HomeChecklistsConnecticut Checklist

Connecticut Privacy Compliance Checklist

Connecticut Data Privacy Act — Step-by-step guide to compliance

Reviewed by PrivacyLawMap editorial teamLast verified: July 28, 2026

What is the CTDPA compliance checklist?

The CTDPA compliance checklist is a 16-step plan for meeting the Connecticut Data Privacy Act (CTDPA), Connecticut's consumer privacy law, which took effect July 1, 2023. It is enforced by the Connecticut Attorney General, with civil penalties up to $5,000 per violation and no cure period. Work through every step below, then confirm your specific obligations with the free applicability calculator.

Compliance Steps

Effective: July 1, 20230

1
Reassess applicability now (not on July 1) — SB 1295 lowers the threshold to 35,000 consumers and removes thresholds entirely for sensitive data processing and any data sale, meaning small B2C businesses, niche e-commerce stores, and any controller selling Connecticut consumer data are pulled into scope regardless of revenue. Build a Connecticut-resident counting methodology and document the count quarterly.
2
Re-evaluate GLBA exemption status before July 1, 2026 — the entity-level exemption is eliminated and replaced with a narrower data-level exemption. Map every data flow against GLBA scope: customer financial data processed pursuant to GLBA remains exempt, but marketing data, website analytics, employment data, and any consumer data outside the GLBA scope must comply with the full CTDPA. Specific entity-level exemptions remain only for insurers, certain banks, and investment agents under federal or state law.
3
Implement mechanisms to honor Global Privacy Control (GPC) signals and other universal opt-out preferences with server-side detection, downstream vendor propagation, cross-browser testing (Firefox, Brave, DuckDuckGo, Chrome), and a GPC hit log retained for AG audit defense. AG Privacy and Data Security Section has identified GPC compliance as a top 2026 enforcement priority — non-recognition is the single highest litigation risk.
4
Update privacy notices to include all CTDPA-required disclosures: categories of data processed, purposes, third parties, consumer rights, opt-out mechanisms, contact info, appeal process — and the new SB 1295 disclosure of whether personal data is collected, used, or sold for training large language models. The LLM disclosure must be explicit and specific (a generic "we use AI" statement does not suffice).
5
Build a consumer request intake and response process meeting the 45-day initial response window (extendable once by 45 days for complex requests), with documented identity verification proportionate to request sensitivity, a 60-day appeal window, and the new SB 1295 profiling-contest mechanism that allows consumers to challenge automated decisions and request reasoning and input data.
6
Obtain freely-given, specific, informed, and unambiguous opt-in consent before processing any sensitive data category, including the four newly added under SB 1295: neural data (brain-computer interfaces, EEG-based apps, neurotechnology), transgender or nonbinary status, financial account credentials, and government-issued identification numbers. Dark-pattern consent flows are prohibited.
7
Cease processing of any sensitive data without consent immediately on July 1, 2026 — there is no cure period and no transition window. Sensitive data sale requires opt-in even after consent for processing.
8
Conduct and document Data Protection Assessments (DPAs) for high-risk processing — including targeted advertising, sale of personal data, processing of sensitive data, and profiling presenting reasonably foreseeable risk of unfair, deceptive, financial, physical, or reputational injury. Retain assessments for at least three years.
9
Perform separate Impact Assessments for profiling that produces legal or similarly significant effects on consumers — credit, housing, insurance, employment, healthcare, education, or essential goods/services decisions. Document purpose, automated logic categories, input data, performance and accuracy metrics, false-positive analysis, demographic disparities, mitigation safeguards, and human-review pathway.
10
Audit system design features for minor protection compliance — ensure zero targeted advertising or data sale for users aged 13-17 (no consent exception), apply strict-necessity test for any minor geolocation collection with active signaling, and remove any dark-pattern features intended to extend minors' session length, increase repeat usage, or encourage compulsive engagement (autoplay, infinite scroll, gamified streaks for minors).
11
Update processor/sub-processor contracts to include CTDPA flow-down obligations, audit rights, deletion-on-termination, processing-limitation language, sub-processor approval, and breach notification — particularly the new SB 1295 LLM training disclosure and profiling impact assessment requirements. Existing 2023 CTDPA addenda are not sufficient for SB 1295.
12
Prepare for a zero-cure-period enforcement environment — Connecticut's statutory right to cure expired December 31, 2024. Build an AG-inquiry response playbook: preserve relevant logs from notice receipt, designate counsel, conduct internal compliance audit, prepare remediation plan with timeline, and respond within the deadline stated in the AG's notice. Document everything for potential CUTPA defense.
13
Establish an ongoing CTDPA compliance monitoring program — monthly GPC honoring tests across browsers, quarterly privacy notice review, annual DPA and impact assessment refresh, employee privacy training, complaint intake log with response tracking, and a designated CTDPA compliance owner. AG Tong's office has signaled it will review compliance program documentation in any enforcement matter.
14
If you sell or license brokered personal data, prepare for the Public Act 26-64 data broker registry: register with the Department of Consumer Protection before selling or licensing brokered personal data in Connecticut on or after January 1, 2027, budget for the $2,500 registration/renewal fee, publish the required consumer-rights page, and plan for 45-day accessible deletion mechanism checks beginning October 1, 2028.
15
For location, biometric, pricing, and genetic-data programs, map Public Act 26-64 duties before October 1, 2026: cease sales of Connecticut consumers' precise geolocation data, add the required surveillance-pricing disclosure where a price-setting device increases an online price using personal data, post signage and a facial-recognition policy where covered on-premises facial recognition is used for security or fraud prevention, and update direct-to-consumer genetic testing consent flows.
16
Map applicability against Maryland MODPA (effective April 1, 2026), New Hampshire (effective January 1, 2025), and Delaware (effective January 1, 2025) — Connecticut joins these states with a 35,000-consumer threshold under SB 1295, and a multistate compliance program designed for the strictest of these laws (typically Maryland MODPA on data minimization or Connecticut on AI/LLM disclosures) provides defensible coverage for the others.

