Sign in
Start free

United States

CTDPA

Connecticut Data Privacy Act

The CTDPA is Connecticut’s consumer privacy law. It lets residents opt out of targeted advertising, the sale of personal data and certain profiling, and requires consent before processing sensitive data. Amendments in force since 1 July 2026 brought many more businesses into scope. It is enforced by the Connecticut Attorney General.

Start free
Run a free scan

At a glance

Opt-out

Region
Connecticut, USA
Status
In force since July 2023, with major amendments from July 2026
Penalties
A violation is an unfair trade practice, and only the Attorney General can enforce it. Civil penalties are up to USD 5,000 per wilful violation, and courts can also order injunctions, restitution and disgorgement. The automatic 60-day right to cure ended on 31 December 2024.
Who it affects
Since 1 July 2026: anyone who does business in Connecticut or targets its residents and, in the previous calendar year, controlled or processed the personal data of 35,000 or more consumers, controlled or processed any sensitive data, or offered personal data for sale. Data processed only to complete a payment does not count.

What the CTDPA requires

  • Publish a privacy notice that includes categories of data and purposes.
  • Offer opt-outs of targeted advertising, the sale of personal data and profiling behind automated decisions that have legal or similarly significant effects.
  • Honour universal opt-out signals, such as the Global Privacy Control, as opt-outs of targeted advertising and the sale of personal data.
  • Obtain opt-in consent before processing sensitive data.
  • Conduct data protection assessments for high-risk processing.
  • Respond to consumer rights requests within 45 days.

Your site’s footer

An example

  • Privacy policy
  • Terms
  • Do Not Sell or Share My Personal Information

What the banner does here

The same opt-out mode as California: no blocking wall, a “Do Not Sell or Share My Personal Information” link on every page, and a preference centre to opt out.

How GrantCookie covers it

  • Scheduled scans. The scanner finds the cookies and trackers your site sets, sorts them into categories and re-checks on every scheduled scan, so the banner asks about what is really there.
  • Provable records. Every choice is timestamped and stored with the banner version the visitor saw. Paid plans include consent log export.
  • Opting out later. The opt-out link and preference centre are always available, so visitors can opt out or change an earlier choice at any time.

See every feature

The consent log: each row has a timestamp in UTC, a consent ID and the visitor’s choice

This page is general guidance. It is not legal advice. Check your specific obligations with a qualified adviser.

Related regulations

All regulations

  • CCPA

    Opt-out

    California Consumer Privacy Act

    California, USA In force since January 2020

  • CPA

    Opt-out

    Colorado Privacy Act

    Colorado, USA In force since July 2023

  • CPRA

    Opt-out

    California Privacy Rights Act

    California, USA In force since January 2023

Start free. No card, no sales call.

Scan your site, publish the banner, and move up a tier when you outgrow the free plan. Every plan is on the pricing page.

14-day trial on paid plans · Cancel any time · No card required to start

Start free
See every price