On July 1, 2026, the amendments to Connecticut’s Data Privacy Act (“CTDPA”), Senate Bill 1295 (“SB 1295”), took effect, expanding the state comprehensive privacy law’s applicability and definition of “sensitive data.” Enacted in June 2025, SB 1295 is just one of many amendments to the CTDPA since the law’s passage in 2022. Companies should be prepared to assess their privacy compliance programs in light of Connecticut’s new requirements, set to go into effect this fall and next year via amendments.

Adding to the increased data protection provisions implemented by SB 1295, Connecticut Governor Ned Lamont also signed Senate Bill 4 (“SB 4”) into law on May 27, 2026, establishing a data broker registration program and amending the CTDPA to prohibit the sale of precise geolocation data. Provisions of SB 4 were subsequently amended by House Bill 5222 and House Bill 5563 on June 2 and June 4, 2026, respectively. Under SB 4, data brokers will need to register under Connecticut’s new program starting January 1, 2027. In the meantime, SB 4’s amendments to the CTDPA will take effect October 1, 2026. In addition to the CTDPA amendments and data broker registration program, the law creates requirements for direct-to-consumer genetic testing companies and entities engaged in surveillance pricing.

In this post, we highlight the recent amendments to the CTDPA and summarize SB 1295’s and SB 4’s key provisions. To stay up to date on the latest state privacy law developments, please subscribe to the WilmerHale Privacy and Cybersecurity Law Blog.

KEY TAKEAWAYS

• Expanded Applicability: SB 1295 expands the applicability of the CTDPA to entities that sell consumers’ personal information or process consumers’ sensitive information, likely bringing many more businesses within the CTDPA’s scope.
• Narrowed GLBA Exemption: SB 1295 narrows the CTDPA’s GLBA exemption, narrowing the general entity-level exemption to only exempt specific traditional financial institutions like banks and credit unions while other entities like brokers, dealers, and tax preparers no longer qualify for the entity-level exemption. Notably, this law and other CTDPA amendments do not impact the law’s data-level GLBA exemption or the law’s exemptions for HIPAA-covered entities, business associates, and protected health information (PHI).
• Expanded Definition of “Sensitive Data”: SB 1295 expands the definition of “sensitive data” to include additional types of data, such as government-issued identification numbers and consumers’ financial information in combination with information that would allow access to a financial account.
• Prohibition on the Sale of Precise Geolocation Data: With SB 4, Connecticut joins Maryland, Virginia, and Oregon in prohibiting the sale of precise location data. Notably, all these states define “sale” to exclude disclosures made at a consumer’s direction, so the sale or sharing of precise geolocation data can still be compliant with these laws through a proper opt-in consent process.
• Expanded Data Subject Rights: SB 1295 expands consumers’ data subject rights to (1) include the right to access any inferences derived from a consumer’s personal data, (2) request a list of third parties to which an entity sold a consumer’s personal data, (3) review personal data processed for the purposes of profiling in furtherance of any automated decision that produced any legal or similarly significant effect concerning the consumer, and (4) question the results of such profiling. Additionally, SB 4 expands consumers’ deletion rights to cover certain publicly available information and inferences.

