Connecticut Data Privacy Act (PA 22-15; Conn. Gen. Stat. 42-515 et seq.), as amended by PA 25-113 (SB 1295) and PA 26-64 (SB 4): profiling opt-out, right to question a profiling result, impact assessments

Summary

Connecticut's comprehensive consumer privacy law (PA 22-15, codified at sections 42-515 et seq.) took effect on July 1, 2023, with an opt-out of profiling in furtherance of solely automated decisions with legal or similarly significant effects. PA 25-113 (SB 1295), effective July 1, 2026, broadened it: the opt-out now reaches profiling in furtherance of any automated decision with such effects, and a consumer whose data were profiled in such a decision may, if feasible, question the result, be told the reason for it and review the personal data used; where the decision concerned housing, the consumer may correct the data and have the decision reevaluated. A controller that profiles to make a decision with legal or similarly significant effects must conduct an impact assessment covering its purpose, use cases and deployment context, any known or reasonably foreseeable heightened risk of harm and the steps taken to mitigate it, inputs and outputs, performance metrics and known limitations, transparency measures and post-deployment monitoring; this applies to processing created or generated on or after August 1, 2026. Data protection assessments remain required for profiling with a reasonably foreseeable risk of unfair or deceptive treatment, unlawful disparate impact or financial injury. PA 25-113 also lowered the applicability threshold to 35,000 consumers (or any controller processing sensitive data or offering personal data for sale) and replaced the entity-level GLBA exemption with a data-level exemption plus narrower exemptions for certain banks, credit unions and broker-dealers. PA 26-64 (SB 4), effective October 1, 2026, added a right to confirm whether data are processed for such profiling. The Attorney General enforces it as an unfair trade practice; there is no private right of action.

Key dates

1. May 10, 2022Enacted
2. October 16, 2026Checked against sources
3. October 21, 2026Checked against sources

Developments are added when the record is reviewed. Next review: January 15, 2027.

Evidence

Each passage is quoted from its source. The quoted passages are re-checked against the live pages every month.

1. Public Act No. 22-15 AN ACT CONCERNING PERSONAL DATA PRIVACY AND ONLINE MONITORING.

   Supports: Instrument

   Approved May 10, 2022

   Supports: Approval date

   or (C) profiling in furtherance of solely automated decisions that produce legal or similarly significant effects concerning the consumer.

   Supports: Original profiling opt-out (effective July 1, 2023)

   shall constitute an unfair trade practice for purposes of section 42-110b of the general statutes and shall be enforced solely by the Attorney General

   Supports: Enforcement

   as providing the basis for, or be subject to, a private right of action for violations of said sections or any other law.

   Supports: No private right of action

   Public Act 22-15 (Substitute Senate Bill No. 6) Connecticut General Assembly Primary source

2. Approved June 24, 2025

   Supports: Approval date of 2025 amendments

   if the consumer's personal data were processed for the purposes of profiling in furtherance of any automated decision that produced any legal or similarly significant effect concerning the consumer, and if feasible, (A) question the result of such profiling, (B) be informed of the reason

   Supports: Right to question a profiling result and be told the reason

   Each controller that engages in any profiling for the purposes of making a decision that produces any legal or similarly significant effect concerning a consumer shall conduct an impact assessment for such profiling.

   Supports: Profiling impact assessment duty

   Impact assessment requirements shall apply to processing activities created or generated on or after August 1, 2026, and are not retroactive.

   Supports: Impact assessment start date

   the processing of personal data for the purposes of profiling, where such profiling presents a reasonably foreseeable risk of (A) unfair or deceptive treatment of, or unlawful disparate impact on, consumers, (B) financial, physical or reputational injury to consumers

   Supports: Data protection assessment for risky profiling

   thirty-five thousand consumers, excluding personal data controlled or processed solely for the purpose of completing a payment transaction

   Supports: Lowered threshold

   data subject to Title V of the Gramm-Leach-Bliley Act, 15 USC 6801 et seq., as amended from time to time; and (18) information included in a limited data set

   Supports: Data-level GLBA exemption

   bank, Connecticut credit union, federal credit union, out-of-state bank or out-of-state credit union, or any affiliate or subsidiary thereof, as such terms are defined in section 36a-2, that (A) is only and directly engaged in financial activities

   Supports: Conditional bank and credit union exemption

   Section 42-516 of the general statutes is repealed and the following is substituted in lieu thereof (Effective July 1, 2026)

   Supports: Effective date of 2025 amendments

   Public Act 25-113 (Substitute Senate Bill No. 1295) Connecticut General Assembly Primary source

3. Approved May 27, 2026

   Supports: Approval date of 2026 amendments

   whether a controller or processor is processing a consumer's personal data for the purposes of profiling to make a decision that produces any legal or similarly

   Supports: Right to confirm profiling (effective October 1, 2026)

   Public Act 26-64 (Substitute Senate Bill No. 4) Connecticut General Assembly Primary source