Connecticut residents will gain additional privacy protections on October 1, 2026. The changes cover several technologies that have become part of everyday life: precise location tracking, facial recognition, direct-to-consumer genetic testing, data brokers, personalized or “surveillance” pricing, artificial intelligence, and chatbots used by children.
The new rules do not mean every organization suddenly follows the same checklist. Different provisions apply to different activities, and the Connecticut Data Privacy Act still includes thresholds and exemptions. But the changes give consumers more control and give businesses a timely reason to examine what information they collect, why they collect it, and which vendors receive it.
Here is a plain-language overview—not legal advice—of what Connecticut consumers and small-business owners should have on their radar.
What changes for Connecticut consumers?
Stronger protection for precise location information
Connecticut’s updated law prohibits the sale of precise geolocation data. That information can reveal sensitive patterns, including where someone lives, works, seeks medical care, worships, or spends time.
For consumers, this is a reminder to review location permissions on phones, tablets, browsers, and individual apps. “Allow only while using” is often more appropriate than permanent background access. If an app does not need your location to deliver the service you expect, consider turning that permission off.
More transparency around surveillance pricing
Some businesses use personal data to influence the price or terms shown to an individual. Connecticut’s new provisions place limitations and disclosure requirements around this practice, commonly described as surveillance pricing.
When shopping online, pay attention to notices explaining that personal data may affect an offer. Consumers can also reduce unnecessary tracking by declining optional advertising cookies, limiting app permissions, and avoiding the automatic assumption that every personalized offer is the best available price.
Rules for facial recognition
Businesses using facial recognition must follow new limitations and disclosure requirements. The Connecticut Attorney General says covered locations must use clear signage and provide access—through a link or QR code—to a policy explaining the use.
Consumers should look for that notice before entering or using the service. A visible camera does not always mean facial recognition is active, but a vague or missing explanation is a good reason to ask how images and biometric information are handled.
Control over genetic testing information
Direct-to-consumer genetic testing companies face consent obligations, and customers receive protections involving their biological samples and test results. Genetic information is unusually sensitive because it can reveal information not only about one customer but also about relatives.
Before using a testing service, read its policies on sample retention, deletion, research, sharing, and account closure. Save a copy of any consent choices you make, since online policies can change over time.
Expanded deletion rights and data-broker visibility
The changes expand deletion rights involving certain profiles built from publicly available information. They also establish a state data-broker registry, with registration beginning by January 1, 2027.
That does not eliminate online profiles overnight, but it should make parts of the data-broker ecosystem easier to identify. Consumers can already use Connecticut Data Privacy Act request procedures with covered businesses to ask what data is held, correct inaccuracies, delete eligible information, or opt out of certain uses.
AI and chatbot provisions are part of the picture
Connecticut’s new Connecticut Artificial Intelligence Responsibility and Transparency Act (CART Act) adds safety requirements for certain chatbots used by children, including parental controls and restrictions. Another provision requires written notice when an employer uses artificial intelligence to make employment decisions and prohibits discriminatory use.
For job applicants and employees, the practical takeaway is simple: watch for notices explaining when AI is part of hiring, promotion, or other employment decisions. For parents, review the settings, privacy controls, and age expectations of chatbot services rather than treating every conversational tool as harmless entertainment.
A practical checklist for Connecticut small businesses
Even a business that is not directly covered by every provision can benefit from better data practices. Start with five questions:
- What personal information do we collect? Include website forms, security cameras, loyalty programs, analytics tools, employee systems, AI services, and vendor platforms—not just customer databases.
- Do we really need it? Keeping less unnecessary data reduces both compliance work and the damage a breach can cause.
- Are our notices accurate? Privacy statements should match what the business and its vendors actually do. If facial recognition, personalized pricing, or employment AI is used, determine which new notice rules apply.
- Can we handle a privacy request? Assign responsibility for receiving, verifying, documenting, and answering consumer requests. A request should not disappear into a general email inbox.
- What are our vendors doing? Ask service providers what they collect, where it goes, how long it is retained, and whether it is sold or used to train AI systems. Contract language and actual settings should agree.
Businesses should also protect retained data with multifactor authentication, appropriate access controls, software updates, reliable backups, and a clear process for removing access when an employee or vendor relationship ends.
Do not wait for a complaint to map your data
The hardest part of privacy work is often not writing a policy. It is discovering that information flows through more systems than anyone realized. A website plug-in may send analytics to one vendor, an appointment platform to another, and an AI feature to a third.
Connecticut businesses with questions about legal coverage or required notices should consult qualified legal counsel and the Attorney General’s official privacy resources. For the technology side, Lyme PC Repair can help Connecticut Shoreline businesses inventory devices and accounts, review access controls, identify unnecessary data exposure, and strengthen the systems that hold customer and employee information.
October 1 is a useful deadline, but good privacy practice is not a one-day project. Know what you keep, collect only what you need, explain it clearly, and secure it throughout its useful life.
Sources
- Connecticut Office of the Attorney General, “Attorney General Tong Reminds Consumers and Businesses of Rights and Requirements Related to New and Updated Privacy Laws,” published September 16, 2026: Read source
- Connecticut Office of the Attorney General, “The Connecticut Data Privacy Act”: Read source
- Connecticut General Assembly, Public Act No. 26-64: Read source
- Connecticut General Assembly, Public Act No. 26-15: Read source