and punitive damages against a person who knowingly disseminated the image intending to cause harm, within two years of discovering the dissemination, with costs and attorneys' fees available to the prevailing party.

Separately, a covered platform under 47 U.S.C. Sec. 223a must set up a notice-and-removal process for a harmed individual or the Attorney General to report such an image, post a clear and conspicuous notice describing that process, and, within forty-eight hours of a valid request, remove the image and make reasonable efforts to remove copies, with good-faith removal shielded from liability.

A platform that violates the removal duty is subject to a civil penalty of up to twenty-five thousand dollars per day, sought by the Attorney General in Superior Court, in addition to the harmed individual's own private right of action.

In effect since October 1, 2024. Connecticut's definition of child sexual abuse material, which governs the promoting, importing, and possessing offenses at Conn. Gen. Stat. Secs. 53a-196a to 53a-196f, was amended to cover a computer-generated image or picture, made or produced by electronic, digital, mechanical, or other means, of sexually explicit conduct, where a person under sixteen was used in producing the depiction.

The 2024 amendment also renamed the term from child pornography to child sexual abuse material throughout the definition.

In effect since October 1, 2025.

A person commits unlawful dissemination of an intimate synthetically created image by intentionally disseminating, without the depicted person's consent, an image that is not wholly recorded by a camera or is partially or wholly computer-generated, depicts a person's genitals, pubic area, buttocks, breast, or sexual intercourse, and is virtually indistinguishable from what a reasonable person would believe is an actual depiction of an identifiable person, where the depicted person suffers harm from the dissemination.

Dissemination to one person is a class D misdemeanor, or a class A misdemeanor if the person created or acquired the image intending to cause harm; dissemination to more than one person through an interactive computer, information, or telecommunications service is a class C misdemeanor, or a class D felony with that same intent. An interactive computer service, information service, or telecommunications service provider is not liable for content provided by another person.

Enacted effective October 1, 2026, binding a deployment of automated employment-related decision technology, technology that processes personal data to produce an output that is a substantial factor in a decision to hire, promote, discipline, discharge, or set the terms of someone's employment, on or after October 1, 2027. A developer must give a deployer the information the deployer needs to meet its own duties.

A deployer must ensure an employee or applicant is told when they are interacting with the technology, unless that would be obvious, and before an employment-related decision is made must give written notice naming the technology, its purpose, the categories and sources of personal data it analyzes, and contact information, subject to a trade-secret withholding notice.

A companion amendment to the state's employment discrimination statute, Conn. Gen. Stat. Sec. 46a-60(b)(1), provides that using such technology is not a defense to a discrimination complaint, though anti-bias testing may be considered as evidence. Violations are enforced solely by the Attorney General as an unfair trade practice, with a sixty-day cure period available for violations occurring on or before December 31, 2027, and create no private right of action.

Takes effect October 1, 2026. An employer that serves a mass-layoff notice on the Connecticut Labor Department under the federal WARN Act, 29 U.S.C. Sec. 2102(a), must also disclose to the department, in a form the Labor Commissioner prescribes, whether the layoffs relate to the employer's use of artificial intelligence or another technological change.

Takes effect January 1, 2027.

An operator of an artificial intelligence companion, an AI system with a natural language interface designed to sustain a relationship across multiple interactions, that would cause a reasonable user to believe they are speaking with a human must give a clear and conspicuous notice that the user is communicating with an artificial intelligence companion, repeated at least hourly for a user under eighteen and at least every three hours for an adult user, and must respond to a direct question about whether it is human by disclosing that it is not.

A violation of the disclosure duty is enforced solely by the Attorney General as an unfair trade practice and creates no private right of action.

Separately, an operator that knows or has reason to believe a user is a minor may not let the companion encourage self-harm, suicide, or violence, offer mental-health services outside narrow exceptions, discourage the user from seeking help from a professional or a trusted adult, engage in romantic or sexually explicit interaction, or use enumerated manipulative engagement techniques, and must give minor users and their parents tools to manage screen time and account settings.

Takes effect October 1, 2026.

