Table of Contents
UPDATED: 10/17/2026
If you run a small business with a website that reaches customers in Hartford, New Haven, Stamford, or anywhere else in the state, Connecticut site laws changed more in the summer of 2026 than in the previous three years combined.
On July 1, 2026, the state’s privacy law expanded to reach businesses one third the size of those covered before, and on October 1, 2026, two more major laws take effect, one on data and one on AI. After twenty years of building and auditing sites for small companies, I can tell you that a business which safely ignored Connecticut privacy rules in 2025 may be squarely inside them today.
This report gives you the full picture in the order you are most likely to encounter each rule. You will learn how the Connecticut Data Privacy Act works after the July 1, 2026 amendments, what SB 4 and SB 5 add on October 1, 2026, what the breach notification statute demands, how the sales tax rules work for online sellers, and how the state treats minors, chatbots, and subscriptions.
Every date and statute reference comes from the Connecticut General Assembly, the Connecticut Attorney General, or established legal summaries.
Why Connecticut Site Laws Reach Smaller Businesses Now
Connecticut was the fourth state to enact a comprehensive consumer privacy law, and Senator James Maroney has driven amendments through nearly every session since. The 2026 regular session, which ran from February 4 through May 6, 2026, produced the two largest additions yet: Senate Bill 4, a privacy and data broker package that passed the House 141 to 6 on May 4, 2026, and Senate Bill 5, a 39 section AI statute that passed the House 131 to 17 on May 1, 2026. Governor Ned Lamont signed both in late May 2026.
For you, the practical result is that Connecticut site laws now come in three layers. The Connecticut Data Privacy Act forms the base layer, and the new thresholds pull in far more small businesses than before. A second layer of consumer protection, breach notification, and tax statutes applies to nearly every business regardless of size. A third layer of AI, chatbot, and minors’ safety rules is new and phases in between October 1, 2026, and October 1, 2027. The sections below walk through each layer.
The Connecticut Data Privacy Act After July 1, 2026
The foundation of Connecticut site laws, the Connecticut Data Privacy Act codified at Conn. Gen. Stat. 42-515 through 42-525, took effect on July 1, 2023, and originally applied only to businesses that processed the personal data of 100,000 or more residents, or 25,000 residents while earning more than 25 percent of revenue from data sales. Senate Bill 1295, signed June 24, 2025, rewrote those thresholds effective July 1, 2026.
The law now applies to any business that conducts business in Connecticut or targets Connecticut residents and, in the preceding year, controlled or processed the personal data of 35,000 or more consumers, controlled or processed any consumer’s sensitive data, or offered any consumer’s personal data for sale. Data processed solely to complete a payment transaction does not count toward the 35,000 figure.
The two “no threshold” triggers are the ones that catch small businesses. Sensitive data now includes racial or ethnic origin, religious beliefs, health conditions or treatment, sexual orientation, transgender or nonbinary status, citizenship or immigration status, genetic and biometric data, neural data, precise geolocation, financial account information, government issued identification numbers, and any data about a known child.
A wellness studio that asks about injuries, a retailer that stores driver’s license numbers for age restricted products, or a site that uses precise location from a mobile app now falls under the Connecticut Data Privacy Act regardless of how many customers you serve. Selling personal data, which means exchanging data for money or other valuable consideration, triggers coverage with a single Connecticut resident.
Once covered by this part of Connecticut site laws, you must post a compliant privacy notice, honor requests to access, correct, delete, and port data, provide a list of third parties to whom you sold a consumer’s data, allow opt outs of targeted advertising, sales, and profiling, obtain consent before processing sensitive data, and honor universal opt out signals such as Global Privacy Control.
The 2026 amendments also require your privacy notice to disclose whether personal data is used to train large language models, require you to notify consumers of material changes and let them withdraw consent, prohibit targeted advertising or sales involving known minors under 18 regardless of consent, and require an impact assessment before profiling that produces legal or similarly significant effects, for activities created on or after August 1, 2026. The Attorney General enforces the law under the Connecticut Unfair Trade Practices Act, the guaranteed cure period expired at the end of 2024, and there is no private right of action.
SB 4: Geolocation, Surveillance Pricing, and Data Brokers
Senate Bill 4, signed by Governor Lamont on May 27, 2026, as Public Act 26-64 and refined by House Bill 5222 on June 2, 2026, adds a second wave of Connecticut site laws effective October 1, 2026. The headline provision is a flat ban on selling, sharing, transferring, or allowing access to a consumer’s precise geolocation data, with no consent exception. If your mobile app or website collects location data and passes that data to advertising partners, that flow must stop by October 1, 2026.
