Support Centre

You have out of 5 free articles left for the month

Signup for a trial to access unlimited content.

Start Trial

Continue reading on DataGuidance with:

Free Member

Limited Articles

Create an account to continue accessing select articles, resources, and guidance notes.

Free Trial

Unlimited Access

Start your free trial to access unlimited articles, resources, guidance notes, and workspaces.

Connecticut: AG releases guidance on CTDPA

On June 5, 2023, the Attorney General of Connecticut, William Tong, released guidance advising on the Connecticut Act Concerning Personal Data Privacy and Online Monitoring (CTDPA), which is set to go into effect on July 1, 2023. In particular, Tong noted that "In less than one month, one of the nation's first and strongest consumer privacy laws goes into effect here in Connecticut. The Connecticut Data Privacy Act gives consumers powerful new baseline rights, including the right to access, correct, and delete personal data stored and collected by businesses, and the right to opt-out of the sale of personal data and targeted advertising."

Moreover, Tong highlighted that the CTDPA passed in May 2022, and requires covered businesses to appropriately limit their collection of personal data, be transparent about how they use and secure that data, and obtain consumer consent before collecting sensitive information, such as precise location data, biometric data, and certain health information. The CTDPA also provides Connecticut consumers with new baseline privacy rights, including:

  • the right to access personal data that a business has collected about them;
  • the right to correct inaccuracies in their personal data;
  • the right to delete their personal data, including data that a business collected through third parties; and
  • the right to opt-out of the sale of their personal data and targeted advertising.

Furthermore, the CTDPA requires covered businesses to maintain a privacy notice that clearly describes how consumers may exercise their rights under the law. Importantly, the CTDPA prohibits businesses from discriminating against consumers for exercising those rights.

The CTDPA also requires covered businesses to protect the personal data of children and teenagers. Specifically, the CTDPA permits a child's parent or legal guardian to exercise privacy rights on the child's behalf, and provides that businesses must obtain opt-in consent before selling the personal data of a consumer under 16 years old or sending them consumer-targeted ads.

Tong highlighted that consumers should note that not all Connecticut businesses are covered by the CTDPA and that the CTDPA includes specific revenue thresholds and exempts certain industries regulated by other privacy frameworks, such as healthcare companies subject to the Health Insurance Accountability and Portability Act of 1996 (HIPAA).

You can read the press release here.