Connecticut Expands Privacy Requirements for Sensitive Data, AI, and Profiling

Connecticut amended its comprehensive privacy law in 2026, lowering the Connecticut Data Privacy Act’s (CTDPA) applicability thresholds and expanding requirements for sensitive data, artificial intelligence, profiling, automated decision-making, facial recognition, precise geolocation, and consumer rights, setting the state near the forefront of U.S. privacy laws.

Businesses that previously determined the CTDPA did not apply, as well as businesses that have not recently revisited their Connecticut privacy programs, should reassess their obligations under the new, more stringent standards.

More Businesses Will Be Subject to the CTDPA

The amendments lower the CTDPA’s general applicability threshold from 100,000 to 35,000 consumers.

They also replace the prior alternative threshold, which applied to businesses that processed the personal data of at least 25,000 consumers and derived more than 25% of gross revenue from the sale of personal data, with broader triggers tied to offering personal data for sale and processing sensitive personal data.

Sensitive Data and Consumer Protections Expand

Connecticut expands the types of information subject to heightened protections and the rights available to consumers. The amendments expand the definition of sensitive personal data and consumer access rights to include certain inferences generated from personal data and raise the age threshold for certain processing of minors’ data from 16 to 18 years old.

Under these amendments, businesses may no longer sell sensitive personal data without consent and are prohibited from selling the personal data of minors under 18, regardless of consent.

The amendments also narrow the definition of publicly available information and expand deletion rights for certain information obtained from public sources. Among other changes, information created by combining personal data with publicly available information, certain genetic data, and information posted where a consumer has a reasonable expectation of privacy may no longer qualify as publicly available. Consumers may also request deletion of publicly available information that is combined to create a publicly accessible consumer profile or made available for sale, as well as inferences generated from that information.

New Requirements for AI, Profiling, and Automated Decision-Making

Like California, Connecticut continues to expand its regulation of AI, profiling, and automated decision-making.

The amendments add a new disclosure requirement relating to artificial intelligence and expand consumer rights involving profiling and automated decision-making. These changes are relevant to businesses using AI and automated systems that generate inferences or other information about individuals or use those outputs in decisions affecting individuals.

Facial Recognition and Precise Geolocation Face Additional Restrictions

Separate Connecticut amendments effective October 1, 2026 add requirements relating to facial recognition technology and precise geolocation information.

The amendments restrict the sale of precise geolocation data and add protections addressing facial recognition technology. Businesses that collect or use this information may therefore have additional obligations depending on how the information is collected, used, disclosed, or sold and should pay particular attention to any new obligations that may arise.

Assessment Requirements Expand

Connecticut’s amended assessment requirements apply to processing activities created on or after August 1, 2026.

The amendments require assessments for certain processing activities, including activities involving sensitive data, profiling, automated decision-making, or other higher-risk processing. Businesses already conducting privacy, data protection, or AI assessments under other state laws may be able to leverage those processes to satisfy Connecticut’s requirements.

What Businesses Should Do Now

Businesses that operate in Connecticut or process Connecticut residents’ personal data should:

Recheck applicability. Determine whether the lower thresholds or new applicability triggers bring the business within the scope of the CTDPA.
Review sensitive and higher-risk data. Identify sensitive data, precise geolocation information, facial recognition information, and inferences collected or generated by the business.
Review AI, profiling, and automated decision-making. Identify relevant activities and determine whether they trigger additional disclosure, consumer-rights, or assessment requirements.
Review notices and consumer-rights procedures. Confirm that existing notices and procedures address the amended requirements, including changes relating to inferences and other newly regulated information.
Review assessment requirements. Identify new or planned processing activities that require assessments and determine whether existing assessments can be leveraged.

If your company needs assistance with any privacy issues, Coblentz Data Privacy & Cybersecurity attorneys can help. Please contact Scott Hall at shall@coblentzlaw.com for further information or assistance.