SB 893 - Consumer Privacy Act Summary

• Establishes comprehensive consumer privacy rights effective January 1, 2023, applying to businesses controlling personal data of 100,000+ Connecticut residents or 25,000+ residents generating 50%+ revenue from data sales

• Grants consumers rights to access, correct, delete, and port their personal data; opt out of targeted advertising, data sales, and profiling; and appeal controller decisions within 45-60 days

• Requires controllers to limit data collection to necessary purposes, maintain data security, obtain consent for sensitive data processing, and provide clear privacy notices disclosing data categories and third-party sharing

• Mandates data protection assessments for targeted advertising, data sales, profiling, and sensitive data processing activities to weigh benefits against privacy risks

• Grants Connecticut Attorney General exclusive enforcement authority with civil penalties up to $7,500 per violation and 30-day cure period before action, with no private right of action for consumers