Cybersecurity Policy Report, Governor Signs Connecticut Bill to Implement New Privacy Protections, (Jun 1, 2026)
Organizations Mentioned:Consumer Reports
Connecticut Gov. Ned Lamont (D.) has signed into law a bill adopting additional privacy measures intended to address new threats to consumer data. Among other things, the new law establishes an accessible deletion mechanism for personal data, prohibits the use of surveillance pricing in the state, puts protections on facial recognition, and expands other protections under the 2023 Connecticut Data Privacy Act. The new law takes effect Oct. 1.
SB 4 imposes certain regulations on data brokers operating in the state and would require, by Jan. 1, 2027, the Department of Consumer Protection (DCP) to establish an accessible deletion mechanism, enabling consumers to request, free of charge and in multiple languages, that all registered data brokers delete their personal data. Data brokers will be required to check for such requests at least every 45 days and comply with verified deletion requests. Also under the new law, beginning July 1, 2030, data brokers will be required to undergo independent audits of their compliance with deletion requirements every three years.
In addition, the new law will require data brokers that sell or license personal data in the state to register annually with the DCP, pay a $600 registration and renewal fee, and disclose detailed information about their data practices, including whether they collect minors’ data or sensitive geolocation and health data.
The measure also amends the Connecticut Data Privacy Act by refining the definition of publicly available information, expanding consumer rights regarding automated profiling, and prohibiting the sale, sharing, or transfer of precise geolocation data by controllers and processors. The law also addresses algorithmic pricing by requiring online businesses that use personalized algorithms to set prices based on personal data to disclose this practice clearly to consumers.
The law further addresses facial recognition technology and will require businesses using facial recognition in public spaces to disclose it at each entrance and provide a process for consumers to request removal of their images.
Lawmakers said the bill (S.B. 4, Reg Sess.) was necessary to “safeguard Connecticut residents’ personal information from exploitation by data brokers, surveillance technology companies, and federal agencies.”
“As technology evolves, our laws must evolve with it. Senate Bill 4 takes critical action to strengthen privacy protections, promote transparency, and ensure Connecticut consumers are treated fairly,” said Rep. Hubert Delany (D.). “Connecticut residents deserve to know that their personal information is protected.
Senate Majority Leader Bob Duff (D.) said the bill was about “protecting people’s lives.”
“I have seen firsthand the devastating consequences that can follow when personal data falls into the wrong hands. Connecticut residents deserve to know their personal information cannot be bought and sold without their knowledge,” he said in a statement.
Consumer Reports also applauded the governor for enacting the legislation.
“This new privacy law will help protect consumers from imminent harm to their safety, autonomy, and finances by making it harder to stalk people, steal their identity, or engage in hyper-targeted marketing for scams. We congratulate the legislature and Governor Lamont for making these critical improvements to the state’s privacy framework,” said Matt Schwartz, senior policy analyst at Consumer Reports.
News: StateLegislation DataPrivacy