Connecticut Poised to Enact Shopper Privacy Law | Insights

Connecticut has positioned by itself to grow to be the fifth state to carry out complete shopper privateness laws, immediately after equally chambers of the state legislature authorized draft monthly bill SB 6 on April 22, 2022, and April 28, 2022, respectively. The “Act Concerning Particular Details Privateness and On the web Monitoring” adopts the exact technique as the Virginia Buyer Details Security Regulation (VCDPA), with only slight variations. The monthly bill will become regulation if signed by Gov. Ned Lamont or if no action is taken by mid-May well.

The pursuing tables review the Connecticut monthly bill to the legislation of the 4 other states that have passed extensive buyer privateness legislations. A Condition Client Privateness Legal guidelines “cheat sheet” is also obtainable for down load.


With the passage of SB 6, some tendencies develop into very clear: California is an outlier in extending legal rights to workforce customers and company-to-company contacts. It is also an outlier in containing any sort of personal appropriate of action – the laws of the other 4 states can only be enforced by point out regulators. The emerging craze is for rules to have to have see and specific customer rights, opt-in consent for processing of sensitive individual data in some situations, data minimization and other information management obligations, to have to have data protection influence assessments, and safety of own information and facts when shared with suppliers.

Connecticut Poised to Enact Shopper Privacy Law | Insights

Perspective larger picture

Client Rights

The Connecticut bill, if it turns into law, will create new rights for Connecticut citizens related to all those of buyers in Virginia and Colorado. The few insignificant distinctions in SB 6 incorporate an explicit prerequisite to attain consent to sell the personal details of a small concerning ages 13-16 or method these types of details for advertising and marketing – an growth earlier Virginia, which only involves choose-in consent up to age 13, to align with California.

Connecticut adopted the tactic of recent VCDPA amendments by including language associated to the deletion proper that enables for organizations to deal with concerns of repopulating data feeds by opting the customer out of processing, in its place of entire deletion. But due to the fact the other a few states do not supply that choice, it is unclear no matter if this will provide operational aid.

Chart with green and red text

Perspective more substantial impression

Request Submission and Dealing with

On the submission and managing of consumer rights requests, Connecticut’s new legislation carefully parallels the Colorado Privateness Act (CPA) as opposed to Virginia. Connecticut follows California and Colorado in environment forth a requirement that firms allow individuals to choose-out of qualified marketing or sale by way of an choose-out choice signal despatched by some kind of technological mechanism (such as a consumer-enabled browser regulate). Unlike California and Colorado, having said that, there is no necessity in the Connecticut regulation that specs for the complex mechanism be authorized by the state regulator, producing uncertainty as to whether marketplace norms can produce about person-enabled controls.

Chart with green and red text

Check out larger image

Facts Governance

All five of the regulations getting applied in 2023 increase earlier the customer-experiencing requirements put in location by California in 2020 by way of the California Purchaser Privateness Act (CCPA) and demand companies to carry out selected obligations relevant to the managing of knowledge from all customers.

Chart with green and red text

View much larger graphic


Connecticut follows the craze in allowing for violations to be enforced only by its state Lawyer Basic. Like Colorado, the Connecticut attorney normal ought to provide a 60-day recognize and chance to overcome violations. The treatment window, having said that, sunsets at the stop of 2024. Violations of SB 6 are treated as a misleading trade practice underneath the condition Unfair and Deceptive Functions and Techniques (UDAP) statute, and punishable by civil penalties of up to $5,000 plus true and punitive damages and attorneys’ fees and costs. California continues to be the only state to allow a private appropriate of action – limited to specified kinds of info breaches only.

Chart with green and red text

Look at greater impression

For additional data or thoughts with regards to Connecticut’s consumer privacy legislation, its influence or relation to the 4 other point out privateness legal guidelines, speak to the authors or one more member of Holland & Knight’s Information Technique, Safety and Privateness Group.

Information contained in this inform is for the general instruction and awareness of our visitors. It is not created to be, and ought to not be used as, the sole resource of facts when examining and resolving a legal trouble, and it need to not be substituted for lawful assistance, which depends on a unique factual assessment. Moreover, the legislation of just about every jurisdiction are distinct and are frequently altering. This information is not intended to create, and receipt of it does not represent, an legal professional-shopper relationship. If you have unique queries concerning a distinct actuality situation, we urge you to check with the authors of this publication, your Holland & Knight agent or other capable lawful counsel.