Connecticut Data Privacy Act: CTDPA Compliance
What is the CTDPA?
The Connecticut Data Privacy Act came into effect July 1, 2023. The law protects the privacy rights of residents of Connecticut and establishes data privacy responsibilities for companies doing business in the state when they process the data of Connecticut residents.
Visit the common CTDPA questions and answers
COMPLIANCE
How to comply with the Connecticut data privacy law
Controllers must notify consumers about data collection and processing on their websites via a privacy notice. Valid consent must be obtained before collecting children’s or sensitive data, collecting additional data, or changing the data processing purpose. Changing or revoking consent must be easily done, and consumers can opt out of data processing for targeted ads, sales, or automated decision-making.
RISKS
What are the consequences of CTDPA noncompliance?
Penalties are governed by the Connecticut Unfair Trade Practices Act (CUTPA) rather than directly by the CTDPA. Courts can impose civil penalties of up to USD 5,000 for willful violations and award actual and punitive damages, costs, and attorneys’ fees. Courts can also issue restraining orders, which could lead to a cease of data collection. Violating a restraining order could result in a penalty of USD 25,000.
your questions answered
Contact our expert team
We’re happy to answer questions about data privacy, compliant marketing operations, and the CTDPA. Usercentrics’ Consent Management Platform helps you build trust and avoid penalties. Learn more today.
- Interested in how privacy compliance benefits user experience and your marketing strategies?
- Not sure if your business is privacy-compliant in Connecticut?
- Need clarity on what your company’s compliance responsibilities are?
- Looking to partner with us?
Learn more
Frequently asked questions
What are consumer rights under the CTDPA?
Under the Connecticut Data Privacy Act (CTDPA), consumers have several rights:
- Right to know and access: confirm whether a controller is processing their personal data and to have access to such data, with some exceptions
- Right to correction: have inaccuracies in their collected personal data corrected, with some limitations
- Right to deletion: have personal data that was provided by or about them deleted by the controller or processor
- Right to data portability: obtain a portable copy of their personal data, to a technically feasible extent and with some restrictions
- Right to opt out: of the processing of their personal data for the purposes of: sale, targeted advertising, or profiling
What are the penalties for CTDPA noncompliance?
The Connecticut Attorney General enforces the CTDPA, and violations of the regulation are considered unfair trade practices under the Connecticut Unfair Trade Practices Act (CUTPA). The cure period sunset at the end of 2024, so enforcement is now at the Attorney General’s discretion.
Courts can impose civil penalties of up to USD 5,000 for willful violations and award actual and punitive damages, costs, and attorneys’ fees. Courts can also issue restraining orders, which could lead to a cease of data collection. Violation of a restraining order could result in a USD 25,000 penalty.
What is CTDPA compliance software?
CTDPA compliance software enables businesses to meet the Connecticut data privacy law’s requirements, such as providing consumers with information about data processing and exercising their rights, and obtaining consent where required.
Can a consent management platform enable CTDPA compliance?
A consent management platform (CMP) is a type of CTDPA compliance software. A CMP enables businesses to achieve and maintain their Connecticut data privacy law compliance for websites and apps. A CMP displays information to users about what cookies and other tracking technologies are in use that collect personal data, and enable users to make granular consent choices while securely storing and documenting consent information over time, which users can update.