iQ Cookie State Law Series
Cookie & Privacy Law in Connecticut
Educational purposes only — not legal advice. This guide is intended to help you understand Connecticut’s data privacy law as it relates to cookie consent and website compliance. Laws change, and your specific situation may vary. Always consult a qualified legal professional before making compliance decisions. iQ Cookie is a technology tool, not a law firm.
The short version
Connecticut was the fourth state to pass a comprehensive privacy law, taking effect July 1, 2023 following the Virginia model. But 2026 brought the biggest overhaul the CTDPA has seen: lower applicability thresholds, a new data broker registry, expanded sensitive data categories, and a first-in-the-nation surveillance pricing disclosure requirement. If Connecticut was on your "small enough to skip" list, this is the year to check again.
Connecticut does not have a separate cookie law. Cookie compliance flows from the CTDPA’s opt-out and sensitive-data provisions — both of which just got broader.
Who does it apply to?
The CTDPA covers businesses that conduct business in Connecticut or target Connecticut residents. The threshold is dropping this year:
Controls or processes data of 100,000+ residents, or 25,000+ residents while deriving over 25% of revenue from data sales.
Threshold drops to 35,000 or more Connecticut residents — full stop, no revenue-based carve-out required.
Sensitive data has no threshold at all. Starting with the 2026 amendments, controlling or processing even a single Connecticut resident’s sensitive data brings you under the CTDPA — regardless of your size or revenue.
Consumer rights
Connecticut residents have six enumerated rights:
The Attorney General has exclusive enforcement authority — there is no private right of action for individual consumers.
What makes Connecticut different
The 2026 overhaul is the biggest since launch. A new data broker registry with public listings and mandatory third-party audits (starting 2031), an expanded sensitive data list, and a universal consumer deletion portal launching in 2028 are all part of the same package.
Surveillance pricing disclosure — a first in the nation. If you adjust prices using an algorithm fed by personal data, Connecticut will require a specific on-screen disclosure telling the consumer their price was set that way.
Genetic data gets its own consent standard. Express consent is required, and consumers are recognized as having a property interest in their own biological samples — stronger language than most states use.
GPC has been mandatory since January 2025. Controllers must honor opt-out preference signals from any platform that can accurately identify the consumer as a Connecticut resident.
No automatic cure period since January 2025. The old 60-day fix-it window sunset December 31, 2024. The Attorney General now decides case by case whether to offer any cure period at all.
Sensitive data & children
Processing sensitive data requires opt-in consent. The 2026 amendments significantly widened this category:
For known children under 13, COPPA-level parental consent applies. Connecticut has also flagged minors’ data as a heightened enforcement priority heading into 2026 — targeted advertising and profiling of minors gets extra scrutiny.
What this means for your cookies
| Cookie / data type | Requirement | What to do |
|---|---|---|
| Sensitive data cookies (health, biometric-derived, geolocation) | Opt-in required | Gate behind affirmative consent. Remember: no size threshold applies here. |
| Targeted advertising cookies | Opt-out required | Provide a clear opt-out; profiling with significant effects is covered too. |
| GPC / opt-out signals | Required | Detect and honor GPC automatically for confirmed Connecticut residents. |
| Pricing / personalization cookies | Disclosure required | If cookie data feeds algorithmic pricing, add the surveillance pricing notice. |
| Analytics & functional cookies | No specific requirement | Disclose in your privacy policy; confirm they are not disclosing data to third parties you haven’t listed. |
Enforcement
The Connecticut Attorney General has exclusive enforcement authority and publishes an annual CTDPA enforcement report. Penalties run up to $5,000 per willful violation under the state’s Unfair Trade Practices Act, plus the AG can seek injunctive relief, restitution, and disgorgement of profits. With the automatic cure period gone since January 2025, the AG’s office has signaled it expects enforcement activity — particularly around minors’ data — to increase.
Your action checklist
The threshold drop lands July 1, 2026 — most other changes hit October 1, 2026:
Recheck your threshold. The old 100,000-consumer bar is dropping to 35,000 residents. Businesses that were safely under the old line may now be in scope.
Check for any sensitive data at all. Even one Connecticut resident’s sensitive data now triggers coverage, regardless of size. Audit what your cookies and forms collect.
Verify GPC recognition. Confirm your consent tool honors opt-out preference signals for confirmed Connecticut residents.
Review algorithmic pricing. If personal data feeds dynamic or personalized pricing, prepare the surveillance pricing disclosure ahead of the October 2026 deadline.
Update your sensitive data list. The 2026 amendments add disability status, transgender/nonbinary status, neural data, financial account info, and government ID numbers — make sure your policy and consent flows reflect the expanded list.
Watch the data broker deadlines. If you sell data about consumers you don’t have a direct relationship with, registration requirements begin January 1, 2027.
Review vendor contracts. Any processor handling Connecticut resident data must be covered by a written agreement specifying processing instructions and confidentiality obligations.
iQ Cookie scans your site for compliance gaps and deploys a lightweight US-built consent banner ahead of the 2026 changes.
iQ Cookie State Law Series · Guide 5 of 25 · Next: Delaware →