On May 4, 2026, the Connecticut House of Representatives passed Senate Bill 4 by a resounding 141-6 vote, sending the far-reaching consumer privacy legislation to Governor Ned Lamont’s desk for expected signature. This follows the Senate’s 31-4 approval the prior week.
SB 4 builds directly on the Connecticut Data Privacy Act (CTDPA) — the state’s landmark 2023 comprehensive privacy law — while introducing a dedicated regulatory framework for data brokers, new restrictions on sensitive data uses, and powerful consumer empowerment tools.
In the context of Gartner’s landmark estimate of $3.425 billion in U.S. state privacy fines in 2025 alone, Connecticut is positioning itself as a national leader in turning consumer rights into enforceable realities.
Core Provisions of Senate Bill 4
1. Data Broker Registry and “Delete” Mechanism
- Defines data brokers as businesses that sell or license “brokered personal data” to others.
- Requires registration with the Department of Consumer Protection (DCP), including mandatory fees.
- Creates a statewide, accessible deletion mechanism allowing consumers to request removal of their personal data from broker databases and websites — at no cost.
- Prohibits data brokers from selling or licensing personal data in violation of the bill or CTDPA.
2. Major CTDPA Amendments
- Precise geolocation data: Bans the sale, sharing, transfer, or granting of access.
- Facial recognition technology: New definitions, disclosure requirements (especially in public spaces), and consumer rights to request removal of images.
- Profiling and automated decisions: Additional consumer rights; eliminates some entity-level exemptions for employment-related processing.
- Surveillance / algorithmic pricing: Requires disclosures for personalized pricing based on consumer data.
- Strengthened protections for genetic and biometric data.
- Restrictions on automated license plate reader data in state and municipal contracts.
3. Additional Consumer Protections
- Measures to reduce certain data-driven advertising on streaming services.
- Tools to combat stalking, identity theft, unwanted marketing, and discriminatory pricing.
Effective Dates: Many provisions take effect October 1, 2026, with phased implementation.
Why This Matters Nationally
Connecticut’s SB 4 arrives as privacy enforcement has shifted from education to aggressive penalties. The $3.425 billion in 2025 fines — driven largely by consent failures, ignored opt-out signals (including Global Privacy Control), and improper data sharing — showed regulators mean business.
Data brokers have long operated in a regulatory gray area. By creating a registry, mandatory fees, and an easy “delete” tool, Connecticut joins California, Oregon, and Vermont in directly targeting this industry.
Business Impact and the Balancing Act
Lawmakers (led by Sen. James Maroney and Rep. Hubert Delany) emphasized balance. The bill focuses specifically on data brokers rather than imposing blanket burdens on small businesses, healthcare, or financial institutions. Amendments addressed concerns raised by the Connecticut Business and Industry Association and national tech groups.
Nevertheless, covered companies will need to:
- Register as data brokers and pay fees
- Update privacy notices, contracts, and risk assessments
- Build robust systems to honor expanded deletion and opt-out rights
- Add disclosures for algorithmic pricing tools
Connecticut’s Privacy Leadership
- 2023: Enacted CTDPA (fifth state with comprehensive privacy law)
- 2025–2026: Bipartisan AI Caucus drives SB 4 (privacy) + SB 5 (AI regulations)
- 2026: Now one of a small group of states with both strong AI and data privacy frameworks
Outlook and Recommendations for Businesses
With Governor Lamont expected to sign SB 4 shortly, organizations operating in Connecticut (or nationally) should act now:
- Inventory all data broker relationships and third-party data sharing
- Audit geolocation, facial recognition, biometric, and profiling practices
- Prepare deletion request handling capabilities
- Review and document algorithmic pricing systems for disclosure readiness
Connecticut is reinforcing the national message that personal data belongs to the individual — and regulators now have sharper teeth to back it up.
