# Connecticut Data Privacy Act: cookie rules for Connecticut visitors

> Connecticut does not require consent before most cookies, but its Attorney General expects a cookie banner that offers Accept all to offer an equally easy Reject all. The Connecticut Data Privacy Act gives residents the right to opt out of targeted advertising, sales and profiling, requires consent for sensitive data, and since 1 January 2025 obliges businesses to honor opt-out preference signals such as Global Privacy Control. Amendments in force since 1 July 2026 lower the threshold to 35,000 consumers and bring in any business that sells personal data or processes sensitive data. Violations are unfair trade practices, punishable by up to $5,000 each.

Source: https://cookiequiet.com/laws/connecticut
Published: 2026-10-21
Publisher: Cookiequiet

## Quick facts

- **Applies to:** Since 1 July 2026: businesses in Connecticut or targeting its residents that process the personal data of 35,000 or more consumers, process any sensitive data, or offer personal data for sale (outside payment-only data); 100,000 consumers or 25,000 plus over 25% of revenue from sales before that
- **Consent model:** Opt-out of targeted advertising, sale (for money or other valuable consideration) and profiling; opt-in consent for sensitive data; targeted advertising and sale of known minors' data prohibited since 1 July 2026
- **Universal opt-out:** Required since 1 January 2025 for opt-out preference signals such as Global Privacy Control
- **Authority:** Connecticut Attorney General (exclusive enforcement, no private right of action)
- **Maximum penalty:** Up to $5,000 per violation under the Connecticut Unfair Trade Practices Act, plus injunctions, restitution and disgorgement
- **In force since:** 1 July 2023; opt-out preference signals 1 January 2025; mandatory cure period ended 31 December 2024; Public Act 25-113 amendments 1 July 2026

## What is the Connecticut Data Privacy Act?

The Connecticut Data Privacy Act (CTDPA), Senate Bill 6 of 2022, was signed on 10 May 2022 and took effect on 1 July 2023. It follows the Virginia model, with controllers, processors, consumer rights and data protection assessments, but adds stronger consent rules, a ban on dark patterns and the obligation to honor browser opt-out signals. Connecticut has amended it almost every year: Public Act 23-56 added protections for minors from 1 October 2024, and consumer health data rules followed in 2023. Public Act 25-113 (Senate Bill 1295), signed on 24 June 2025, rewrote the scope and several rights from 1 July 2026. For how Connecticut compares with other states, see [US state privacy laws](/laws/us-state-privacy-laws).

## Who does the CTDPA apply to?

Until 30 June 2026 the Act covered businesses that conduct business in Connecticut or target its residents and that, in the preceding calendar year, processed the personal data of at least 100,000 consumers (excluding data processed only to complete a payment), or of at least 25,000 consumers while earning more than 25% of gross revenue from selling personal data.

Since 1 July 2026 the Act applies to any such business that:

- processes the personal data of at least 35,000 consumers, excluding payment-only data, or
- controls or processes any consumer's sensitive data, excluding payment-only data, or
- offers consumers' personal data for sale in trade or commerce.

The Attorney General notes that extending the law to every business that sells personal data or processes sensitive data, with no volume threshold, is unique to Connecticut. A website that shares visitor data with ad networks for value can therefore be covered even with a small Connecticut audience. Consumer health data controllers are covered regardless of size. Non-profits, higher education, HIPAA covered entities, insurers, banks and credit unions are exempt, although the consumer health data rules apply to non-profits.

## What does the CTDPA require for cookies and trackers?

The Act gives Connecticut residents the right to opt out of three things: targeted advertising, the sale of personal data (an exchange for money or other valuable consideration), and profiling in furtherance of decisions with legal or similarly significant effects. Advertising cookies, retargeting pixels and ad network tags are targeted advertising, and passing data to ad tech partners for value can be a sale.

A controller that sells personal data or uses it for targeted advertising must clearly and conspicuously disclose that processing and the way to opt out, and must provide a clear and conspicuous link on its website to a page where the consumer, or an agent, can opt out. The Attorney General's 2025 enforcement report questions whether a link buried in the footer of a long page meets that standard, and recommends prominent notice and an obvious opt-out mechanism.

**Cookie banners.** The same report says the office has run several sweeps of cookie banners that make opting out harder than opting in. Its position is plain: a business whose banner offers an option to accept all cookies should also offer a symmetrical option to reject all cookies, and toggles for advertising or sale cookies should be off by default as a best practice. Consent under the Act excludes acceptance of broad terms, hovering over, muting, pausing or closing content, and agreement obtained through dark patterns.

**Sensitive data needs consent.** Sensitive data includes data revealing racial or ethnic origin, religious beliefs, mental or physical health conditions, disability or treatment, sexual activity or orientation, nonbinary or transgender status, citizenship or immigration status, consumer health data, genetic and biometric data, neural data, certain financial account credentials and government identifiers, data of a known child under 13, and precise geolocation data. Since 1 July 2026 a controller also may not sell sensitive data without consent, and the Attorney General states that precise geolocation data may not be sold.