The Act also requires businesses that use personalized algorithmic pricing, sometimes called surveillance pricing, to disclose that an individual price was set using personal data. If your eCommerce platform adjusts prices based on a customer’s browsing history, location, or device, you will need a clear disclosure at the point of sale.
The Act adds signage and disclosure requirements for facial recognition used in physical locations, new protections for direct to consumer genetic testing data, and a redefinition of publicly available information that narrows what you can treat as outside the law.
The third piece of SB 4 adds a California style data broker registry to Connecticut site laws. Beginning January 1, 2027, any business that sells or licenses brokered personal data about consumers with whom you have no direct relationship must register with the Department of Consumer Protection and, once the Department builds the program, honor a single accessible deletion mechanism that lets residents remove their data from every registered broker at once.
Most small business websites are not data brokers, but if you sell lead lists, audience segments, or compiled contact data, confirm your status before the registration date.
SB 5: The AI Responsibility and Transparency Act
Senate Bill 5, the Connecticut Artificial Intelligence Responsibility and Transparency Act, became Public Act 26-15 with the governor’s signature on May 27, 2026, and a ceremonial signing on June 2, 2026. Senator Maroney’s comprehensive AI bills had passed the Senate in 2024 and 2025 only to die in the House, so the 2026 version is the culmination of a three year effort. The Act phases in across three dates.
Beginning October 1, 2026, employers may no longer use an automated employment decision tool as a defense to a discrimination claim, developers of those tools must provide documentation to deployers, employers filing WARN notices must disclose whether layoffs relate to AI, and providers of generative AI systems with more than one million monthly users must embed provenance data in generated content.
Beginning January 1, 2027, operators of AI companion chatbots must disclose that users are interacting with AI, repeat that disclosure at regular intervals, maintain protocols for suicide and self harm disclosures, and apply additional safeguards for minors. Beginning October 1, 2027, employers must give applicants and employees notice before an automated tool drives a consequential decision, and provenance marking extends to all generative AI developers. Violations are unfair trade practices enforced by the Attorney General, with a 60 day cure period available through the end of 2027 and no private right of action.
For a small business website, the January 1, 2027 chatbot rules are the Connecticut site laws most likely to reach you. A basic customer service bot that answers order questions is generally outside the companion chatbot definition, but any AI assistant that holds open ended, relationship style conversations falls inside. Because Colorado’s chatbot law takes effect the same day and California’s SB 243 already applies, building disclosure and crisis response into any conversational AI now satisfies three states at once.
Minors Online: The 2023 Rules Still in Force
Connecticut site laws addressed minors before most states. Senate Bill 3, signed June 26, 2023, added provisions to the privacy law effective October 1, 2024, that apply to any controller offering an online service, product, or feature to a consumer the controller actually knows, or willfully disregards, is under 18. Those controllers must use reasonable care to avoid heightened risk of harm, may not process a minor’s data for targeted advertising or sale without consent, may not use system design features to significantly increase a minor’s use of the service, may not collect precise geolocation without consent and a visible signal, and may not allow unsolicited direct messages from adults to minors on social media.
The July 1, 2026 amendments hardened those rules by removing the consent option for targeted advertising and sales involving minors, and SB 5 added further duties for social media platforms used by minors. Connecticut has not enacted a general age verification mandate for adult content websites, so unlike Arizona and Arkansas the state does not require ID checks, and a typical business site is not forced into age gating. Federal COPPA rules still apply if your site is directed at children under 13.
Breach Notification: A 60 Day Clock
The longest standing of the Connecticut site laws for any website that stores customer data is the breach notification statute at Conn. Gen. Stat. 36a-701b. The law applies to any person who conducts business in Connecticut and owns, licenses, or maintains computerized data that includes personal information. Personal information means a first name or initial plus last name combined with a Social Security number, taxpayer ID number, driver’s license or state ID number, passport or military ID number, account or card number with any required access code, medical or health insurance information, or biometric data, as well as a username or email address combined with a password or security question.
If unencrypted personal information is accessed or acquired without authorization, you must notify affected residents without unreasonable delay and no later than 60 days after discovering the breach, and you must notify the Connecticut Attorney General no later than when you notify residents.
