Connecticut Data Privacy Act (CTDPA)
A practical compliance guide for website owners. Learn what Connecticut's privacy law requires and how to implement it on your site.
Who Must Comply
Conducts business in Connecticut or targets Connecticut residents AND, during the prior year: controls/processes personal data of 35K+ consumers (excl. payment transactions), OR controls/processes data of 25K+ consumers and derives 25%+ revenue from selling personal data. Since SB 1295 (1 Jul 2026) two further triggers carry no threshold at all: processing sensitive data, or selling personal data in any amount.
What Your Website Must Do
| Requirement | Status |
|---|---|
| Cookie consent banner | Recommended |
| Do Not Sell link | Required |
| Do Not Share link | Required |
| Honor GPC browser signals | Required |
| Universal opt-out mechanism | Required |
| Sensitive data opt-in consent | Required |
This law changes on October 1, 2026. SB 4 (2026) prohibits the sale of precise geolocation data from 1 October 2026.
Checked against the CTDPA on August 29, 2026. Read the source This is a summary, not legal advice.
Required Links & Notices
The CTDPA requires the following links or notices to be visible on your website:
- 1Do Not Sell My Personal Data
- 2Privacy Policy
Enforcement & Penalties
Key Things to Know
The Connecticut Data Privacy Act (CTDPA) has applied in Connecticut since July 1, 2023.
Who it covers: Conducts business in Connecticut or targets Connecticut residents AND, during the prior year: controls/processes personal data of 35K+ consumers (excl. payment transactions), OR controls/processes data of 25K+ consumers and derives 25%+ revenue from selling personal data. Since SB 1295 (1 Jul 2026) two further triggers carry no threshold at all: processing sensitive data, or selling personal data in any amount.
Connecticut has been amended twice since it took effect and now reaches businesses that process sensitive data or sell personal data at any volume, with no threshold to fall under.
Do Not Sell and opt-out rights: residents may opt out of the sale of their personal data and opt out of targeted advertising. CTDPA expects the choice to be reachable from your site under the heading “Do Not Sell My Personal Data”, and you may not degrade the service of someone who exercises it.
Global Privacy Control: CTDPA requires you to honour a universal opt-out mechanism sent by the visitor’s browser. A GPC signal has to be treated as the opt-out itself — not as a request to show someone a banner — and it applies to that browser without any further action from the person.
Cookie banner: CTDPA is an opt-out law, so it does not require the opt-in banner the GDPR does. What it does require is that the tracking you run for advertising can be switched off on request, which in practice means a preference control that actually blocks tags rather than a notice that only records a click. Sensitive data is the exception: that needs consent before you process it.
Recently amended. CTDPA changed on July 1, 2026. The summary above reflects the amended law.
Changing on October 1, 2026. SB 4 (2026) prohibits the sale of precise geolocation data from 1 October 2026.
Enforcement: Up to $5,000 per willful violation under CUTPA. The guaranteed 60-day cure period was removed by SB 1295 on 1 Jul 2026; the Attorney General may still allow cure at its discretion. Enforced by the Connecticut Attorney General.
How to Configure LegalBanner for CTDPA
- 1
Create your site
Sign up for free and add your website domain in the dashboard.
- 2
Set consent mode to "Opt-out"
In Settings, select the consent mode that matches Connecticut's requirements.
- 3
Install the snippet
Add the one-line script tag to your website. The banner, opt-out links, and GPC support are automatic.
- 4
Generate your Privacy Policy
Use the built-in policy wizard to generate a CTDPA-compliant privacy policy.
Set up CTDPA compliance in 5 minutes
LegalBanner handles Connecticut privacy requirements automatically — cookie banner, opt-out links, and GPC support included.
Frequently Asked Questions
Does Connecticut require a cookie consent banner?
The CTDPA does not require opt-in cookie consent. You must provide opt-out mechanisms for targeted advertising and sale of personal data. A cookie preference center is the recommended approach.
Does Connecticut require honoring GPC signals?
Yes. As of January 2025, Connecticut requires businesses to recognize and honor universal opt-out mechanisms including GPC. LegalBanner handles this automatically.
What are the penalties for CTDPA violations?
Violations are enforced under the Connecticut Unfair Trade Practices Act (CUTPA), with penalties up to $5,000 per willful violation. The 60-day cure period expired in December 2024.
Does the CTDPA have a private right of action?
No. Only the Connecticut Attorney General can enforce the CTDPA. Consumers cannot sue businesses directly for violations.
What consumer rights does the CTDPA provide?
The CTDPA provides rights to access, correct, delete, and port personal data. Consumers can also opt out of targeted advertising, sale of personal data, and profiling for decisions with legal or similarly significant effects.