Connecticut Passes Fifth State Privacy Law

The Connecticut Data Privacy Act (CTDPA) goes into effect on July 1, 2023. Connecticut is the fifth state to pass its own comprehensive privacy law, following in the footsteps of California, Colorado, Utah and Virginia. Though the laws in these five states share similarities, they differ in ways that will make compliance a challenge for businesses.

Companies preparing for the new laws should keep in mind five things about the CTDPA: (1) It applies to companies that conduct business in Connecticut or produce products or services for Connecticut residents; (2) gives consumers the right to opt out of processing data for targeted advertising, sales and profiling; (3) sets responsibilities and privacy protection standards for data controllers; (4) requires controllers to conduct data protection assessments; and (5) authorizes the attorney general to enforce the law rather than providing a private right of action. 

The similarities of the laws in these five states — providing rights, contractual provisions, and security obligations — will need to be balanced with the laws’ nuances. Businesses and legal teams are encouraged to learn more about them to be better prepared for compliance deadlines.