Law note · Connecticut
Connecticut Data Privacy Act, consumer rights
CTDPA gives a Connecticut consumer the right to confirm processing, access, correct, delete, obtain a portable copy, and opt out of targeted advertising, sale, and qualifying profiling. A controller must respond without undue delay and no later than 45 days after receipt, with one 45-day extension available.
Public Act 25-113 (S.B. 1295, 2025 session, effective July 1, 2026) removed the 'solely automated' qualifier so the profiling opt-out and a new right to contest automated-decision outcomes reach decisions with human involvement, and its Sec. 11 (amending section 42-522) adds a new impact-assessment requirement for such profiling applying to processing activities created or generated on or after August 1, 2026, confirmed against the enrolled act's own text during review.
What it asks of an app
- Give a Connecticut consumer a means to confirm whether you process their personal data, access it, correct it, delete it, and receive a portable copy.
- Offer a Connecticut consumer an opt-out of targeted advertising, sale, and profiling in furtherance of decisions with legal or similarly significant effects, and honor a universal opt-out preference signal.
- Respond to a consumer rights request without undue delay and within 45 days of receipt, with one 45-day extension available.
When LexLint raises it
Declared activities: crawls_web, trains_models, deploys_chatbot, automated_outreach, high_risk_decisions
Primary source: official Connecticut statute text, Chapter 743jj, Connecticut General Statutes