# Connecticut — US state consumer data privacy laws: applicability thresholds by state

For Connecticut, law name and abbreviation is Connecticut Data Privacy Act (CTDPA); effective date is July 1, 2023; consumer volume threshold is Controlled or processed the personal data of not less than one hundred thousand consumers, excluding personal data controlled or processed solely for the purpose of completing a payment transaction; revenue-from-data-sales threshold is controlled or processed the personal data of not less than twenty-five thousand consumers and derived more than twenty-five per cent of their gross revenue from the sale of personal data; threshold combination logic is OR — during the preceding calendar year met either threshold, recorded from its source on 2026-08-12.

- **State:** Connecticut _(our reading, not quoted from the source)_
- **Law name and abbreviation:** Connecticut Data Privacy Act (CTDPA)
- **Effective date:** July 1, 2023
- **Consumer volume threshold:** Controlled or processed the personal data of not less than one hundred thousand consumers, excluding personal data controlled or processed solely for the purpose of completing a payment transaction _(verified: appears in the quote below)_
- **Revenue-from-data-sales threshold:** controlled or processed the personal data of not less than twenty-five thousand consumers and derived more than twenty-five per cent of their gross revenue from the sale of personal data _(verified: appears in the quote below)_
- **Threshold combination logic:** OR — during the preceding calendar year met either threshold _(verified: appears in the quote below)_
- **Key exemptions:** State and local government bodies; HIPAA-covered entities and business associates; GLBA-regulated financial institutions; nonprofit organizations; institutions of higher education; data processed solely for payment transactions excluded from consumer count
- **Enforcement mechanism:** Attorney General; cure period (expires December 31, 2024); civil penalty of up to $5,000 per violation under CUTPA; no private right of action
- **Statute citation:** Conn. Gen. Stat. §§ 42-515 to 42-525
- **Notes:** Connecticut SB 1295 (effective July 1, 2026) will lower the consumer threshold from 100,000 to 35,000, add a sensitive-data trigger with no volume floor, and add a trigger for selling consumer data at any scale regardless of volume or revenue percentage. Connecticut originally set the data sales revenue threshold at 25% (vs Virginia's 50%), making it easier for mid-sized data businesses to fall into scope.

## What the source says

> apply to persons that conduct business in this state or persons that produce products or services that are targeted to residents of this state and that during the preceding calendar year: (1) Controlled or processed the personal data of not less than one hundred thousand consumers, excluding personal data controlled or processed solely for the purpose of completing a payment transaction; or (2) controlled or processed the personal data of not less than twenty-five thousand consumers and derived more than twenty-five per cent of their gross revenue from the sale of personal data.

## Source

- https://web.archive.org/web/2024/https://www.cga.ct.gov/current/pub/chap_743jj.htm

Last verified: 2026-08-12. Review by: 2026-11-10.
Part of [US state consumer data privacy laws: applicability thresholds by state](https://referencesource.org/state-data-privacy-applicability-thresholds/).