**Minors.** Since 1 October 2024 controllers that offer online services to minors under 18 have had a duty of care and consent requirements. From 1 July 2026 Public Act 25-113 removes the consent option: processing a known minor's personal data for targeted advertising or sale is prohibited.

## Must I honor Global Privacy Control in Connecticut?

Yes. Since 1 January 2025 section 42-520 requires controllers to let consumers opt out of targeted advertising and sales through an opt-out preference signal sent with the consumer's consent by a platform or mechanism. The mechanism must not be a default setting, must be easy to use, and must let the controller determine that the consumer is a Connecticut resident. If the signal conflicts with a previous choice or a loyalty program, the controller must follow the signal and may ask the consumer to confirm.

The Attorney General's 2025 report adds that a GPC signal should trigger an opt-out across all personal data, not only data collected through cookies or SDKs, and should apply to every device on which a signed-in consumer uses the account. In 2025 Connecticut, California and Colorado ran a joint sweep of businesses that did not process GPC signals. The [Global Privacy Control guide](/guides/global-privacy-control) explains how a site can detect it.

## Enforcement and penalties

The Attorney General has exclusive authority, and a violation is an unfair trade practice under the Connecticut Unfair Trade Practices Act. From 1 July 2023 to 31 December 2024, the office had to issue a notice of violation and allow 60 days to cure when a cure was possible. Since 1 January 2025 a cure opportunity is at the Attorney General's discretion, weighing factors such as the number of violations, the size of the business and the sensitivity of the data. Civil penalties are up to $5,000 per violation, and the Attorney General can also seek injunctions, restitution and disgorgement. There is no private right of action.

The first settlement under the Act was with TicketNetwork, announced on 8 July 2025. The office sent a cure notice in November 2023 because the company's privacy notice was unreadable, omitted key rights and contained broken rights mechanisms; TicketNetwork did not fix them until December 2024. It paid $85,000 and agreed to annual reviews of its notice. The office reports five privacy notice sweeps, several cookie banner sweeps, and ongoing investigations into connected vehicles, geolocation data, consumer health apps and data brokers.

## How Cookiequiet handles Connecticut

Cookiequiet's banner shows Accept all and Reject all with the same size and weight, and optional categories are off until the visitor turns them on, which matches what Connecticut's Attorney General asks of cookie banners. For Connecticut visitors you can instead use geo-targeting, free on every plan, to show an opt-out notice with a "Do not sell or share my personal information" link, and Global Privacy Control is honored as an opt-out. See [pricing](/pricing). The policy templates are written for the CCPA/CPRA, so check the Connecticut notice items, including the new disclosure about training large language models, with your advisor.

## Questions

### Does Connecticut require a cookie consent banner?

Not for most cookies. The CTDPA requires a clear opt-out from targeted advertising and sales, consent for sensitive data, and recognition of Global Privacy Control. If you do use a cookie banner with an Accept all button, the Attorney General expects an equally easy Reject all option.

### What changed in the CTDPA on 1 July 2026?

Public Act 25-113 lowered the threshold to 35,000 consumers, brought in every business that sells personal data or processes sensitive data, expanded the list of sensitive data, banned targeted advertising to and sale of known minors' data, and added rights around profiling. Privacy notices must also say whether personal data is used to train large language models.

### Must I honor Global Privacy Control in Connecticut?

Yes, since 1 January 2025. Controllers must treat an opt-out preference signal such as GPC as a request to opt out of targeted advertising and sales. The Attorney General expects the opt-out to cover all personal data and every device linked to a signed-in account.

### What are the penalties under the Connecticut Data Privacy Act?

Violations are unfair trade practices, with civil penalties of up to $5,000 per violation plus injunctions, restitution and disgorgement. The mandatory 60-day cure period ended on 31 December 2024. The first settlement, with TicketNetwork in July 2025, was $85,000.

## Sources

- [Connecticut General Statutes, Chapter 743jj, Data Privacy (sections 42-515 and following)](https://www.cga.ct.gov/current/pub/chap_743jj.htm)
- [Connecticut Attorney General, The Connecticut Data Privacy Act (FAQ, thresholds, opt-out signals, penalties)](https://portal.ct.gov/ag/sections/privacy/the-connecticut-data-privacy-act)
- [Connecticut Attorney General, CTDPA Enforcement Report 2025](https://portal.ct.gov/-/media/ag/reports/ctdpaenforcementreportcy2025.pdf)
- [Connecticut General Assembly, Public Act 25-113 (SB 1295), bill status and OLR summary](https://www.cga.ct.gov/asp/cgabillstatus/cgabillstatus.asp?selBillType=Bill&which_year=2025&bill_num=1295)
- [Connecticut Attorney General, settlement with TicketNetwork under the CTDPA (8 July 2025)](https://portal.ct.gov/ag/press-releases/2025-press-releases/attorney-general-tong-announces-settlement-with-ticketnetwork)