Connecticut Enacts Privacy Law

Connecticut Governor Ned Lamont signed the Connecticut Data Privacy Act today, making Connecticut the fifth state since 2018 to enact a consumer data privacy law. Connecticut’s law will allow residents of that state to opt-out of the processing of their personal data for purposes of (1) targeted advertising; (2) the sale of personal data; and (3) some automated decisions. The CT law allows consumers to designate an authorized agent to carry out opt-out requests, including by way of a global opt-out browser signal or device setting. The Connecticut Data Privacy Act is the first state law to require opt-in consent for the use of personal data for targeted advertising for teens between 13 and 16 years old. The law also prohibits the use of dark patterns to obtain consent and the processing of personal data in violation of state and federal laws prohibiting discrimination. While Connecticut’s law includes some stronger protections that Virginia and Utah’s weak privacy laws, it lacks the necessary rulemaking authority, private right of action, strong enforcement, and data minimization requirements that are necessary in order to begin to tackle surveillance capitalism.