Manage opt-outs easily for Connecticut Data Privacy Act

The Connecticut Data Privacy Act categorises sensitive data as data that reveals race, sexual orientation, religious belief, citizenship or citizenship status, genetic or biometric data, precise geolocation data and personal data from a child under the age of 13.

The CTDPA defines the sale of personal data as "the exchange of personal data for monetary or other valuable consideration by the controller to a third party."

Notably, the CTDPA includes the exchange of personal data for "other valuable consideration" as sale, aligning with Colorado's and California's privacy laws' definition. This is different from Utah's and Virginia's laws which only extend the definition of "sale" to monetary consideration.

Six types of organizations are exempt from Connecticut Data Privacy Act or CTDPA. These include:

• Local and state governments
• Non-profits
• Higher education institutions
• National security associations registered under the Securities Exchange Act of 1934
• Financial institutions subject to the Gramm-Leach-Bliley Act
• Entities covered under the HIPPA

There are sixteen categories of data-level exemptions, including information regulated by laws such as HIPAA, FERPA, the Driver's Privacy Protection Act, the Family Educational Rights and Privacy Act, the Farm Credit Act, and the Airline Deregulation Act, as well as employee and job applicant data.

Connecticut Attorney General (AG) has the sole authority to enforce the CTDPA. In the event of a potential violation, the AG's office will notify the business and give them 60 days from receipt of the notification to correct the violation. From January 1, 2025, this cure period will no longer be available by default and will be provided at the Attorney General's discretion.

Here are some links you can refer to for additional reading:

• Official Text: An Act Concerning Personal Data Privacy and Online Monitoring
• FAQ by Office of Attorney General