A covered provider, defined as anyone who creates a generative artificial intelligence system that has more than one million users a month and is publicly accessible to consumers, must, to the extent commercially and technically reasonable, embed provenance data in audio, image, or video content its system creates or materially alters, letting a consumer assess whether the content came from that system, and must use commercially and technically reasonable methods, including the Coalition for Content Provenance and Authenticity standard, to make that data hard to remove or tamper with.

The duty does not require identifying an individual depicted in the content or disclosing a trade secret.

Takes effect October 1, 2026. A subscription-based provider of an artificial intelligence technology may not enter into or renew a consumer subscription, or collect a fee for one, unless the provider first gives the consumer written notice of the key terms and conditions and the consumer accepts them in writing.

The initial-subscription notice must disclose any quantitative or qualitative limitations the provider may impose, including limitations it may impose in response to the consumer's own conduct, and whether the provider has discretion to limit or eliminate the consumer's access to, or reduce the quality of, the technology's functionality. A renewal notice must disclose any such limitation or discretion that is new or has changed since the prior term.

A person who owns, licenses, or maintains computerized data including personal information must notify each affected Connecticut resident of a breach without unreasonable delay, and no later than 60 days after discovery unless federal law requires a shorter time. 'Personal information' excludes publicly available information lawfully made available to the general public from government records or widely distributed media.

Unlike CTDPA, which bars a private right of action outright, this breach-notification section deems a violation an unfair trade practice under section 42-110b, and CUTPA's own private-action provision, section 42-110g, lets any person who suffers an ascertainable loss from a practice prohibited by section 42-110b sue for damages, so a breach-notice violation carries indirect private-plaintiff exposure that the comprehensive act does not.

This provision is in force under the current codified text; no dated original commencement is established, so no effective date is recorded here.

CTDPA governs private-sector processing of Connecticut residents' personal data. Enacted as Public Act 22-15 (S.B. 6, 2022), effective July 1, 2023. Controller and processor duties are allocated at sections 42-515 to 42-524. S.B. 1295, enacted as Public Act 25-113 (signed June 25, 2025), substantially amended the Act, with amendments effective July 1, 2026, including a lower applicability threshold and an expanded profiling opt-out.

The base chapter as published at cga.ct.gov's 'current' text has not yet folded this Public Act in, directing readers to a separate 2026 Supplement instead; the July 1, 2026 effective date and the amendment's substance are confirmed against the enrolled Public Act 25-113 text itself.

CTDPA gives a Connecticut consumer the right to confirm processing, access, correct, delete, obtain a portable copy, and opt out of targeted advertising, sale, and qualifying profiling. A controller must respond without undue delay and no later than 45 days after receipt, with one 45-day extension available.

Public Act 25-113 (S.B. 1295, 2025 session, effective July 1, 2026) removed the 'solely automated' qualifier so the profiling opt-out and a new right to contest automated-decision outcomes reach decisions with human involvement, and its Sec. 11 (amending section 42-522) adds a new impact-assessment requirement for such profiling applying to processing activities created or generated on or after August 1, 2026, confirmed against the enrolled act's own text.

The Connecticut Attorney General has exclusive authority to enforce CTDPA as an unfair trade practice under section 42-110b. A cure period was mandatory (60 days) from July 1, 2023 through December 31, 2024; from January 1, 2025 it became discretionary, weighed against factors including violation count, controller size, likelihood of public injury, and data sensitivity. The chapter creates no private right of action.

CTDPA classifies data revealing racial or ethnic origin, religious beliefs, mental or physical health condition or diagnosis, sex life, sexual orientation, citizenship or immigration status, consumer health data, the processing of genetic or biometric data to uniquely identify an individual, a known child's data, victim-of-crime status, and precise geolocation data as sensitive data.

'Biometric data' means data from automatic measurement of biological characteristics used to identify a person, such as a fingerprint or voiceprint, and the raw photograph or recording is excluded, but data generated from it (a faceprint, a voiceprint) is brought back inside 'biometric data' the moment it is generated to identify a specific individual.

This clawback is the material finding for Connecticut: a voiceprint or faceprint manufactured from a public-facing recording for identification purposes is covered biometric and sensitive data here.

Section 53a-251(b)(1) criminalizes unauthorized access to a computer system when a person, knowing that he is not authorized to do so, accesses or causes to be accessed any computer system without authorization. The statute does not itself define without authorization for a system open to the public, so it carries the same textual gap the federal Computer Fraud and Abuse Act (CFAA) has always carried, and no Connecticut appellate decision construes it against a scraper of public pages.