If Social Security numbers or taxpayer ID numbers were involved, you must offer at least 24 months of identity theft prevention and mitigation services at no cost. Notice may go by mail, telephone, or email, or by substitute notice when direct notice would cost more than $250,000 or reach more than 500,000 people. Failure to comply is an unfair trade practice enforceable by the Attorney General, and a separate statute, Conn. Gen. Stat. 42-471, requires you to safeguard personal information and dispose of records securely.
The Connecticut Unfair Trade Practices Act and Your Online Store
Connecticut polices advertising and sales through the Connecticut Unfair Trade Practices Act, known as CUTPA, at Conn. Gen. Stat. 42-110a and following sections. CUTPA prohibits unfair methods of competition and unfair or deceptive acts in trade or commerce, and Connecticut courts look to Federal Trade Commission interpretations for guidance, which means federal advertising standards effectively become part of Connecticut site laws. Consumers may recover actual damages, punitive damages, and attorney fees, and the Attorney General may seek civil penalties of up to $5,000 per willful violation.
For your site, this reaches the everyday choices you already worry about. Reference prices that were never charged, timers that reset on every visit, subscription trials that convert without clear disclosure, fees revealed only at checkout, and staff written testimonials all create exposure.
Connecticut also has an automatic renewal statute at Conn. Gen. Stat. 42-126b that requires clear disclosure of automatic renewal terms and an easy cancellation method for consumer contracts with terms longer than one month. Treating every product page, pricing table, and review section as regulated advertising is the habit that can help you steer clear of both state and federal complaints.
Connecticut Site Laws for eCommerce: Sales and Use Tax
Connecticut imposes a statewide sales and use tax of 6.35 percent with no local add on rates, which makes collection simpler than in most states. Following the U.S. Supreme Court’s 2018 decision in South Dakota v. Wayfair, Connecticut required remote sellers to register with the Department of Revenue Services and collect tax beginning December 1, 2018, once their retail sales into Connecticut reached $250,000 and 200 transactions. Public Act 19-117 lowered the dollar figure to $100,000 effective July 1, 2019.
Connecticut still requires both tests to be met, so you must exceed $100,000 in gross receipts and complete 200 or more separate retail sales into the state in the 12 month period ending September 30 before the obligation begins.
Connecticut site laws have required marketplace facilitators such as Amazon, Etsy, and eBay to collect on facilitated sales since December 1, 2018, and those sales are not counted toward your own threshold. Digital goods, streaming services, and canned software delivered electronically are taxable in Connecticut, with software sold to businesses taxed at a reduced 1 percent rate. Clothing and footwear under $50 are exempt, and a one week sales tax holiday for clothing runs each August. Check your product categories against the Department’s guidance instead of trusting default platform settings.
What You Should Do Now
You do not need a compliance department to satisfy Connecticut site laws, but you do need a short list of concrete tasks that reflect the July 1, 2026 threshold change and the October 1, 2026 effective date for SB 4 and SB 5. Each step below addresses a current or scheduled obligation, and each also positions you well for the January 1, 2027 chatbot and data broker dates.
- Re-test whether the Connecticut Data Privacy Act applies to you under the 35,000 consumer threshold and the no threshold triggers for sensitive data and data sales, and if so, update your privacy notice, consent flows, and Global Privacy Control handling.
- Stop any sale or sharing of precise geolocation data and add a surveillance pricing disclosure if your prices vary by customer data, both before October 1, 2026.
- Map every place you store personal information, confirm encryption, and write a breach plan that reaches residents and the Attorney General within 60 days.
- Check your Connecticut sales for both the $100,000 and 200 transaction tests and register with the Department of Revenue Services if you crossed both.
- Inventory any chatbot or AI feature on your site and plan disclosure, crisis protocols, and minor safeguards before January 1, 2027.
Once those tasks are done, you will be current on every one of the Connecticut site laws covered in this report, so put three dates on your calendar: October 1, 2026, for SB 4 and the first SB 5 provisions, January 1, 2027, for chatbot rules and data broker registration, and October 1, 2027, for the remaining SB 5 duties. The General Assembly returns in January 2027, and Senator Maroney has already signaled that further privacy and AI amendments are likely.
Key Takeaways
- Since July 1, 2026, the Connecticut Data Privacy Act applies at 35,000 consumers, or to any business processing sensitive data or selling personal data.
- SB 4 (Public Act 26-64) bans precise geolocation sales and requires surveillance pricing disclosures effective October 1, 2026, with data broker registration on January 1, 2027.
- SB 5 (Public Act 26-15), the AI Responsibility and Transparency Act, phases in from October 1, 2026, with companion chatbot rules on January 1, 2027.
