Press Releases
06/05/2023
AG Tong Advises Connecticut Consumers of Upcoming Rights Under the Connecticut Data Privacy Act
(Hartford, CT) – Attorney General William Tong today released the following guidance advising Connecticut consumers of important new privacy rights under the Connecticut Data Privacy Act (CTDPA), set to go into effect on July 1, 2023.“In less than one month, one of the nation’s first and strongest consumer privacy laws goes into effect here in Connecticut. The Connecticut Data Privacy Act gives consumers powerful new baseline rights, including the right to access, correct, and delete personal data stored and collected by businesses, and the right to opt-out of the sale of personal data and targeted advertising. Between now and July 1, I will be speaking to businesses and consumers and doing all I can to help ensure everyone understands their new rights and obligations, and the importance of protecting our personal information online,” said Attorney General Tong.
Connecticut passed the CTDPA in May of last year. One of the first comprehensive consumer privacy laws in the country, the CTDPA requires covered businesses to appropriately limit their collection of personal data, be transparent about how they use and secure that data and obtain consumer consent before collecting sensitive information—such as precise location data, biometric data, and certain health information. The CTDPA also provides Connecticut consumers with new baseline privacy rights, including:
• The right to access personal data that a business has collected about them;
• The right to correct inaccuracies in their personal data;
• The right to delete their personal data, including data that a business collected through third parties; and
• The right to opt-out of the sale of their personal data and targeted advertising.
The CTDPA requires covered businesses to maintain a privacy notice that clearly describes how consumers may exercise their rights under the law. Importantly, the law prohibits businesses from discriminating against consumers for exercising those rights.
The CTDPA also requires covered businesses to protect the personal data of children and teens. In addition to permitting a child’s parent or legal guardian to exercise privacy rights on the child’s behalf, businesses must obtain opt-in consent before selling the personal data of a consumer under 16 years old or sending the consumer targeted ads.
Consumers should note that not all Connecticut businesses are covered by the CTDPA. The law includes specific revenue thresholds and exempts certain industries regulated by other privacy frameworks—such as health care companies subject to the Health Insurance Accountability and Portability Act of 1996 (HIPAA).
"In a month's time Connecticut will be one of the first states to give people the tools to comprehensively protect their personal data," said Senate Majority Leader Bob Duff. "Online data is a billion-dollar industry that profits from violating the privacy of our residents. Connecticut Democrats are standing up for consumers with these new privacy rights."
"I am proud to have worked with the AG's Data Privacy Unit on this bill for several years," said State Senator James Maroney. "We are fortunate to have them as the first data privacy unit in an AG's office in the country. Beginning July 1, Connecticut residents will be protected online while we continue to navigate our increasingly connected world."
"As the digital landscape changes and evolves, it is crucial that we prevent the unauthorized use and trade of personal data. Data privacy is a priority for all, and this act protects all of our residents while they are online," said State Representative Mike D'Agostino.
"In today's world, the internet has become an integral part of our lives in many ways – for commerce, communication, employment, personal finances, and countless others, all coming to a head during the pandemic," said Rep. David Rutigliano. “Connecticut must ensure that all its residents' personal data is safe and secure. The disturbing trend of data mining and the sale of that private information without a person's knowledge has many people compromised, particularly our seniors and children. That is unacceptable. This law is a major step towards security and privacy.”
Connecticut Senate Republican Leader Kevin Kelly said, "I'm happy to see the legislature continue the work started in 2022 to protect the online data of Connecticut citizens. This bill expands the protection to health and children's data. As the internet evolves at a rapid pace, lawmakers continue to advance measures that ensure Connecticut residents' data is properly safeguarded."
For more information about the CTDPA, visit the Attorney General’s FAQ page here.
- Twitter: @AGWilliamTong
- Facebook: CT Attorney General
Media Contact:
Elizabeth Benton
elizabeth.benton@ct.gov
Consumer Inquiries:
860-808-5318
attorney.general@ct.gov