Connecticut Data Privacy Law (CTDPA): What Connecticut Residents Need to Know

The Connecticut Data Privacy Act (CTDPA) took effect on July 1, 2023, making Connecticut the fifth state with comprehensive consumer data privacy legislation. The law gives residents rights over their personal data, requires businesses to honor browser-based opt-out signals, and provides an appeal process for denied requests. Here is how it works.

What Is the Connecticut Data Privacy Act?

Governor Ned Lamont signed the Connecticut Data Privacy Act into law on May 10, 2022. It became effective July 1, 2023 — the same day as Colorado's CPA — making Connecticut the fifth state to pass a comprehensive consumer privacy law.

The CTDPA applies to persons or businesses that conduct business in Connecticut or produce products or services targeted to Connecticut residents, and during the prior calendar year either: controlled or processed personal data of at least 100,000 Connecticut consumers, excluding data processed solely for completing a payment transaction; or controlled or processed personal data of at least 25,000 Connecticut consumers and derived more than 25% of gross revenue from the sale of personal data.

Connecticut's revenue threshold is 25%, lower than Virginia's and Colorado's 50%. Data brokers that derive a quarter of their revenue from selling personal data are covered even if they process fewer consumer records than the primary threshold requires. For most large data brokers, both thresholds are met, but the lower percentage pulls in a wider set of smaller data sellers too.

Your Rights Under the CTDPA

Connecticut residents have six rights under the CTDPA — the standard five plus a specific right to opt out of profiling:

Controllers must respond to authenticated consumer requests within 45 days. The response period may be extended by an additional 45 days when reasonably necessary, provided the controller notifies you within the initial 45-day period. Requests are free of charge, and controllers cannot retaliate against consumers for exercising their privacy rights.

Connecticut's Universal Opt-Out Mechanism

Like California and Colorado, Connecticut requires covered businesses to honor universal opt-out signals. Starting January 1, 2025, Connecticut businesses must recognize and comply with opt-out preference signals transmitted via browser or device settings — specifically, signals that meet criteria established by the Connecticut Attorney General in consultation with stakeholders.

The Global Privacy Control (GPC) is the leading technology that satisfies this requirement. When you enable GPC in your browser (supported natively by Firefox, Brave, and others, and available as an extension for Chrome), covered Connecticut businesses must treat it as a valid opt-out of data sales and targeted advertising — without requiring you to complete a separate opt-out form for each site.

How the CTDPA Compares to CCPA

What Data Brokers Must Do Under the CTDPA

Connecticut's law places substantive obligations on data controllers processing Connecticut consumer data:

• Publish a clear privacy notice disclosing the categories of personal data processed, the purposes of processing, how consumers can exercise their rights, the categories of personal data shared with third parties, and whether data is sold or used for targeted advertising.
• Honor universal opt-out signals (GPC and equivalent) starting January 1, 2025. Failure to recognize these signals after that date is a violation of the CTDPA.
• Obtain consent before processing sensitive data, including data concerning racial or ethnic origin, religious beliefs, mental or physical health conditions, sexual orientation, citizenship status, biometric data, precise geolocation, and data concerning children.
• Conduct data protection assessments before engaging in processing activities that present heightened risk to consumers, including sale of personal data and targeted advertising.
• Respond to deletion requests within 45 days and instruct processors to delete the same data. Legitimate exceptions include data needed to fulfill a contract, data subject to legal hold, or data necessary for cybersecurity purposes.
• Provide a meaningful appeals process for denied requests, with a response required within 60 days.

Step-by-Step: How to Use the CTDPA to Delete Your Data

1. 1. Enable GPC in your browser. This automatically sends a legal opt-out signal to covered Connecticut businesses. For Firefox users, go to Settings > Privacy and Security > Enable "Tell websites not to sell or share my data." For Brave, it is enabled by default.
2. 2. Locate the data broker's privacy notice. Check the site's footer for "Privacy Policy," "Connecticut Privacy Rights," or "Do Not Sell or Share My Personal Information." CTDPA requires this information to be clearly accessible.
3. 3. Submit your deletion request. Use the company's designated mechanism — web form, email, or phone. Identify yourself as a Connecticut resident and request deletion of all personal data the company holds about you. Include any names, email addresses, phone numbers, or physical addresses associated with your profile.
4. 4. Respond to identity verification. The company may verify your identity before processing the request. This is standard — provide what is requested but note that companies cannot require you to create an account solely to submit a request.
5. 5. Track your 45-day window. Keep records of your submission date and any confirmation emails. If you receive a notice of extension, note the new deadline.
6. 6. Appeal denials. If your request is denied, submit a formal appeal within the time frame specified in the company's denial notice. If the appeal is denied, file a complaint with the Connecticut Attorney General at portal.ct.gov/AG.

The CTDPA gives residents real control over their data. The practical problem, as with any state law, is scale — hundreds of data brokers, each with different opt-out procedures. Authorized agent services like GhostVault submit requests on your behalf across 500+ brokers at once. For more on the broader framework, see our guide to California's CCPA rights.

Frequently Asked Questions