Connecticut Data Act Fine: Essential Guide for 2026

Last updated November 10, 2026. This article is educational and is not legal advice.

The Connecticut Data Privacy Act, known as the CTDPA, changed in 2026. Amendments that took effect on July 1, 2026 widened who must comply, tightened the rules for sensitive data and profiling, and brought many smaller businesses under the law for the first time. The mandatory cure period that once let businesses fix a violation before facing enforcement is gone. This guide explains who the CTDPA covers today, what the Connecticut Attorney General can do to businesses that do not comply, and what to update now.

Key takeaways

• Who it covers now: Since July 1, 2026, the CTDPA applies to any business that operates in Connecticut or targets Connecticut residents and, in the prior year, controlled or processed the personal data of at least 35,000 consumers, controlled or processed any sensitive data, or offered personal data for sale. Personal data processed only to complete a payment transaction is excluded from the 35,000 count.
• The old thresholds are gone: The previous test of 100,000 consumers, or 25,000 consumers plus more than 25 percent of revenue from selling data, no longer applies. The revenue prong was removed entirely.
• Some triggers have no volume minimum: A business that processes any sensitive data, or sells personal data, can be covered even with a small Connecticut customer base.
• No guaranteed cure period: The 60-day statutory cure period expired on December 31, 2024. The Attorney General can choose to offer a chance to cure but is not required to.
• Penalties: Violations can be enforced under the Connecticut Unfair Trade Practices Act, with civil penalties of up to 5,000 dollars per willful violation, plus injunctions, restitution and disgorgement.

Connecticut Data Privacy Act explained

The CTDPA was signed on May 10, 2022 and took effect on July 1, 2023. It gives Connecticut residents rights to access, correct, delete and obtain a copy of their personal data, and to opt out of targeted advertising, the sale of personal data and certain profiling. It requires covered businesses to limit data collection, give clear privacy notices, protect data and get consent before processing sensitive data. The Connecticut Attorney General is the only enforcer, and the law gives consumers no private right of action.

On June 24, 2025, Connecticut enacted Senate Bill 1295, Public Act 25-113, the most significant set of amendments since the law took effect. Most of its provisions began on July 1, 2026.

Who must comply with the CTDPA in 2026?

A business is covered if it conducts business in Connecticut, or produces products or services targeted to Connecticut residents, and in the preceding calendar year it did any one of the following:

• Controlled or processed the personal data of at least 35,000 consumers, not counting data processed solely to complete a payment transaction.
• Controlled or processed any sensitive data.
• Offered personal data for sale.

Test	Before July 1, 2026	Since July 1, 2026
Consumer volume	100,000 consumers	35,000 consumers
Data sales with revenue test	25,000 consumers and more than 25 percent of revenue from selling data	Removed. Offering personal data for sale is now a trigger on its own
Sensitive data	No separate trigger	Any sensitive data processing is a trigger, with no volume minimum

An example. On June 30, 2026, an online retailer with 40,000 Connecticut customers that sold no data was outside the law. On July 1, 2026, the same retailer was covered. A smaller business that processes a single Connecticut consumer’s sensitive data, such as health or biometric information, can also be covered.

What else changed in 2026

• Sensitive data was expanded, now including neural data among other additions, and the rules on consent and selling sensitive data were tightened.
• Profiling and automated decisions. The amendments add consumer rights and impact assessment duties around profiling. The new profiling impact assessment obligation began on August 1, 2026.
• Privacy notices. Notices must be updated for the new requirements, including disclosure of whether personal data is used to train large language models.
• Narrower financial-institution exemption. The exemption for entities subject to the Gramm-Leach-Bliley Act now covers only GLBA-regulated data and activities, instead of exempting the whole company.
• Senate Bill 4 begins October 1, 2026, adding a ban on selling geolocation data, data broker registration, limits on surveillance pricing, facial recognition rules and genetic data protections.
• Opt-out preference signals. Since January 1, 2025, covered businesses must honor universal opt-out signals such as Global Privacy Control.

