Connecticut Revamps Its Privacy Law (Again)

Connecticut continues to tinker with its comprehensive privacy law—the Connecticut Data Privacy Act (CDPA). This year the revisions come courtesy of Senate Bill 1295, which the governor signed on June 24, 2025. The changes lower thresholds for the law to apply, update exemptions, create new categories of sensitive data, expand consumer rights, and more. These changes take effect on July 1, 2026.

Application and Exemptions

The amended CDPA will apply to more companies and certain financial institutions (that were previously exempt).

• Thresholds. The legislature added a new trigger: Companies must comply with the CDPA if they process sensitive data. And the amendedlaw revamps the existing thresholds. Starting in July 2026, the CDPA will apply to companies that process personal information about at least 35,000 individuals (previously it was 100,000) or sell such information about at least one individual (previously it was 25,000 and included a requirement that