- Breach notices are due within 60 days, with concurrent notice to the Attorney General.
- Remote sellers collect Connecticut sales tax after both $100,000 in sales and 200 transactions.
Frequently Asked Questions About Connecticut Site Laws
Does the Connecticut Data Privacy Act apply to my small business?
Since July 1, 2026, yes if you conduct business in Connecticut or target Connecticut residents and, in the prior year, processed personal data of 35,000 or more consumers, processed any sensitive data such as health information, precise location, or government ID numbers, or sold any personal data. Payment only processing does not count toward the 35,000 figure.
Do Connecticut site laws apply to my business if I am located in another state?
Yes, in most cases. The privacy law reaches any business that targets Connecticut residents and meets a trigger, the breach statute covers anyone holding Connecticut residents’ data, CUTPA reaches sales to Connecticut residents, and the sales tax rules apply once you exceed $100,000 in sales and 200 transactions.
Do Connecticut site laws require age verification on my website?
No. Connecticut has no general age verification mandate. The minors’ provisions of the privacy law apply when you actually know or willfully disregard that a user is under 18, and the SB 5 chatbot rules require safeguards for minors beginning January 1, 2027. Federal COPPA rules still apply if your site is directed at children under 13.
Do Connecticut site laws still allow location data for advertising?
Not by selling or sharing precise geolocation data. Beginning October 1, 2026, SB 4 flatly prohibits selling, sharing, or allowing access to a consumer’s precise geolocation data, with no consent exception. You may still collect and use precise location internally with consent for a disclosed purpose.
Do Connecticut site laws require me to disclose AI chatbots on my website?
Beginning January 1, 2027, yes for AI companion chatbots under SB 5. Operators must disclose that users are interacting with AI, repeat the disclosure at intervals, maintain suicide and self harm protocols, and add protections for minors. Until then, disclosure is a best practice and may already be required if your chatbot could mislead consumers under CUTPA.
Conclusion
Connecticut site laws in 2026 reward the owner who re-checks thresholds instead of relying on last year’s answer. The Connecticut Data Privacy Act has reached businesses at 35,000 consumers, or with any sensitive data or any data sale, since July 1, 2026. SB 4 bans precise geolocation sales and requires surveillance pricing disclosures on October 1, 2026, and opens a data broker registry on January 1, 2027.
SB 5 brings AI provenance and employment rules on October 1, 2026, and companion chatbot rules on January 1, 2027. The 60 day breach statute, CUTPA, and the two part sales tax test round out the picture. Finish the five tasks above this fall and you will meet every current requirement while staying ready for whatever the General Assembly sends your way in 2027.
Updates
PRIOR UPDATE
09/21/2026: Public Act 26-130 — Surveillance Pricing Amendments
Status: Enacted
Connecticut’s surveillance-pricing rules were changed again after Public Acts 26-64 and 26-100. Public Act 26-130 repealed the earlier surveillance-pricing provision and sets the principal new requirements for July 1, 2027, rather than October 1, 2026. The new law generally prohibits retailers and third-party delivery services from using surveillance pricing in either online or in-person transactions. Other businesses using personal data to increase a customized price for a consumer good or service in an online transaction must generally give a readily visible statutory disclosure, or a substantially similar one, stating that the price was increased using the consumer’s personal data. The disclosure rule does not apply when surveillance pricing is used to establish a discounted price. Online sellers using personalized pricing should reassess their practices and implementation schedule against the later effective date and revised scope.
Sources: Official or supporting source | Official or supporting source
PRIOR UPDATE
09/21/2026: Connecticut Automatic Renewal and Continuous Services Law, Conn. Gen. Stat. § 42-158ff
Status: Effective
Connecticut’s updated automatic-renewal and continuous-services requirements have been effective since July 1, 2026. Covered businesses offering consumer subscriptions or memberships that renew automatically must send an annual renewal reminder containing specified service, charge, and cancellation information. They also must provide an easy cancellation method, promptly process cancellation requests, and may not require cancellation in person or by mail.
For an online consumer agreement, the statute requires an online way to take the actions necessary to stop renewal or end continuous services; the Attorney General specifically advises online businesses to provide a clear online cancellation option or a dedicated cancellation email address. A voicemail cancellation request containing enough information to process must be handled within one business day. Violations are designated unfair trade practices. The statute includes exemptions for specified regulated utilities, financial institutions, insurers, and certain predominantly audiovisual services.
Sources: Official or supporting source | Official or supporting source
One Response