connecticut-ctdpa
Connecticut Data Privacy Act (CTDPA)
Overview
The Connecticut Data Privacy Act (CTDPA), codified as Conn. Gen. Stat. §42-515 through §42-525, was signed into law on May 10, 2022 (SB 6), and became effective July 1, 2023. Connecticut was the fifth state to enact comprehensive consumer privacy legislation. The CTDPA is notable for its explicit prohibition on dark patterns in obtaining consent, its bona fide loyalty program exemption, and its requirement to recognize universal opt-out mechanisms (effective January 1, 2025).
Applicability (§42-516)
The CTDPA applies to persons that conduct business in Connecticut or produce products or services targeted to Connecticut residents AND during the preceding calendar year:
- Controlled or processed personal data of at least 100,000 Connecticut consumers (excluding data processed solely for payment transactions); OR
- Controlled or processed personal data of at least 25,000 Connecticut consumers AND derived more than 25% of gross revenue from the sale of personal data.
Note: The 25% revenue threshold is lower than Virginia's 50% and mirrors no specific percentage in Colorado.
Exemptions: State/local government, GLBA institutions (entity-level), HIPAA covered entities/BAs (entity-level), nonprofits, higher education institutions, and data governed by certain federal statutes.
Liberty Commerce Inc. Assessment: Liberty Commerce Inc. processes personal data of approximately 87,000 Connecticut consumers. With 12% advertising revenue from data sale activities, it does not meet threshold (2). However, excluding payment-only transactions, the consumer count exceeds the threshold under a conservative reading. Liberty Commerce Inc. treats itself as subject to the CTDPA.