CTDPA: Connecticut Data Protection Act

Consumer privacy law in Connecticut, Connecticut Data Protection Act

What is CTDPA?

CTDPA is Connecticut Data Protection Act was signed into law on 28 April 2022. It is a data privacy law similar to US CCPA.

Who does the CTDPA apply to?

  1. personal data of a minimum of 100,000 consumers (excluding personal data that is controlled or processed solely for the purpose of completing payment transactions), or
  2. personal data of a minimum of 25,000 consumers, and derived over 25 % of their gross revenue from selling personal data.

Personally Identifiable Information (PII)

  • Biometric information
  • Credit and debit card numbers
  • Drivers’ license and license plate numbers
  • Email addresses
  • Employment information
  • Financial data
  • Healthcare and insurance information
  • Mailing addresses
  • Military ID numbers
  • Passport ID numbers
  • Passwords
  • Physical addresses
  • Social Security Numbers
  • Student ID numbers
  • Telephone numbers
  • Usernames

Sensitive personal information

  • “data revealing racial or ethnic origin, religious beliefs, mental or physical health condition or diagnosis, sex life, sexual orientation or citizenship or immigration status”,
  • genetic or biometric data that is processed to uniquely identify an individual,
  • “personal data collected from a known child” or
  • “precise geolocation data”.

Consumer rights under CTDPA

  1. to confirm whether a controller is processing their personal data;
  2. to obtain access to such data;
  3. to be provided with a copy of their personal data in a portable and readily usable format;
  4. to correct any inaccuracies contained therein; and
  5. to delete personal data provided by them or received about them.

CTDPA enforcement and fines

A violation of the CTDPA constitutes an unfair trade practice under the Connecticut Unfair Trade Practices Act, which provides for penalties up to $5,000 per wilful violation.

CTDPA and consent management

The consumer’s consent has to be obtained to process sensitive data and the consent option must be designed as an opt-in.

Consumers must have the possibility to opt-out of the processing of their personal data for the purposes of targeted advertising, the sale of their personal data (unless an exception applies), or, “profiling in furtherance of solely automated decisions that produce legal or similarly significant effects concerning the consumer.

The Connecticut Data Protection Act (CTDPA) Timeline

  • Signed into law on April 28, 2021
  • The CTDPA will take effect on July 1, 2023

Other US State Privacy Laws

  • CCPA: California Consumer Privacy Act, learn more at CCPA
  • CPRA: California Privacy Rights Act, learn more at CPRA
  • CPA: Colorado Privacy Act, learn more at CPA
  • VCDPA: Virginia Consumer Data Protection Act, learn more at VCDPA
  • UCPA: Utah Consumer Privacy Act, learn more at UCPA
  • CTDPA: Connecticut Data Protection Act, learn more at CTDPA
  • COPPA: Children’s Online Privacy Protection Act, learn more at COPPA

Compare different US State Privacy Laws

How to compliant with and implement the Connecticut Data Protection Act Compliance Solution?

Use a consent management platform like UniConsent to offer consumers full control of data collection, opt-out features, manage the preferences communication.

Trusted by 5000+ of global publishers and marketers
  • football365
  • teamtalk
  • sharethrough
  • elnacional
  • districtm
  • lyon
  • new business
  • tower cast

Get started to make your website compliant for EU GDPR, US CCPA.

Sign up