Connecticut Enacts Third Update to CT Data Privacy Act

Connecticut Governor Ned Lamont has signed SB4 and HB 5563 amending the Connecticut Data Privacy Act (CTDPA). The CTDPA was originally enacted in 2022 and was updated in 2023 and again in 2025.

SB4 prohibits the sale of precise geolocation data. It also narrows the definition of publicly available information definition to better protect consumers and allows Connecticut residents to delete their information from registered data brokers using a centralized deletion mechanism. It also requires that entities using facial recognition on its premises to alert consumers via signage and exclusively use facial recognition to match still images or video to a database maintained exclusively by the company themselves.

SB 4 and HB 5563 address surveillance pricing, making Connecticut the second state to prohibit companies from using consumers’ personal data to set individualized prices. Connecticut’s law is a great first step toward mitigating these harms and, in its scope and enforcement provisions, marks an improvement upon the similar law Maryland passed earlier this session. However, EPIC urges Connecticut lawmakers to strengthen this law and close remaining loopholes in future legislative sessions.

This bill continues the trend of states revisiting enacted privacy laws to strengthen protections, with Delaware, New Hampshire, Virginia, Utah, and Maryland all recently passing updates to their privacy laws to strengthen consumer protections.