Grading turns on the dollar value of damage or of computer services, and the statute fixes the value of private personal data at $1,500 for grading purposes (section 53a-259(c)), which matters specifically for personal-data scraping.

The Second Circuit's narrow construction of exceeds authorized access in United States v. Valle (807 F.3d 508, 2d Cir. 2015), consistent with the national reading Van Buren v. United States (593 U.S. 374, 2021) later adopted, is the closest regional authority, though it is federal rather than Connecticut law. Section 53a-251 was added by Public Act 84-206 and carries no History note in the official statute text, meaning it has never been amended since.

That Act's own conversion table shows no override of the general default rule for the effective date of a Connecticut public act (Conn. Gen. Stat. § 2-32: the first day of October following the session at which it was passed), so the section commenced October 1, 1984.

Section 42-515(26) defines personal data to exclude de-identified data or publicly available information outright, and section 42-515(33) defines publicly available information as information that is lawfully made available through federal, state or municipal government records or widely distributed media, and that a controller has a reasonable basis to believe a consumer has lawfully made available to the general public.

Because the exclusion operates on the definition of personal data itself, most scraped public-record or publicly posted personal data falls outside the CTDPA's scope entirely, not merely outside a narrower carve-out from an otherwise-applicable duty.

The Act applies to a business conducting business in Connecticut that, in the preceding calendar year, controlled or processed the personal data of 100,000 or more consumers (excluding payment-transaction data), or 25,000 or more consumers while deriving more than 25% of gross revenue from the sale of personal data.

Separate 2026 amendments (S.B. 1295) added a right to contest automated-decision outcomes and a universal opt-out preference signal requirement, effective July 1, 2026, and a data-protection impact assessment duty for qualifying profiling activities created or generated on or after August 1, 2026; neither amendment changes the publicly-available exemption itself. How a Connecticut court would apply the reasonable-basis-to-believe standard is unlitigated. CTDPA was enacted as Public Act 22-15 and, per its own effective-date history note, took effect July 1, 2023.

Public Act 21-119 (2021) shields a 'covered entity', any business that accesses, maintains, communicates or processes personal or restricted information through a system, network or service located in or outside Connecticut, from punitive damages in a tort action alleging that a failure to implement reasonable cybersecurity controls caused a data breach, where the entity created, maintained and complied with a written cybersecurity program with administrative, technical and physical safeguards that conforms to a named industry framework.

The shield does not apply where the failure was the result of gross negligence or wilful or wanton conduct. The section creates no duty to adopt a program of its own and does not limit the Attorney General's or the Commissioner of Consumer Protection's authority to seek other relief. It leaves undisturbed the process for certifying a class action founded in tort. It also leaves undisturbed the requirements of the state's breach-notification statute at Section 36a-701b.

Any person in possession of another person's personal information must safeguard the data, computer files and documents containing it from misuse by third parties, and destroy, erase or make it unreadable before disposal. Any person who collects Social Security numbers in the course of business must create and publish a privacy protection policy that protects their confidentiality, prohibits unlawful disclosure and limits access.

The section does not apply to a state agency or political subdivision of the state. A financial institution that has adopted safeguards complying with the Gramm-Leach-Bliley Act's Section 501(b) standards is deemed compliant with this section.

Amends the Connecticut Data Privacy Act so social media platforms must honor a minor's request to unpublish or delete their account (effective July 1, 2024), and requires controllers offering services to known minors under 18 to use reasonable care against heightened risk of harm, including limits on targeted advertising, certain profiling, and precise geolocation collection (effective October 1, 2024).

Part of a 39 section omnibus online safety and artificial intelligence act signed June 2, 2026.

Section 39 bars covered platforms from showing a user personalized algorithmic recommendations unless the operator uses commercially reasonable and technically feasible methods to determine the user is not a minor under 18, or obtains verifiable parental consent for a minor; bars notifications to minors between 9:00 p.m. and 8:00 a.m. absent parental consent; requires protective defaults for minor accounts including a one hour per day limit on algorithmic feeds; requires deletion of age determination data; and requires annual public disclosures.