Connecticut Data Privacy Act and AI: what changed in 2026

The Connecticut Data Privacy Act became a different law on July 1, 2026. Public Act 25-113 cut the main threshold from 100,000 consumers to 35,000, brought in any business that processes sensitive data at all, added Social Security and driver’s license numbers to that sensitive list, and made every privacy notice say whether personal data trains large language models. A second round, Public Act 26-64, took effect on October 1, 2026.

For a Connecticut business whose staff put customer details into ChatGPT, Claude or Copilot, that changes the starting question from “are we big enough to be covered?” to “what is in the prompt?”. This page covers only what is specific to Connecticut. The federal layer is in our guide to which AI tools comply with US privacy law, and the other states are in the state by state overview.

Who the Connecticut Data Privacy Act (CTDPA) covers from July 1, 2026

The CTDPA lives in chapter 743jj of the General Statutes, sections 42-515 onward, and has applied since July 1, 2023. Section 42-516, as rewritten by Public Act 25-113 and signed on June 24, 2025, covers anyone who conducts business in Connecticut or targets products or services to its residents and, in the preceding calendar year, met any one of three tests.

Applicability test, section 42-516	Until June 30, 2026	From July 1, 2026
Consumers whose data was controlled or processed	100,000	35,000
Revenue from selling personal data	Over 25%, with 25,000 consumers	Any offer of data for sale
Sensitive data	Not a test on its own	Any processing of it

The 35,000 and sensitive data tests exclude data processed solely to complete a payment. Public Act 25-113, section 6.

The attorney general’s 2025 enforcement report, published on February 5, 2026, notes that covering every business that processes sensitive data is unique to Connecticut. A small property manager that never reached 35,000 tenants is now inside the law the moment it processes one applicant’s Social Security number or driver’s license number.

Employees and business contacts are outside it

The act protects a “consumer”, meaning a Connecticut resident. Section 42-515 excludes anyone acting in a commercial or employment context, and section 42-517 separately exempts data about applicants, employees and contractors used in that role. An HR file pasted into a chatbot is therefore outside the CTDPA, though Connecticut has a new employment AI rule, covered below and in our guide to AI for HR.

The amendments also removed the exemption for whole businesses subject to the Gramm-Leach-Bliley Act. Only GLBA data stays exempt, along with listed banks, credit unions, insurers and investment advisers that meet the act’s conditions. HIPAA covered entities and business associates remain exempt as businesses, and protected health information stays exempt as data.

CTDPA sensitive data: the list that now catches an SSN in a prompt

Most AI questions under the CTDPA turn on section 42-520. A controller must limit collection to what is reasonably necessary and proportionate to the disclosed purpose, keep reasonable security, and must not process sensitive data unless the processing is reasonably necessary for its purpose and the consumer has consented. Consent means a clear affirmative act; accepting broad terms of use does not count, and neither does agreement obtained through dark patterns.

The definition of sensitive data in section 42-515 grew on July 1, 2026, and several of its new entries are exactly what turns up in office prompts.

CTDPA sensitive data	Where it turns up in an AI prompt
Health condition, diagnosis, disability or treatment	Claim notes, leave requests, intake forms
Consumer health data	Pharmacy, fitness and wellness records
Government ID numbers not required to be displayed	Tax files, loan applications, license copies
Financial account or card number with its access code	Payment disputes, bank forms
Citizenship or immigration status	Visa letters, onboarding packs
Genetic or biometric data, or information derived from it	Face or voice matching, lab results
Precise geolocation, within 1,750 feet	Delivery logs, field visit records
Neural data, crime victim status, data of someone the business knows, or willfully ignores, is a child	Specialist and family files

Connecticut General Statutes 42-515, as amended by Public Act 25-113, section 5.

The ID number entry names Social Security, passport, state identification card and driver’s license numbers. Removing a Social Security number before AI is therefore no longer only good practice in Connecticut; for a covered business it is the alternative to collecting consent. A copy of a license sent to a person rather than a model can carry a watermark instead, with our Connecticut driver’s license watermark tool, which works on the image in your browser.

Pseudonymous data has its own lighter regime

Section 42-515 defines pseudonymous data as personal data that cannot be attributed to a specific person without additional information kept separately under protective measures, and section 42-523 relaxes several consumer rights for it. The detail is in our guide to data anonymization before AI. It is still personal data, and the line between it and PHI and other sensitive personal information is worth checking before relying on it.

