Connecticut has significantly expanded and toughened its consumer privacy law. Under Senate Bill 1295 (Public Act 25-113), sweeping amendments to the Connecticut Data Privacy Act (CTDPA) took effect on July 1, 2026, with one key obligation – a new profiling impact assessment – following on August 1, 2026. The amendments widen who must comply, broaden the data the law protects, and add new obligations around profiling, artificial intelligence, minors’ data, and privacy disclosures. For many businesses, the takeaway is simple: you may now be covered even if you never were before.
Who Is Now Covered?
As of July 1, 2026, the CTDPA applies to any entity that conducts business in Connecticut, or targets products or services to Connecticut residents, and that during the preceding calendar year satisfied any one of the following:
