Connecticut’s amended Data Privacy Act takes effect July 1, 2026, tightening business rules.
Why it matters: Legal and compliance teams at affected companies must act now to update policies and systems. The changes broaden the law's scope and escalate enforcement risks, potentially raising compliance costs and workloads.
- Amendments signed June 24, 2025; effective July 1, 2026.
- Threshold for applicability drops from 100,000 to 35,000 Connecticut residents.
- Sensitive data now includes disability, biometric, genetic, neural, and financial data.
- New rules require opt-in consent for sensitive data and ban sale of precise geolocation data.
The Connecticut Data Privacy Act (CTDPA) amendments, enacted via Senate Bill 1295 on June 24, 2025, take effect on July 1, 2026. They significantly broaden privacy obligations for businesses handling personal data of Connecticut residents. The threshold for applying the law falls sharply—from covering businesses processing data of over 100,000 residents to those processing data of just 35,000, expanding the pool of affected companies (
NatLawReview).
The amended CTDPA extends to any business that sells personal data or processes sensitive data, regardless of the number of residents. Sensitive data definitions are expanded to include disability or treatment details, nonbinary and transgender status, genetic, biometric, certain financial information, government-issued IDs, and neural data—information derived from brain activity (
Connecticut AG Office PDF).
Crucially, businesses must now obtain opt-in consent before collecting or using sensitive data—marking a stricter standard than before. The law also bans the sale of precise geolocation data of Connecticut residents and tightly controls facial recognition technology, limiting it to matching images against databases and requiring visible notice where used (
Mintz Viewpoint).
The CTDPA mandates a data broker registry, requiring annual registration and easy consumer options to delete personal data. Protections for minors include bans on processing their data for targeted ads or sales, prohibiting "addictive design" features intended to prolong usage, and restricting geolocation data collection unless essential—a response to concerns about tech companies exploiting children’s attention (
Attorney General Tong Statement).
Privacy experts from consulting firms caution that lowering the applicability threshold and removing a guaranteed cure period before enforcement means increased compliance risks. They advise companies to promptly revise data governance frameworks, consent protocols, and privacy disclosures to meet the new requirements well before July 2026.
By the numbers:
- 35,000 residents — new lower applicability threshold under CTDPA
- July 1, 2026 — effective date of Connecticut's data privacy amendments
- June 24, 2025 — date Senate Bill 1295 was signed into law
Yes, but: While the amendments strengthen consumer protections, some businesses may face significant compliance costs and operational challenges adapting to stricter consent and data use rules.
What's next: Businesses should begin compliance assessments and policy updates immediately to meet the July 2026 deadline and avoid penalties.