Amendments to the Connecticut Data Privacy Act took effect on October 1, 2026, banning the sale of consumers’ precise geolocation data, adding rules for facial recognition on business premises, and starting the clock on a state registry and a one-stop deletion system for data brokers. The changes come from Public Act 26-64, known as SB 4, which Governor Ned Lamont signed on May 27, 2026, according to a summary by the law firm Proskauer Rose.

In a September 16 advisory, Connecticut Attorney General William Tong said residents would gain new privacy rights from October 1 under laws covering artificial intelligence, facial recognition technology (FRT), genetic data, surveillance pricing and data brokers. His office listed the main changes under SB 4:

  • limits on surveillance pricing, plus disclosure duties for businesses that use personal data to set prices;
  • signs alerting consumers that FRT is in use on the premises, with a link or QR code to the company’s FRT policy;
  • consent duties for direct-to-consumer genetic testing companies, giving consumers a property right in, and exclusive control over, their samples and results;
  • a narrower definition of “publicly available information,” with expanded rights to delete profiles built from it;
  • a ban on the sale of precise geolocation data; and
  • a data broker registry, with registration at the Department of Consumer Protection due by January 1, 2027.

“Connecticut is doing everything we can—through legislation and litigation—to protect our online privacy and safety. These laws going into effect are significant steps to protect our kids from dangerous chatbots, safeguard our privacy, and prevent unfair pricing practices,” Tong said in the advisory.

A registry and a deletion deadline for data brokers

From January 1, 2027, data brokers generally may not sell or license brokered personal data in Connecticut unless they are registered, Proskauer wrote. Registration costs $2,500 a year, and an analysis by Davis+Gilbert says violations of the data broker provisions carry civil penalties of up to $200 a day per violation.

The bigger change comes later. The department must set up a state-run deletion mechanism by July 1, 2028, and from October 1, 2028, registered brokers must check it at least every 45 days and process covered requests, according to Proskauer. Davis+Gilbert says requests will be verified through the consumer’s motor vehicle operator’s license number, and that independent broker audits begin on July 1, 2031, recurring every three years.

The design resembles California’s Delete Act. Davis+Gilbert notes that California charges a $6,000 annual registration fee and that its deletion platform, DROP, has been operational since January 1, 2026.

Location, faces and DNA

The geolocation provision bars controllers and third parties from selling precise geolocation data, with an exception for utility metering data and carve-outs for disclosures to processors, services a consumer requests, affiliates and mergers, Proskauer wrote. The firm said Oregon, Maryland and Virginia have similar restrictions.

The FRT rules cover on-premises use for security, fraud prevention, anti-harassment, anti-abuse, legal compliance or system protection. Covered companies must follow an FRT policy and limit matching to a database they maintain exclusively. Online-only identity verification is not covered, according to Proskauer.

Genetic testing companies need separate express consent before disclosing data beyond vendors or service providers, using it for secondary purposes or keeping it after testing. Disclosure to employers, to certain insurers for underwriting, and to third parties known to use the data for advertising is barred.

Pricing rules come later

The attorney general’s office listed surveillance pricing among the new protections, but Proskauer puts the start of those obligations at July 1, 2027. Retail sellers and third-party delivery services will generally be barred from surveillance pricing, subject to exceptions such as certain discounts, loyalty programs and publicly disclosed promotions. Other businesses that raise a price using personal data must display a notice reading “THIS PRICE WAS INCREASED USING YOUR PERSONAL DATA” or similar wording, unless an exception applies.

Why it matters

For Connecticut residents, the immediate changes are the end of precise location-data sales and new rights to delete profiles assembled from public sources. Once built, the state deletion mechanism will require every registered broker to check for and act on verified requests, though it is not due until 2028.

For businesses, enforcement sits with the state. Proskauer notes there is no private right of action, and Davis+Gilbert says surveillance pricing and genetic testing violations are enforced by the attorney general as unfair trade practices. The attorney general’s office also cautioned that not every business is covered, because the privacy act has thresholds and exempts some industries regulated under other privacy frameworks.

What to watch

Brokers must register by January 1, 2027, to keep selling Connecticut residents’ data. The pricing rules follow on July 1, 2027, and the deletion mechanism is due by July 1, 2028.

The caveats

Fees, penalties and later compliance dates in this report come from law firm summaries of the act rather than from the statute text or state guidance.

Corrections and tips: email the editor using the address on the Contact page.