Press Releases
04/17/2025
Attorney General Tong Releases Updated Report on Connecticut Data Privacy Act
(Hartford, CT) – Attorney
General William Tong today released a new report detailing
the actions the Office of the Attorney General took in 2024 to enforce
compliance with the Connecticut Data Privacy Act (CTDPA).
The CTDPA, which took effect
in July 2023, grants important data rights to Connecticut residents and
solidifies critical privacy obligations for covered businesses. Since our
initial report, the Office of the Attorney General continues to take significant
steps to prompt compliance with the CTDPA.
This voluntary report
provides updates on (1) the Office’s broader privacy and data security efforts;
(2) consumer complaints received under the CTDPA to date; (3) several
enforcement efforts highlighted in the Office’s initial report and (4) expanded
enforcement priorities. Recommendations for strengthening the CTDPA’s
protections are also included in the report.
“Connecticut remains at the
forefront of consumer data privacy,” Attorney General Tong states in the
report. “Since the Connecticut Data Privacy Act took effect, our office has
worked to educate consumers and companies alike about their rights and
obligations. We remain focused on ensuring compliance with this important law
going forward. Much remains to be done, including amending the CTDPA to provide
stronger protections for Connecticut residents. We will continue to be
transparent about our efforts to uphold and strengthen this important law.”
“As the 2025 Enforcement
Report is released, it's clear that Connecticut's commitment to data privacy is
not just about safeguarding personal information—it's about protecting the
dignity and autonomy of every resident,” said Sen. Maroney. “In an era
where data is a powerful currency, our laws ensure that individuals have
control over their own digital footprints.”
Since the law went into
effect, the Office of the Attorney General has opened various investigations
and inquiries into companies which collect, sell, and otherwise share consumer
data, including:
· Manufacturers
of connected vehicles;
· A genetic
and family history company;
· A web
service provider which provides palm recognition services to consumers;
· The provider
of an anonymous peer messaging app aimed at teens; and
· Connecticut
retailers’ use of facial recognition technology.
By the end of 2024, the
Office had issued dozens of notices of violation, as well as a number of
broader information requests, under the Act. We remain focused on key
aspects of the CTDPA including transparency and sensitive data processing, but have
also broadened our efforts to address problematic opt-out practices and dark
patterns that trick consumers. Our priorities have also expanded as new
legislation related to minors’ privacy and consumer health data took effect,
and as our universal opt-out provisions came online.
The report also identifies
areas in which the state legislature could strengthen or clarify aspects of the
CTDPA. Some of the recommendations include:
· Scaling back
exemptions, including eliminating entity-level exemptions;
· Lowering
thresholds for applicability, including fully covering processing for all
sensitive data and minors’ data;
· Strengthening
data minimization provisions to limit the data companies can collect and
maintain;
· Expanding
the definition of sensitive data to
incorporate a comprehensive list of elements added by other states since the
CTDPA’s passage;
· Strengthening
protections of minors’ data by
prohibiting businesses from sending targeted ads so long as the company “knew
or should have known” that the individual is a minor; and
· Enacting a
one-stop-shop deletion mechanism to allow Connecticut residents to delete their
personal information held by data brokers through a single, verified request.
For more information about
the CTDPA, visit the Attorney General’s FAQ page here.
This report was prepared and
reviewed by the entire Privacy Section, including Section Chief Deputy
Associate Attorney General Michele Lucan, assistant attorneys general John
Neumon, Laura Martella, Kileigh Nassau, Jordan Levin, and Patrick Kania, paralegal
specialist Casey Rybak, and legal investigator Carly Smedberg, with support from administrative assistant Diana
Viera.
- Twitter: @AGWilliamTong
- Facebook: CT Attorney General
Media Contact:
Elizabeth Benton
elizabeth.benton@ct.gov
Consumer Inquiries:
860-808-5318
attorney.general@ct.gov