Consumer health data: rules for every business, whatever its size

Connecticut added consumer health data to the act in 2023, in section 42-526, and that section ignores the thresholds entirely. The attorney general’s FAQ states it plainly: there are no revenue or processing thresholds for a consumer health data controller, and the nonprofit exemption does not apply to these rules.

Consumer health data is personal data a controller uses to identify a consumer’s physical or mental health condition, diagnosis or status, including gender affirming and reproductive or sexual health data. Section 42-526 then sets four bans for any person: giving employees or contractors access without a duty of confidentiality; giving a processor access without a contract that meets section 42-521; geofencing within 1,750 feet of a mental health or reproductive or sexual health facility; and selling the data without consent.

35,000consumers, the new general threshold

0threshold for consumer health data rules

1,750 feetgeofence limit around health facilities

The processor ban is the one an AI workflow meets first. A physical therapy clinic outside HIPAA, a gym or a supplement shop that pastes a customer’s condition into an AI tool without a processor contract is in breach of section 42-526 on its own terms. Our guide to HIPAA compliant AI covers the federal side, and the Washington My Health My Data Act page shows how much further another state went.

The AI vendor as processor, and when it stops being one

An AI provider handling personal data on your instructions is a processor, and section 42-521(b) says what the binding contract between you must contain.

The contract must set out	The processor must also
Processing instructions	Keep each person handling the data under a duty of confidentiality
The nature and purpose of processing	Delete or return the data at the end, at your direction
The type of data and the duration	Give you what you need to show its compliance
The rights and obligations of both sides	Use subcontractors only on the same terms, after you can object
	Allow and cooperate with reasonable assessments

Connecticut General Statutes 42-521(b), as amended by Public Act 25-113, section 10.

From July 1, 2026, the processor must also give the controller what it needs to write both data protection assessments and the new impact assessments. Which providers sign such terms, and on which plans, is set out in our guide to what ChatGPT does with your data and our Claude guide.

A vendor that trains on your data decides its own purposes

Section 42-521(d) makes the role a question of fact. A person not limited to the controller’s instructions, or who departs from them, is a controller, and a processor that begins deciding the purposes and means of processing becomes a controller for that processing and may face enforcement. A consumer plan that uses your customers’ data to improve the provider’s own models fits that description more naturally than it fits a processor.

Whether handing data to such a provider is then a “sale” is not settled by the text. The act defines a sale as an exchange of personal data for money or other valuable consideration to a third party, and excludes disclosure to a processor acting for the controller. No court or attorney general guidance read for this page has applied that to AI training, so treat it as an open question for counsel rather than a rule.

Section 42-524(d) offers some protection the other way: a controller that disclosed data lawfully is not liable for a processor’s later violation if it had no actual knowledge at the time that the processor would break the law. The business account settings in our Copilot guide are the kind of evidence of that knowledge worth keeping.

The privacy notice line about training large language models

Section 42-520(b), as rewritten from July 1, 2026, lists what a controller’s privacy notice must contain. Two items are new and specific to Connecticut: a statement disclosing whether the controller collects, uses or sells personal data for the purpose of training large language models, and the most recent month and year the notice was updated.

The notice must be linked from the home page with a hyperlink that includes the word “privacy”, be available in each language in which the business offers its services, and be accessible to people with disabilities. A business that makes a retroactive material change must notify affected consumers and let them withdraw consent to the new processing.

LLM training

For most offices the honest answer is “no”, if staff use an AI account that does not train on inputs. The attorney general’s AI memorandum of February 25, 2026 adds that personal data used in AI must have been disclosed in the privacy notice, and that bought datasets are unlawful to use if the original collector never disclosed the sharing. The clause to write is in the US AI policy template, on top of the generic AI policy template.

Profiling under the CTDPA: opt out, contest and an explanation

Profiling is automated processing of personal data to evaluate or predict someone’s economic situation, health, preferences, reliability, behavior or location. A “decision that produces any legal or similarly significant effect” means one that provides or denies financial or lending services, housing, insurance, education enrollment or opportunity, criminal justice, employment opportunity or health care services.

