Connecticut's Privacy Law Just Changed — Effective Today
Connecticut's Public Act 26-64 took effect October 1, 2026, and it meaningfully expands what the state's existing privacy law actually covers. If your last compliance check on Connecticut happened before this week, it's already out of date in a few specific ways.
The Geolocation Sale Ban
Connecticut now prohibits selling precise geolocation data outright. This puts Connecticut alongside Virginia, Maryland, and Oregon, all of which have adopted similar prohibitions within roughly the same stretch of time, a real, fast-forming pattern worth watching if your business touches location data at all.
A Narrower Exclusion for "Publicly Available" Data
Previously, information considered publicly available fell outside Connecticut's definition of personal data entirely, an exclusion that enrichment, lead-generation, and similar data models commonly leaned on. That exclusion is now narrower. Businesses relying on this category as a reason certain data practices sat outside the law's scope should revisit that assumption specifically.
New Facial Recognition Rules and an Expanded Profiling Scope
The amendment adds specific rules around facial recognition technology, and broadens how the law treats profiling used in decisions that produce legal or similarly significant effects on a consumer. It also narrows the law's employment-related exemption, worth noting if your data practices have leaned on that carve-out.
A Detail That Matters for Threshold Calculations
Connecticut's sensitive-data and data-sale triggers no longer carry a minimum processing threshold tied to them. Previously, certain obligations only applied once a business crossed a particular volume. That minimum is gone for these specific triggers, a real tightening worth understanding precisely rather than assuming the old volume cushion still applies.
Why This Is Worth Acting On Now, Not Eventually
An amendment that's already in effect isn't a future planning item, it's a current compliance question. If your business was relying on the publicly-available-data exclusion or a processing-volume minimum that no longer exists in its prior form, that gap exists today, not at some point down the road.
Check Your Connecticut Privacy Position
All information in this article is sourced from Connecticut Public Act 26-64 (Senate Bill 4) and independent legal analysis from InfoLawGroup and Morgan Lewis. Regulens is informational only and this article is not legal advice. Speak to a licensed privacy attorney about your specific compliance situation.
Regulens tracks Connecticut as part of its ongoing state-by-state privacy coverage.
Free to check, takes three minutes, no credit card needed. Not legal advice. Informational only.
Check your store's Connecticut privacy readiness at getregulens.com
Further Reading
Four States Now Ban Selling Your Customers' Exact Location — Is Yours Next
Virginia, Connecticut, Maryland, and Oregon have each independently banned the sale of precise geolocation data within the same general stretch of time. A pattern like this rarely stays confined to four states for long.
Utah's New Tax Has Nothing to Do With Nexus Thresholds — And That's the Point
As of this month, Utah taxes a specific category of digital content at 2%, tied to age-verification requirements. It's a genuinely different kind of obligation than the nexus thresholds most sellers are used to tracking.