Key Enforcement Details

Enforced By

Connecticut Attorney General

Penalty / Violation

$5,000

Cure Period

None

Private Right of Action

Related Resources

Connecticut Privacy Law — Full Guide
Compare Connecticut with Other States
Connecticut Enforcement Actions & Privacy Fines
2026-2027 Privacy Law Compliance Deadlines
All State Privacy Laws

CTDPA Compliance Checklist FAQ

What is the CTDPA compliance checklist?

It is a 16-step plan organizations use to meet the Connecticut Data Privacy Act (CTDPA), which took effect July 1, 2023. The steps below cover consumer-rights request handling, privacy-notice disclosures, opt-out mechanisms, data-processing agreements, and security safeguards required under Connecticut law.

Who has to comply with the Connecticut Data Privacy Act?

The CTDPA generally applies to organizations that handle Connecticut residents' personal data above the law's revenue and data-volume thresholds. Whether it applies to you depends on the specifics — check your exact obligations with the free applicability calculator at /calculator rather than assuming.

What is the penalty for CTDPA non-compliance?

The Connecticut Attorney General can impose civil penalties of up to $5,000 per violation and no cure period. There is no private right of action, so enforcement comes from the state, not individual lawsuits. Figures verified July 28, 2026.

Put CTDPA Into Practice on Your SiteSponsored

Termly builds and maintains a Connecticut-ready privacy policy, a consent banner that recognizes universal opt-out signals like GPC, opt-in consent capture for sensitive data, and a workflow for the access, deletion and correction requests CTDPA grants.

Start Free with Termly

Does this law apply to you?

Use our free calculator to check if Connecticut Data Privacy Act applies to your business.

Check Applicability

Official Resources

Connecticut Attorney General Privacy and Data Security Section
CTDPA (Public Act 22-15) Full Text
SB 1295 / Public Act 25-153 (2025 Amendments) Full Text
SB 4 / Public Act 26-64 (2026 Amendments) Full Text
Connecticut Unfair Trade Practices Act (CUTPA) — Conn. Gen. Stat. § 42-110a
File a Consumer Privacy Complaint with the Connecticut AG
Attorney General William Tong — Office Homepage