Before July 1, 2026, consumers could opt out only of profiling in furtherance of “solely” automated decisions. Section 42-518 now covers any automated decision with such an effect, and adds a set of rights that apply where feasible.

Right under section 42-518(a)(6)	Applies to
Question the result of the profiling	Any decision with a legal or similarly significant effect
Be told the reason for the decision	The same
Review the personal data used	The same
Correct the data and have the decision reevaluated	Housing decisions only

Public Act 25-113, section 8, effective July 1, 2026.

Consumers can also access inferences the controller drew about them and learn whether their data is used for profiling of this kind. Colorado took a different route, with duties on deployers of automated decisions from 2027, set out in our Colorado AI Act guide.

Impact assessments from August 1, 2026

Section 42-522(c) requires an impact assessment from every controller that profiles to make decisions with a legal or similarly significant effect. It must cover the purpose and deployment context, any foreseeable heightened risk and its mitigation, the categories of input data and the outputs, data used to customize the profiling, performance metrics and limitations, transparency measures and post deployment monitoring.

The requirement applies to processing activities created or generated on or after August 1, 2026, and is not retroactive. A firm that uses a general chatbot to draft letters is not profiling; one that asks it to score loan applicants or rank tenants is, and our guide to AI for HR shows how the same question arises with candidates.

Data protection assessments for sensitive data

Since July 1, 2023, section 42-522, now in its subsection (b), has required a documented data protection assessment for targeted advertising, sale, risky profiling and any processing of sensitive data, weighing benefits against risks and factoring in the use of de-identified data. Sending clients’ diagnoses or ID numbers to an AI vendor is processing sensitive data, so the assessment comes with it. The attorney general can demand it in an investigation, and handing it over does not waive privilege.

Connecticut AI law from October 1, 2026: Public Act 26-64 and the CART Act

The legislature amended the act again in 2026. Public Act 26-64, signed on May 27, 2026, took effect on October 1, 2026, and a separate law, Public Act 26-15, created the Connecticut Artificial Intelligence Responsibility and Transparency Act, which the attorney general calls the CART Act.

Change from October 1, 2026	Source
Consent for any new incompatible purpose, no longer only a “material” one	PA 26-64, section 14
No controller or third party may sell precise geolocation data	PA 26-64, sections 14 and 15
Narrower “publicly available information”, and deletion of profiles built from it	PA 26-64, sections 12 and 13
Using automated employment technology is no defense to discrimination	PA 26-15, section 13

Public Acts 26-64 and 26-15, read on cga.ct.gov.

The first row matters for AI. Reusing customer data in a new AI workflow that is neither reasonably necessary to nor compatible with the purposes disclosed now needs consent whether or not the change is material, judged by the consumer’s expectations, the link to the original purpose, the impact, and safeguards such as encryption or pseudonymization.

The CART Act and employees

The CART Act reaches the workers the CTDPA leaves out. For automated employment decision technology deployed on or after October 1, 2027, a deployer must tell employees and applicants in plain language when they are interacting with it, and give written notice before a decision covering the purpose, the tool’s trade name, the categories and sources of personal data and a contact. Only the attorney general enforces it. The Illinois AI hiring law page covers the nearest equivalent elsewhere.

Who enforces the CTDPA: the attorney general, CUTPA and the cure period

Section 42-525 gives the attorney general exclusive authority and says the act creates no private right of action. A violation is an unfair trade practice under the Connecticut Unfair Trade Practices Act, enforced solely by the attorney general, and the attorney general’s FAQ puts civil penalties at up to $5,000 per violation, with injunctions, restitution and disgorgement available besides.

The mandatory 60 day cure period ran from July 1, 2023 to December 31, 2024. Since January 1, 2025, a cure is at the attorney general’s discretion, weighing the number of violations, the size and complexity of the business, the nature of its processing, the likelihood of injury, safety, whether human or technical error caused it, and the sensitivity of the data. The national guide compares other states.

$85,000

The office says its priorities will follow the amendments, with sensitive data first now that the threshold is gone. Its February 25, 2026 memorandum on existing laws and AI states that businesses using AI must follow the controller and processor duties, keep data protection assessments for high risk processing, and guard against “data leaks and errant outputs” with the vigilance expected against outside attackers. The state by state overview shows which other attorneys general have said similar things.

