Connecticut Data Privacy Act: Your Rights

Connecticut residents can access, correct and delete data and opt out of sales, targeted ads and profiling.

By Siddharth ShankarUpdated October 23, 2026

Connecticut has a comprehensive privacy law that gives residents several rights over their data. This guide follows the Connecticut Attorney General’s page on the Connecticut Data Privacy Act, or CTDPA.

When it took effect

The CTDPA took effect on July 1, 2023. Governor Ned Lamont signed it as Senate Bill 6 in May 2022.

Who must comply

The Act applies to people conducting business in Connecticut, or targeting products or services to Connecticut residents, that meet one of three thresholds. They controlled or processed personal data of at least 35,000 consumers, excluding payment-only data; they processed consumers’ sensitive data, excluding payment-only data; or they offered consumers’ personal data for sale. Consumer health data controllers have no size threshold. Service providers, called processors, are also covered. Exempt entities include state and local governments, most nonprofits, HIPAA entities, financial institutions covered by the federal Gramm-Leach-Bliley Act and higher education institutions.

Your rights

Connecticut residents may:

• access, correct and delete their personal data;
• obtain a portable copy;
• get a list of third parties to which their data was sold;
• opt out of data sales, targeted advertising and profiling with legal or similarly significant effects.

Response times

Controllers must respond no later than 45 days after receiving a request, and may extend that by 45 days under certain conditions.

Appeals

You can appeal if a controller denies a request. The controller has 60 days after receiving the appeal to respond. If it denies the appeal, it must give you information on contacting the Attorney General.

Universal opt-out signals

Controllers must honour opt-out preference signals as of January 1, 2025. Consumers can send such signals, for example Global Privacy Control, through a privacy-protective browser or extension. Read how to turn on Global Privacy Control.

Complaints and enforcement

The Attorney General’s page does not describe a specific CTDPA complaint procedure. It says controllers must provide contact information for the Attorney General for consumers who want to file a complaint, and the site has a general complaint link. The Attorney General has exclusive authority to enforce the Act. There is no private right of action. Violations may bring civil penalties of up to $5,000 per violation under the Connecticut Unfair Trade Practices Act, and the Attorney General may also seek injunctive relief, restitution and disgorgement.

How to use your rights

1. Look for the business’s privacy notice and its request method.
2. Identify yourself as a Connecticut resident and name the right you are using.
3. Keep a record of the request and the date.
4. Wait for the 45-day period, then follow up.
5. Appeal a denial, and contact the Attorney General if you remain unsatisfied.
6. Turn on an opt-out signal in your browser to send your opt-out automatically.

Data brokers

Data brokers collect and sell personal details. Where the law applies, you can ask them to delete data or stop selling it. Our guides on opting out of data brokers and what data brokers are explain the process. California has a special tool, covered in the Delete Act and DROP guide.

Compare with other states

See Virginia, Colorado and Texas. Details such as thresholds and penalties differ from state to state.