Connecticut Just Passed the Strongest Data Broker Law in the Country (SB4)

On May 4, 2026, the Connecticut House of Representatives passed SB4 by a vote of 141 to 6. The bill now heads to Governor Ned Lamont's desk for signature. If signed — and there is every indication it will be — Connecticut will have the strongest data broker law in the United States, surpassing even California's landmark Delete Act.

What SB4 Does

SB4 is not an incremental privacy update. It is a comprehensive overhaul of how data brokers operate in Connecticut, and it introduces several provisions that no other state has enacted. The bill builds on the Connecticut Data Privacy Act (CTDPA), which took effect in July 2023, but goes substantially further.

At its core, SB4 does four things: it creates a centralized deletion mechanism, establishes a mandatory data broker registry, bans surveillance pricing, and restricts the sale of geolocation data. Each of these provisions addresses a gap that existing state privacy laws — including California's — have left open.

The Centralized Deletion Mechanism

The centerpiece of SB4 is a centralized portal where Connecticut residents can submit a single deletion request that goes to every data broker registered with the state. If this sounds familiar, it should — California launched its DELETE Request Online Portal (DROP) on January 1, 2026 under the Delete Act. Connecticut's version takes the same concept and strengthens it.

Where DROP relies on brokers to voluntarily comply within a generous timeline, SB4 pairs the deletion mechanism with a mandatory registry. Every broker that collects, processes, or sells Connecticut residents' personal data must register with the state. Unregistered brokers face penalties, which closes the loophole that makes DROP less effective — in California, brokers that simply don't register can avoid the system entirely.

The deletion portal will also require brokers to confirm that they have processed deletion requests, rather than leaving consumers in the dark about whether their data was actually removed. This addresses one of the biggest shortcomings we identified in our review of California's DROP: the complete lack of transparency after you submit a request.

The Surveillance Pricing Ban

This is where SB4 breaks genuinely new ground. No other state law has banned surveillance pricing — the practice of using consumers' personal data to charge them different prices for the same product or service.

Surveillance pricing works like this: a company collects data about you — your browsing history, purchase patterns, income estimates, location, device type — and uses that data to determine what price to show you. Someone identified as a high earner in a wealthy ZIP code might see a higher price for the same product than someone in a lower-income area. Someone who has been browsing a product repeatedly might see the price go up. Someone using an iPhone might see a different price than someone on Android.

This is not hypothetical. The FTC issued a report in January 2025 confirming that major retailers, travel companies, and service providers use personal data to set individualized prices. Connecticut's SB4 makes this practice illegal for Connecticut consumers. Companies cannot use personal data — whether collected directly or purchased from data brokers — to charge consumers different prices for the same goods or services.

Geolocation Data Restrictions

SB4 restricts the sale of precise geolocation data, which tracks where you physically go throughout the day. Your phone constantly generates location data — from GPS, Wi-Fi connections, cell tower triangulation, and Bluetooth beacons. Data brokers buy this data from apps, SDKs embedded in apps, and ad networks, then package and sell it to anyone willing to pay.

The risks are not abstract. Location data has been used to track visitors to abortion clinics, identify attendees at political protests, monitor military personnel at sensitive facilities, and stalk individuals. Under SB4, the sale of precise geolocation data about Connecticut residents is restricted, requiring explicit consent and limiting the purposes for which it can be sold.

How SB4 Compares to Other State Laws

SB4 represents a clear escalation in state privacy law. Here is how it stacks up against the existing landscape:

California still has the most established infrastructure — DROP has been live since January 2026, and the CCPA's broader framework has been setting standards since 2020. But on the specific question of data broker regulation, Connecticut SB4 is now the most comprehensive law in the country.

What This Means for Connecticut Residents

If SB4 is signed into law, Connecticut residents will gain three protections that no other state currently provides in combination: the right to delete their data from all registered brokers with a single request, protection from being charged higher prices based on their personal data, and restrictions on who can buy and sell their location history.

The mandatory registry means that brokers cannot avoid the deletion mechanism by simply not registering, as many do in California. The deletion confirmation requirement means you will actually know whether your request was processed, rather than seeing a status that permanently reads "processing."

For Connecticut residents who want to act now — before the SB4 portal is built and operational — services like GhostVault already submit deletion requests to 500+ data brokers on your behalf and provide the per-broker tracking and re-removal that government portals have not yet delivered.

What This Means for the National Trend

The 141-6 vote is not subtle. This is overwhelming bipartisan support for aggressive data broker regulation. When a bill passes a state house with only six dissenting votes, it signals that the political argument is settled at the state level — the question is no longer whether to regulate data brokers, but how aggressively.

Connecticut's approach is likely to become a template. The surveillance pricing ban, in particular, addresses a consumer harm that is easy to understand and hard to defend. Expect to see similar provisions introduced in other state legislatures within the next 12 months.

The federal picture remains stagnant. Congress has not passed comprehensive privacy legislation despite years of proposals. In the absence of federal action, states like Connecticut and California are setting the standards. Each new state law raises the floor, making it increasingly difficult for data brokers to argue that regulation is unnecessary or unworkable.

What If You Don't Live in Connecticut?

SB4 protects Connecticut residents. If you live in one of the 45+ states without a centralized deletion mechanism, you are still exposed to the same data brokers, the same surveillance pricing, and the same geolocation tracking — without the legal tools to do anything about it.

That is exactly the problem GhostVault was built to solve. At $3.99/month, GhostVault submits deletion requests to 500+ data brokers on your behalf, monitors for re-listings, and provides a live dashboard showing the status of every request — regardless of which state you live in. You do not need to wait for your state legislature to act.

Frequently Asked Questions

What is Connecticut SB4?

Connecticut SB4 is a data broker regulation bill that passed the Connecticut House of Representatives 141-6 on May 4, 2026. It creates a centralized one-request deletion mechanism for data brokers, bans surveillance pricing, restricts the sale of geolocation data, and establishes a mandatory data broker registry. It is now awaiting Governor Lamont's signature.

How does Connecticut SB4 compare to California's DROP?

Both laws create centralized deletion portals, but SB4 goes further in several areas. It bans surveillance pricing — charging consumers different prices based on their personal data — which California's Delete Act does not address. SB4 also restricts the sale of precise geolocation data and requires brokers to confirm that deletion requests have been processed, whereas California's DROP provides no per-broker status updates.

What is surveillance pricing and why does SB4 ban it?

Surveillance pricing is the practice of charging consumers different prices for the same product or service based on their personal data — including browsing history, location, income estimates, and purchase patterns. The FTC confirmed in a January 2025 report that major companies engage in this practice. SB4 bans it because it enables hidden price discrimination that consumers cannot detect or challenge.

Does Connecticut SB4 apply to people outside Connecticut?

SB4 directly protects Connecticut residents. If you live outside Connecticut, the law does not give you a legal right to use its deletion portal or invoke its surveillance pricing ban. However, the law sets a precedent that other states are likely to follow. In the meantime, a data removal service like GhostVault covers 500+ brokers across all 50 states for $3.99/month.

When does Connecticut SB4 take effect?

SB4 passed the Connecticut House on May 4, 2026 and is awaiting the governor's signature. Once signed, provisions will take effect on a phased timeline. The data broker registry and centralized deletion mechanism will require implementation time, while the surveillance pricing ban and geolocation data restrictions are expected to become enforceable within 12 to 18 months of signing.