Breach notice in Connecticut: 60 days, and the attorney general at the same time

Section 36a-701b requires notice to each Connecticut resident whose personal information was, or is reasonably believed to have been, breached, without unreasonable delay and within 60 days of discovery. The attorney general must be told no later than the residents. Where Social Security or taxpayer identification numbers are involved, the business must offer identity theft prevention services free for at least two years.

Personal information here means a name with a Social Security, taxpayer ID, driver’s license or passport number, card or account numbers, medical information, health insurance identifiers, biometric data or precise geolocation, or a login with its password. Whether pasting it into an AI tool is a breach in the first place is a separate question, covered in our guide on whether putting client data in ChatGPT is a data breach.

A Connecticut checklist for AI at work

In the order a Connecticut business can work through it:

1. Recount the threshold. 35,000 consumers last year, any sale of data, or any sensitive data at all.
2. Read the prompt for sensitive data. An SSN, a driver’s license number or a diagnosis needs consent, or needs to come out first.
3. Check the health data rules. Section 42-526 applies with no threshold, nonprofits included.
4. Paper the AI vendor. A section 42-521 contract, on an account that does not train on your inputs.
5. Fix the privacy notice. Say whether personal data trains large language models, and date the update.
6. Assess before profiling. Impact assessments for processing from August 1, 2026, and a data protection assessment for sensitive data.

Items 4 and 5 belong in your AI policy, and item 2 pairs with the list of personal information to remove before AI.

Nonimo in a Connecticut office

Nonimo is an app for Mac and Windows that works on the text before it reaches ChatGPT, Claude or Copilot. A leasing agent in Hartford highlights a rental application and presses one key, and the applicant’s name, address and Social Security number become placeholders on that computer, so the prompt no longer carries the government ID number that made it sensitive data. When the answer comes back, the real details go back in on the same machine.

In Connecticut terms, that means fewer government ID numbers and less consumer health data reaching a processor, a shorter sensitive data section in the data protection assessment, and an easier sentence about model training in the privacy notice. It does not replace the processor contract or the consent where the data has to go.

The conversation stays on the computer, encrypted, and what the app sends out is a daily usage count with no text, as the security page sets out. Start from Nonimo for US teams, or see the Nonimo page for real estate if your files carry tenant applications.

Sources

Read October 13, 2026.

• Connecticut General Assembly, Public Act 25-113 (SB 1295): sections 5 to 12 amending 42-515 (definitions, sensitive data, consumer health data, pseudonymous data, sale), 42-516 (thresholds), 42-517 (exemptions), 42-518 (rights, profiling), 42-520 (duties, privacy notice and LLM training statement), 42-521 (processors), 42-522 (assessments; impact assessments from August 1, 2026) and 42-524; effective July 1, 2026.
• Connecticut General Assembly, SB 1295 bill status: signed by the governor June 24, 2025.
• Connecticut General Assembly, General Statutes chapter 743jj, 2025 revision: 42-525 (exclusive attorney general enforcement, cure periods, no private right of action, CUTPA) and 42-526 (consumer health data, geofencing, processor access).
• Connecticut General Assembly, Public Act 26-64 (SB 4) and its bill status: sections 12 to 15, effective October 1, 2026; signed May 27, 2026.
• Connecticut General Assembly, Public Act 26-15 (SB 5): sections 7 to 13, automated employment decision technology, notices for deployments on or after October 1, 2027, and 46a-60.
• Connecticut General Assembly, General Statutes chapter 669, 2025 revision: 36a-701b, breach notice within 60 days, attorney general notice, two years of identity theft services.
• Connecticut Attorney General, The Connecticut Data Privacy Act FAQ: thresholds from July 1, 2026, consumer health data with no threshold and no nonprofit exemption, penalties up to $5,000 per violation.
• Connecticut Attorney General, updated CTDPA report, February 5, 2026 and the report itself: TicketNetwork settlement for $85,000, uniqueness of the sensitive data trigger, enforcement priorities.
• Connecticut Attorney General, memorandum on existing laws and artificial intelligence, February 25, 2026: CTDPA duties for businesses that use AI, privacy notice disclosure, bought datasets, security against leaks.
• Connecticut Attorney General, new and updated privacy laws, September 16, 2026: Public Acts 26-64 and 26-15, the CART Act name, rights from October 1, 2026.