SUMMARY OF AMENDMENTS TO THE CTDPA AND DATA REGISTRY

• SB 1295’s Amendments to the CTDPA: SB 1295 makes several notable amendments to the CTDPA, including the following:
  • Previously, the CTDPA applied to entities that conduct business in Connecticut and, in the preceding year, (1) controlled or processed personal information of at least 25,000 Connecticut residents and derived more than 25% of gross revenue from the sale of personal information; or (2) controlled or processed personal information of at least 100,000 Connecticut residents. However, the CTDPA, as amended by SB 1295, now applies to entities that (1) control or process the personal data of at least 35,000 consumers; (2) control or process consumers’ sensitive data; or (3) offer consumers’ personal data for sale in trade or commerce. The removal of thresholds for revenue and the number of residents with personal information being processed brings additional entities into the scope of the law.
  • SB 1295 narrows the CTDPA’s previous entity-level GLBA exemption, with the amended law only exempting any “bank, Connecticut credit union, federal credit union, out-of-state bank or out-of-state credit union, or any affiliate or subsidiary thereof…that (A) is only and directly engaged in financial activities as described in 12 USC 1843(k), (B) is regulated and examined by the Department of Banking or an applicable federal bank regulatory agency, and (C) has established a program to comply with all applicable requirements established by the Banking Commissioner or the applicable federal bank regulatory agency concerning personal data” (emphasis added). Notably, the CTDPA still contains an exemption for data subject to the GLBA, and exemptions for HIPAA-covered entities, business associates, and PHI in the current version of the law remain unaltered.
  • Sensitive data. SB 1295 expands the CTDPA’s definition of “sensitive data” to include “a consumer’s financial account number, financial account log-in information or credit card or debit card number that, in combination with any required access or security code, password or credential, would allow access to a consumer’s financial account” and a “government-issued identification number, including, but not limited to, Social Security number, passport number, state identification card number or driver’s license number, that applicable law does not require to be publicly displayed.” Additionally, SB 1295 updates the CTDPA’s definition of “sensitive data” to replace “personal data collected from a known child” with “personal data collected from an individual the controller has actual knowledge, or willfully disregards, is a child.”
  • Data subject rights. SB 1295 expands consumers’ data subject rights to include the following:
    • The right to access “any inferences about the consumer derived from such personal data and [confirm] whether a controller or processor is processing a consumer’s personal data for the purposes of profiling to make a decision that produces any legal or similarly significant effect concerning a consumer.”
    • The right (A) to question the result of “profiling in furtherance of any automated decision that produced any legal or similarly significant effect concerning the consumer,” (B) to “be informed of the reason that such profiling resulted in such decision,” (C) to “review the consumer’s personal data that were processed for the purposes of such profiling,” and (D) “if the profiling decision concerned housing,…[to take] into account the nature of the personal data and the purposes for which such personal data were processed, [to] allow the consumer to correct any incorrect personal data that were processed for the purposes of such profiling and [to] have the profiling decision reevaluated based on the corrected personal data.”
    • The right to “obtain from the controller a list of the third parties to which such controller has sold the consumer’s personal data or, if such controller does not maintain a list of the third parties to which such controller has sold the consumer’s personal data, a list of all third parties to which such controller has sold personal data, provided the controller shall not be required to reveal any trade secret.”
  • SB 4’s Data Broker Registration Program: SB 4 establishes a data broker registration program, with Connecticut joining California, Oregon, Texas, and Vermont in creating such a registry. Under SB 4, data brokers are required to register with Connecticut’s Department of Consumer Protection by January 1, 2027 in order to sell or license brokered data in the state. Furthermore, SB 4 requires the Commissioner of Consumer Protection to establish an accessible deletion mechanism program by July 1, 2028, enabling a consumer to submit a single request that all data brokers delete the consumer’s data (similar to California’s Delete Request and Opt-out Platform).

• SB 4’s Amendments to the CTDPA: SB 4 also makes several notable amendments to the CTDPA, including the following:
  • Precise geolocation data. SB 4 amends the CTDPA to prohibit entities from selling “any consumer’s precise geolocation data.” The CTDPA defines “sale of personal data” as “the exchange of personal data for monetary or other valuable consideration” but excludes from that definition “the disclosure of personal data where the consumer directs the controller to disclose the personal data.”
  • Publicly available information. SB 4 adds several exemptions to the CTDPA’s definition of “publicly available information.” Most notably, it adds exemptions for personal data created by combining personal data with publicly available information, as well as “information provided by a consumer on a publicly accessible Internet web site or online service…where the consumer has maintained a reasonable expectation of privacy in such information, including, but not limited to, by restricting such information to a specific audience.”
  • Deletion rights. SB 4 expands the scope of the right to delete under the CTDPA, specifically by applying the deletion right not just to personal data provided by or obtained about a consumer but also to “publicly available information that is (i) collated and combined to create a consumer profile that is made available to a user of a publicly accessible Internet web site for compensation or free of charge, or (ii) made available for sale,” as well as any inferences generated from such publicly available information.