Law / United States / Connecticut
Connected device provider's duty to protect recorded personal information with reasonable security measures
Public Act No. 25-44, Sec. 2(c) (2025)
A citation is an address, not a summary. The first part names the law; what follows narrows it to the exact section, article or paragraph.
In force 77 days, effective 1 July 2026.
A security baseline statutes rule binding private bodies.
As of 12 September 2026.
What it requires
- This binds a 'provider': a connected device manufacturer (a person doing business in Connecticut who manufactures an Internet-connected home appliance, television or toy that includes a camera or microphone), and any person under contract with the manufacturer who gets access to the camera or microphone, or to any image, video or sound it collects, records, stores, analyzes, interprets or transmits.
- Implement and maintain reasonable security measures to protect any personally identifying information collected through the connected device's camera or microphone from unauthorized access, acquisition, destruction, disclosure, modification or use.
- A violation is an unfair or deceptive trade practice under Conn. Gen. Stat. Sec. 42-110b; the enforcement clause for this subsection does not exclude Section 42-110g the way several of this Public Act's other sections do, so a person who suffers an ascertainable loss appears to retain Connecticut's ordinary CUTPA private right of action for a violation of this duty.
If you get it wrong
Criminal exposureNo
Private right of actionYes
Who enforces it
Enforcement body
A violation is deemed an unfair or deceptive trade practice under Conn. Gen. Stat. Sec. 42-110b(a), enforceable by the Attorney General under the Connecticut Unfair Trade Practices Act's general enforcement provisions (chapter 735a).
What it reaches
Obligation class
Security
What this law does
Drafted with AI from the cited sources under the direction of UnGovr staff. UnGovr holds editorial responsibility for this page.
Public Act 25-44 defines a connected device as an Internet-connected home appliance, television or toy that includes a camera or microphone. It defines a 'provider' as the device's manufacturer or any person under contract with the manufacturer who gets access to the camera, microphone, or the images, video or sound they collect.
Each provider must implement and maintain reasonable security measures to protect any personally identifying information collected through a connected device's camera or microphone from unauthorized access, acquisition, destruction, disclosure, modification or use.
A violation of this subsection is an unfair or deceptive trade practice under the Connecticut Unfair Trade Practices Act, and unlike several of this same Public Act's other sections, the enforcement clause covering it does not exclude Section 42-110g, so it appears to carry that chapter's ordinary private right of action for a person who suffers an ascertainable loss.
When LexLint raises it
distributes_software_product