Connecticut Data Privacy Act compliance
Connecticut widened its privacy law in July 2026.
Smaller websites are now covered, and Connecticut has required websites to honor browser opt-out signals since January 2025. ConsentBit shows the opt-out link, honors Global Privacy Control automatically, and records every choice.
Key facts
Connecticut’s privacy law, enforced as an unfair trade practice.
The Connecticut Data Privacy Act (CTDPA) protects the personal data of Connecticut residents. A violation is treated as an unfair trade practice, which is where the penalties come from. The Attorney General enforces it, and consumers can’t sue a business directly under this law.
$5,000
per willful violation, under Connecticut’s Unfair Trade Practices Act.
Requirements
Five things Connecticut expects from your website
Each requirement in plain terms, next to how ConsentBit covers it.
Tell visitors what you collect and how to opt out
The banner explains that data is collected, as soon as visitors land.
Put an easy-to-find opt-out link on your site
The banner shows a “Do Not Share My Personal Information” link, and you can edit the label.
Honor browser opt-out signals
ConsentBit detects Global Privacy Control and opts the visitor out automatically. It’s on by default.
Act on the opt-out
Tracking scripts are blocked the moment a visitor opts out or a GPC signal arrives.
Keep a record of requests
Every opt-out is logged with the date and time, ready to export.
How it works
What a visitor sees, step by step
Nothing is blocked by default. The visitor, or their browser, decides whether the tracking continues.
They land on your site
A notice explains that data is collected. Your scripts run as normal.
Their browser may opt out first
If the browser sends Global Privacy Control, ConsentBit applies the opt-out straight away, with no click.
Or they click the opt-out link
“Do Not Share My Personal Information” opens the opt-out panel, with a single checkbox.
The tracking stops
Analytics, Marketing and Preferences scripts are blocked. Necessary cookies keep running.
What changed in July 2026
The law now covers far smaller websites.
Connecticut amended the CTDPA in 2025, and most of the changes took effect on 1 July 2026. The headline change is who the law covers: the old test was 100,000 consumers, or 25,000 consumers plus a quarter of your revenue from selling data. A business can now be covered because of what it does with data, not how much of it there is.
The amendments also added rules on profiling, automated decisions and the data of people under 18. This page covers the parts a consent banner handles.
Runs until they opt out
For US visitors, ConsentBit uses an opt-out model. Here’s what runs by default in Connecticut, and what changes after an opt-out or a GPC signal.
No cure period since 2025
Businesses used to get 60 days to fix a problem before any enforcement action. That ended on 31 December 2024, so the Attorney General can act without giving notice first.
They are testing for the signal
Connecticut’s Attorney General has said his office works with technologists to check whether websites actually detect and act on browser opt-out signals.
Colorado has the same signal rule and higher penalties. See what Colorado requires →
Add a Connecticut-ready opt-out to your site, free.
Records
A record of every opt-out, ready if the Attorney General asks
Every choice is recorded with when it was made and whether the visitor opted out. You can export the log as a CSV file whenever you need it.
The visitor opted out, so targeted advertising and sale scripts were blocked.
The visitor didn’t opt out, so scripts ran as normal.
Consent log
FAQ
Connecticut privacy questions, answered
Can't find what you need? Talk to our team at web@consentbit.com.
Since 1 July 2026, it applies to businesses that sell to or target people in Connecticut and either reach 35,000 consumers in a year, process sensitive data, or offer personal data for sale. The last two have no size test, so a small website can be covered if it handles sensitive data or sells data.
Yes. Since 1 January 2025, businesses covered by the CTDPA must honor opt-out preference signals sent by Connecticut residents, and the Attorney General names Global Privacy Control as an example. You also need an easy-to-find opt-out link on your website.
A violation is treated as an unfair trade practice under Connecticut’s Unfair Trade Practices Act, which allows civil penalties of up to $5,000 for each willful violation. The Attorney General can also seek injunctions, restitution and the profits made from the violation.
No. The 60-day cure period ended on 31 December 2024. Since then the Attorney General can take enforcement action without giving a business a chance to fix the problem first.
No. Enforcement sits with the Attorney General, and the law gives consumers no private right of action.
The law widened on 1 July 2026. The consumer threshold dropped to 35,000, the revenue test was removed, and businesses that process sensitive data or sell personal data are covered whatever their size. The amendments also added rules on profiling, automated decisions and the data of people under 18.
Both require websites to honor browser opt-out signals, and neither offers a cure period any more. Colorado’s penalties are higher, at up to $20,000 per violation, and Colorado keeps an official list of recognized signals. Connecticut’s rules now reach smaller businesses. See what Colorado requires →
Yes. ConsentBit has a free plan, and every paid plan comes with a 14-day free trial. See pricing for what each plan includes. See pricing →
RELATED READING
Keep reading
Cover Connecticut’s rules without extra work
Show the opt-out link, honor Global Privacy Control automatically, and keep a record of every choice.
This page is a general overview of the Connecticut Data Privacy Act as amended in 2026, not legal advice. The amendments also cover profiling, automated decisions and the data of people under 18, which sit outside what a consent banner handles.