Attorney General Tong Releases Updated Report on Connecticut Data Privacy Act

Press Releases

04/17/2025

Attorney General Tong Releases Updated Report on Connecticut Data Privacy Act

(Hartford, CT) – Attorney General William Tong today released a new report detailing the actions the Office of the Attorney General took in 2024 to enforce compliance with the Connecticut Data Privacy Act (CTDPA).

The CTDPA, which took effect in July 2023, grants important data rights to Connecticut residents and solidifies critical privacy obligations for covered businesses. Since our initial report, the Office of the Attorney General continues to take significant steps to prompt compliance with the CTDPA.

This voluntary report provides updates on (1) the Office’s broader privacy and data security efforts; (2) consumer complaints received under the CTDPA to date; (3) several enforcement efforts highlighted in the Office’s initial report and (4) expanded enforcement priorities. Recommendations for strengthening the CTDPA’s protections are also included in the report.

“Connecticut remains at the forefront of consumer data privacy,” Attorney General Tong states in the report. “Since the Connecticut Data Privacy Act took effect, our office has worked to educate consumers and companies alike about their rights and obligations. We remain focused on ensuring compliance with this important law going forward. Much remains to be done, including amending the CTDPA to provide stronger protections for Connecticut residents. We will continue to be transparent about our efforts to uphold and strengthen this important law.”

“As the 2025 Enforcement Report is released, it's clear that Connecticut's commitment to data privacy is not just about safeguarding personal information—it's about protecting the dignity and autonomy of every resident,” said Sen. Maroney. “In an era where data is a powerful currency, our laws ensure that individuals have control over their own digital footprints.”

Since the law went into effect, the Office of the Attorney General has opened various investigations and inquiries into companies which collect, sell, and otherwise share consumer data, including:

· Manufacturers of connected vehicles;

· A genetic and family history company;

· A web service provider which provides palm recognition services to consumers;

· The provider of an anonymous peer messaging app aimed at teens; and

· Connecticut retailers’ use of facial recognition technology.

By the end of 2024, the Office had issued dozens of notices of violation, as well as a number of broader information requests, under the Act. We remain focused on key aspects of the CTDPA including transparency and sensitive data processing, but have also broadened our efforts to address problematic opt-out practices and dark patterns that trick consumers. Our priorities have also expanded as new legislation related to minors’ privacy and consumer health data took effect, and as our universal opt-out provisions came online.

The report also identifies areas in which the state legislature could strengthen or clarify aspects of the CTDPA. Some of the recommendations include:

· Scaling back exemptions, including eliminating entity-level exemptions;

· Lowering thresholds for applicability, including fully covering processing for all sensitive data and minors’ data;

· Strengthening data minimization provisions to limit the data companies can collect and maintain;

· Expanding the definition of sensitive data to incorporate a comprehensive list of elements added by other states since the CTDPA’s passage;

· Strengthening protections of minors’ data by prohibiting businesses from sending targeted ads so long as the company “knew or should have known” that the individual is a minor; and

· Enacting a one-stop-shop deletion mechanism to allow Connecticut residents to delete their personal information held by data brokers through a single, verified request.

For more information about the CTDPA, visit the Attorney General’s FAQ page here.

This report was prepared and reviewed by the entire Privacy Section, including Section Chief Deputy Associate Attorney General Michele Lucan, assistant attorneys general John Neumon, Laura Martella, Kileigh Nassau, Jordan Levin, and Patrick Kania, paralegal specialist Casey Rybak, and legal investigator Carly Smedberg, with support from administrative assistant Diana Viera.

Twitter: @AGWilliamTong

Facebook: CT Attorney General

Media Contact:

Elizabeth Benton
elizabeth.benton@ct.gov

Consumer Inquiries:

860-808-5318
attorney.general@ct.gov