Connecticut
For Connecticut, law name and abbreviation is Connecticut Data Privacy Act (CTDPA); effective date is July 1, 2023; consumer volume threshold is Controlled or processed the personal data of not less than one hundred thousand consumers, excluding personal data controlled or processed solely for the purpose of completing a payment transaction; revenue-from-data-sales threshold is controlled or processed the personal data of not less than twenty-five thousand consumers and derived more than twenty-five per cent of their gross revenue from the sale of personal data; threshold combination logic is OR — during the preceding calendar year met either threshold, recorded from its source on 2026-08-12.
- State
- Connecticut our reading
- Law name and abbreviation
- Connecticut Data Privacy Act (CTDPA)
- Effective date
- July 1, 2023
- Consumer volume threshold
- Controlled or processed the personal data of not less than one hundred thousand consumers, excluding personal data controlled or processed solely for the purpose of completing a payment transaction verified
- Revenue-from-data-sales threshold
- controlled or processed the personal data of not less than twenty-five thousand consumers and derived more than twenty-five per cent of their gross revenue from the sale of personal data verified
- Threshold combination logic
- OR — during the preceding calendar year met either threshold verified
- Key exemptions
- State and local government bodies; HIPAA-covered entities and business associates; GLBA-regulated financial institutions; nonprofit organizations; institutions of higher education; data processed solely for payment transactions excluded from consumer count
- Enforcement mechanism
- Attorney General; cure period (expires December 31, 2024); civil penalty of up to $5,000 per violation under CUTPA; no private right of action
- Statute citation
- Conn. Gen. Stat. §§ 42-515 to 42-525
- Notes
- Connecticut SB 1295 (effective July 1, 2026) will lower the consumer threshold from 100,000 to 35,000, add a sensitive-data trigger with no volume floor, and add a trigger for selling consumer data at any scale regardless of volume or revenue percentage. Connecticut originally set the data sales revenue threshold at 25% (vs Virginia's 50%), making it easier for mid-sized data businesses to fall into scope.
Values marked our reading are our classification of what the source says — the source does not print them in those words. The quote below is the evidence for each one; judge it yourself.
What the source says
apply to persons that conduct business in this state or persons that produce products or services that are targeted to residents of this state and that during the preceding calendar year: (1) Controlled or processed the personal data of not less than one hundred thousand consumers, excluding personal data controlled or processed solely for the purpose of completing a payment transaction; or (2) controlled or processed the personal data of not less than twenty-five thousand consumers and derived more than twenty-five per cent of their gross revenue from the sale of personal data.
— cga.ct.gov, retrieved 2026-08-12
Source
- cga.ct.govhttps://web.archive.org/web/2024/https://www.cga.ct.gov/current/pub/chap_743jj.htm