Cybersecurity Policy Report, Updated Privacy Protections Advance in Connecticut, (May 5, 2026)
Organizations Mentioned:Instacart | Vinoble, Inc.
The Connecticut state House voted 141-6 this week in support of comprehensive privacy measures that seek to address new threats to consumer data. Among other things, the bill would establish an accessible deletion mechanism for personal data, prohibit the use of surveillance pricing in the state, and expand other protections under the Connecticut Data Privacy Act.
“Today’s passage of Senate Bill 4 by the House is a tremendous victory for every Connecticut resident,” Sen. James Maroney (D.) said in a statement. “This bill puts protections on Facial Recognition, makes it easier to exercise your right to delete your data from data brokers and people tracking websites, and prevents predatory surveillance pricing. It has been a privilege to collaborate with my colleagues in the effort to protect the residents of Connecticut.”
The Senate cleared the bill late last month and yesterday concurred with House amendments.
SB 4 would impose certain regulations on data brokers operating in the state and would require, by Jan. 1, 2027, the Department of Consumer Protection (DCP) to establish an accessible deletion mechanism, enabling consumers to request, free of charge and in multiple languages, that all registered data brokers delete their personal data. Data brokers would have to check for such requests at least every 45 days and comply with verified deletion requests. Also under the bill, beginning July 1, 2030, data brokers would be required to undergo independent audits of their compliance with deletion requirements every three years.
In addition, the bill would require data brokers that sell or license personal data in the state to register annually with the DCP, pay a $600 registration and renewal fee, and disclose detailed information about their data practices, including whether they collect minors’ data or sensitive geolocation and health data.
The bill also would amend the Connecticut Data Privacy Act by refining the definition of publicly available information, expanding consumer rights regarding automated profiling, and prohibiting the sale, sharing, or transfer of precise geolocation data by controllers and processors. The bill also would address algorithmic pricing by requiring online businesses that use personalized algorithms to increase prices based on personal data to disclose this practice clearly to consumers.
The bill further addresses facial recognition technology and would require businesses using facial recognition in public spaces to disclose it at each entrance and provide a process for consumers to request removal of their images.
Lawmakers said the bill (S.B. 4, Reg Sess.) was necessary to “safeguard Connecticut residents’ personal information from exploitation by data brokers, surveillance technology companies, and federal agencies.”
“This is a wide ranging bill regulating data brokers, establishing an accessible deletion mechanism for your personal data, and prohibits the use of surveillance pricing by retail establishments in this state, including apps like Instacart or Uber Eats,” said Rep. Kara Rochelle (D.), in a statement. “I am thrilled this bill passed and remained intact instead of being watered down. I hope the governor signs it and it becomes law so consumers in this state are not abused and overcharged.”
Added Senate Majority Leader Bob Duff (D.), “The passage of Senate Bill 4 is about more than policy, it’s about protecting people’s lives. I have seen firsthand the devastating consequences that can follow when personal data falls into the wrong hands. Connecticut residents deserve to know their personal information cannot be bought and sold without their knowledge.”
News: StateLegislation DataPrivacy