Connecticut Fifth State To Pass A Comprehensive Privacy Law

Connecticut just joined California, Colorado, Utah, and Virginia in passing a comprehensive privacy law. The Connecticut Data Privacy Act (CTDPA) goes into effect July 1, 2023, the same time as Colorado's very similar law. Companies preparing for these new laws (Virginia goes into effect January 1, 2023 and Utah December 31, 2023) will want to keep in mind the following five things about this fifth general US state privacy law.

1. Applicability. It applies to businesses that (1) conduct business in Connecticut, or produce products or services targeted to CT residents; and (2) during the preceding calendar year either (a) controlled/processed the personal data of at least 100,000 consumers (excluding for payment transactions), or (b) controlled/processed the personal data of at least 25,000 consumers and derived more than 25% of gross revenue from the sale of personal data. A "consumer" is not an employee or individual acting in their role as an employee. Similar to