Get Your Website Ready for CTDPA Compliance

CTDPA stands for the Connecticut Data Privacy Act. Effective since July 1, 2023, it gives Connecticut residents rights over their personal data and establishes obligations for covered controllers and processors.

Changes effective July 1, 2026 expanded its scope, sensitive data categories and protections for minors. The law is enforced exclusively by the Connecticut Attorney General.

A sale is the exchange of personal data by a controller to a third party for money or other valuable consideration. Connecticut consumers have the right to opt out of these transactions.

Disclosures to a processor acting on the controller’s behalf, transfers to an affiliate and disclosures needed to provide a consumer-requested product or service are not automatically treated as sales. Certain merger, acquisition and consumer-directed transfers are also excluded from the statutory definition.

CTDPA compliance means meeting the obligations that apply to an organisation’s processing of Connecticut consumers’ personal data. Depending on its activities, a covered controller may need to:

• Publish a clear and accessible privacy notice.

• Limit data collection to what is reasonably necessary.

• Obtain consent before processing sensitive data.

• Provide consumer rights and appeal mechanisms.

• Support opt-outs for sales, targeted advertising and qualifying profiling.

• Recognise applicable universal opt-out signals.

• Implement reasonable security measures.

• Conduct assessments for processing that presents a heightened risk of harm.

A cookie banner may support part of this process, but it does not establish CTDPA compliance by itself.

The CTDPA contains both entity-level and data-level exemptions. Exempt entities include certain state and local government bodies, financial institutions subject to the Gramm-Leach-Bliley Act, higher education institutions, political committees, insurance entities and qualifying healthcare organisations.

Certain data regulated under laws such as HIPAA, the Fair Credit Reporting Act, the Family Educational Rights and Privacy Act and the Gramm-Leach-Bliley Act may also be excluded. Exemptions are activity-specific in some cases; for example, nonprofits can still be covered when acting as consumer health data controllers.

Subject to applicable exceptions, Connecticut consumers have the right to:

• Confirm whether their personal data is being processed and access it.

• Correct inaccurate personal data.

• Request deletion of personal data.

• Obtain eligible data in a portable format.

• Receive information about third parties to which their data was sold.

• Opt out of personal data sales, targeted advertising and qualifying profiling.

• Appeal a controller’s refusal to fulfil a request.

Controllers generally must respond within 45 days. A further 45-day extension is permitted when reasonably necessary and properly communicated to the consumer.

The CTDPA does not require every website to display a cookie consent banner. The need for consent or opt-out controls depends on what the website’s cookies and tracking technologies do with personal data.

Consent is required before processing sensitive data. Clear opt-out controls are required when a covered controller sells personal data or uses it for targeted advertising. A consent management platform can support these choices, but the interface must correspond with the website’s actual data-processing activities.

Yes. Since January 1, 2025, covered controllers must recognise applicable opt-out preference signals sent by Connecticut consumers. These signals apply to the sale of personal data and its use for targeted advertising.

Global Privacy Control is a common example. The signal must enable the controller to reasonably determine that the user is a Connecticut resident, and the website’s privacy notice should explain how such signals are handled.