Connecticut law sets data broker and consumer privacy rules

Data brokers must register with the Department of Consumer Protection before selling or licensing covered personal data in Connecticut. A data broker is a business that sells or licenses organized personal data about consumers to another person. Exceptions cover specified regulated businesses and certain sales or services; the act also lists limited kinds of information that may be sold or licensed without registration. Initial registration and annual renewal each cost $2,500. The registration restriction applies to sales or licenses in Connecticut on or after January 1, 2027.

The Department of Consumer Protection must create a free process for consumers to ask registered data brokers to delete their personal data. The process covers data held by registered data brokers and service providers that hold data for them. Consumers may leave specific brokers out of a request. Brokers may keep data when an exception applies, such as to comply with law, protect safety, or provide a service the consumer requested. The department may use a driver's license number only to verify a request and may not share, store, or keep that number. The department must establish the process by July 1, 2028. Starting October 1, 2028, brokers must check it at least once every 45 days.

Retail sellers and third-party delivery services must not set customized prices using a consumer's personal data. The restriction applies to retail sellers and third-party delivery services doing business in Connecticut. The rules allow price differences tied to justifiable costs or timing, and certain discounts offered under public, uniform terms, including loyalty programs. The rules do not apply to specified insurance and financial businesses. These pricing rules take effect October 1, 2026.

Direct-to-consumer genetic testing companies must explain their data practices and get consumers' express consent before collecting, using, or sharing genetic data. These rules cover companies that offer genetic tests directly to Connecticut consumers or collect, use, or analyze genetic data consumers provide. Companies must get separate consent before sharing data beyond their vendors or service providers, using data beyond the test's main purpose, or keeping a sample after testing. Test results may be disclosed without consent when a court order, warrant, or subpoena requires it. Consumers must be able to access or delete genetic data and ask the company to destroy their sample. These requirements take effect October 1, 2026.

Streaming video services must keep commercial advertisements from playing louder than the video content they accompany. The rule covers streaming video services provided to people in Connecticut. The rule follows federal volume standards for television and cable advertisements. The Attorney General enforces violations, and the law does not allow a private lawsuit. The volume rule applies beginning July 1, 2027.