Connecticut data act fine: what the penalties are

The Connecticut Attorney General enforces the CTDPA under the Connecticut Unfair Trade Practices Act. Civil penalties can reach 5,000 dollars per willful violation, and fines are set case by case at the Attorney General’s discretion. Each affected consumer or each instance can count as a separate violation, so the totals can grow quickly. Penalties are not the only remedy. The Attorney General can also seek:

• Injunctive relief, a court order to stop a practice.
• Restitution, returning money or property to affected consumers.
• Disgorgement, requiring a company to give up profits gained from the violation.

Connecticut has used its authority. In 2025, the Attorney General reached an 85,000 dollar settlement with TicketNetwork over privacy notice and consumer rights failures, and the Attorney General’s office publishes enforcement reports that highlight common deficiencies, including inadequate privacy notices, weak consumer request handling and consent problems.

The cure period has ended

When the CTDPA began, covered businesses that received a notice of violation from the Attorney General had 60 days to cure before enforcement. That guaranteed right expired on December 31, 2024. Today the Attorney General can pursue enforcement without first offering a cure period. The Attorney General may still choose to offer one, and a prompt, documented fix can still help your position, but you should not plan around it. The July 1, 2026 effective date is best treated as a compliance deadline that has already passed.

CTDPA exemptions

The statute exempts certain categories of organizations and data, including government bodies, entities and data covered by HIPAA, and data covered by laws such as the Fair Credit Reporting Act, the Family Educational Rights and Privacy Act, the Driver’s Privacy Protection Act and the Farm Credit Act. The 2025 amendments changed some exemptions. The most notable change is that the Gramm-Leach-Bliley Act exemption now applies to GLBA-regulated data and activities instead of whole organizations. Confirm your status against the current statute with counsel before relying on any exemption.

How to comply with the CTDPA now

1. Reassess applicability. Count Connecticut consumers using the 35,000 test, and check whether you process any sensitive data or offer personal data for sale. Assume you may be covered until you confirm otherwise.
2. Update your privacy notice for the 2026 requirements, including large language model training disclosures and the new consumer rights.
3. Honor opt-out signals. Make sure your consent tools respect Global Privacy Control and that tags actually stop when a visitor opts out. Test it, not just the banner.
4. Review sensitive data practices. Get consent before processing sensitive data, and stop selling it without consent.
5. Run profiling assessments where you profile consumers in ways the law covers.
6. Check consumer request handling. Make sure access, correction, deletion and opt-out requests are logged and answered on time.
7. Prepare for Senate Bill 4 if you handle geolocation data, facial recognition, genetic data or dynamic pricing based on personal data.
8. Document everything. With no guaranteed cure period, records of your compliance work are your best protection.

Frequently asked questions

What is the penalty for violating the CTDPA?

Civil penalties can reach 5,000 dollars per willful violation under the Connecticut Unfair Trade Practices Act. The Attorney General can also seek injunctions, restitution and disgorgement.

Who does the CTDPA apply to?

Since July 1, 2026, it applies to businesses that operate in Connecticut or target Connecticut residents and, in the prior year, controlled or processed the personal data of at least 35,000 consumers, controlled or processed any sensitive data, or offered personal data for sale.

Is there still a cure period under the CTDPA?

No guaranteed one. The 60-day statutory cure period ended on December 31, 2024. The Attorney General may choose to offer a cure opportunity but is not required to.

Does the CTDPA apply to small businesses?

It can. The 35,000-consumer threshold is lower than before, and the sensitive data and data sale triggers have no volume minimum. Small businesses that process sensitive data or sell personal data may be covered.

Can consumers sue under the CTDPA?

No. The Connecticut Attorney General is the sole enforcer, and the law does not create a private right of action.

When did the CTDPA start?

It took effect on July 1, 2023. Major amendments took effect on July 1, 2026, with profiling impact assessments beginning August 1, 2026 and additional requirements from Senate Bill 4 beginning October 1, 2026.

This article is general information for educational purposes and does not constitute legal advice. Laws, regulations and enforcement priorities change, and their application depends on your facts. Consult a licensed attorney about your situation.