In late June 2025, Connecticut lawmakers passed a statute making significant amendments to the Connecticut Data Privacy Act (“CTDPA”). The amendments strengthen the CTDPA and make it applicable to almost every business that collects and/or processes consumer personal data. Here are a couple of the notable changes.

More businesses covered by the CTDPA

In the original version of the CTDPA, covered businesses were defined in the usual manner: those that controlled or processed personal data for at least 100,000 Connecticut consumers, OR those that controlled or processed the personal data of at least 25,000 consumers and derived 25% or more of their gross revenue from the sale of personal data. The original definition was used in similar statutes.

However, Connecticut legislators have blazed a new trail. Now the CTPDA applies to businesses that:

• Control or process the personal data of at least 35,000 consumers OR
• Control or process the sensitive data of ANY consumers (excluding data processed solely for payment purposes) OR
• Offer consumer personal data for sale

The new definition gives greater importance to the distinction between personal data and sensitive data. Most similar statutes make the distinction, but the distinction does not matter too much. Personal data generally means data that can be used to identify a person, but is not particularly intrusive into privacy questions. On the other hand, sensitive data is defined as including data about race, religion, sexual orientation, gender, gender fluidity, biometric data, neural data, and more.

Regulations on profiling are strengthened

The most recently enacted consumer data privacy statutes have highlighted privacy issues related to profiling. Consumer data can be used to identify personal characteristics (like race or sexuality) that can be used for targeted advertising. The same data can also be used as part of a company’s automated evaluation of an individual for services and products (like access to credit or other financial products).

The revised CTDPA gives consumers new rights with respect to their data when used for automated decision-making. First, the revised CTDPA allows consumers to opt out of having their data processed for any automated decision-making, not just circumstances where the data was processed SOLELY for automated decision-making.

Second, Connecticut consumers now have the right to know whether personal data is being used for automated decision-making, AND what inferences are being used by the company when the data is used for profiling in this manner. In the original version of the CTDPA, Connecticut consumers were given the right to know what data is/was being collected, how the data was processed, to whom it was sold, etc. The list has now been expanded

Third, the revised CTDPA clarifies that consumer rights and protections apply not only when a covered business is making automated decisions, but also when automated decisions are being made “on behalf of” a controller. Thus, affiliated and third parties are now covered.

Finally, the revised CTDPA mandates that companies that use profiling for automated decision-making must provide certain appeal rights. More specifically, consumers must be given a mechanism for:

• Challenging or questioning the decision
• Obtaining an explanation of how the decision was made and how/why the result were reached
• Examining the personal data that was used in the profiling
• Correcting inaccurate data and asking for a re-evaluation (applies only in housing-related circumstances)

Contact The Consumer Data Privacy and Compliance Attorneys At Revision Legal

For more information, contact the experienced Consumer Data Privacy and Compliance Lawyers at Revision Legal. You can contact us through the form on this page or call (855) 473-8474.