Connecticut: Public Act 26-64 (SB 4), consumer privacy and protection

Status

• 4 May 2026House passed as amended, in concurrence (bill history, cga.ct.gov).
• 27 May 2026Signed by the Governor.
• 1 Oct 2026Every section of the act takes effect. Each of the twenty sections carries the line “Effective October 1, 2026”.
• 1 Jan 2027Sec. 2: no data broker shall sell or license brokered personal data in the state on or after this date unless actively registered with the Department of Consumer Protection.
• 1 Jul 2028Sec. 5: deadline for the Commissioner of Consumer Protection to establish the accessible deletion mechanism.
• 1 Jul 2029Sec. 6: registered data brokers begin processing deletion requests through the mechanism, annually thereafter.

What is in it

• Secs 1-10Data broker regime: registration with the Department of Consumer Protection, a public internet registry, the accessible deletion mechanism, exemptions, a registration account, and civil penalties after notice and hearing.
• Sec 11Surveillance pricing: disclosure duties where a “price setting device”, an automated process using a consumer’s personal data, sets a customised price for consumer goods or services.
• Secs 12-16CTDPA amendments: rewritten definitions (adding, among others, neural data and precise geolocation data to sensitive data), consumer rights, controller duties, processor duties and exemptions. Sec. 14 adds the ban: “No controller shall sell any consumer’s precise geolocation data.”
• Facial rec.Controllers using facial recognition on premises for security purposes must use it only against their own database and post clearly legible signage at each entrance where it is in use.
• Secs 17-19Genetic data: a consumer property right in biological samples and genetic results, and duties on direct-to-consumer genetic testing companies.
• Sec 20Streaming video services: consumer provisions applying Commercial Advertisement Loudness Mitigation Act concepts to streaming.

Why it is on this list

This is the privacy half of Connecticut’s 2026 pair. The AI half is Public Act 26-15 (SB 5), and the two were signed a week apart. PA 26-64 matters to anyone running automated pricing or profiling against Connecticut consumers: the surveillance-pricing disclosure duty and the rewritten CTDPA profiling rights both attach to automated decisions, and both are answered with records of what the system actually did.

Note what this act is not: it never uses the words “artificial intelligence”. The AI-specific duties live in PA 26-15.

Sources

• Connecticut General Assembly, Public Act No. 26-64, enrolled text (PDF)
• Connecticut General Assembly, SB 4 bill status and history

Related

• The law library · AI rules by country
• Connecticut Public Act 26-15 (SB 5), the AI half of the 2026 pair
• Connecticut CTDPA, the act this one amends
• California Delete Act (SB 362 / DROP), the other state deletion mechanism

Checked against the source 13 August 2026: the enrolled Public Act PDF (all twenty “Effective” lines read) and the CGA bill history. Information, not legal advice.