CT SB00006

Effective July 1, 2023, establishes comprehensive personal data privacy protections applying to businesses collecting data from 100,000+ Connecticut residents or 25,000+ residents where 25%+ of revenue comes from data sales

Grants consumers rights to access, correct, delete, and port personal data; opt out of targeted advertising and data sales; and opt out of automated profiling with legal/financial effects

Requires controllers to limit data collection, maintain reasonable security practices, obtain consent for sensitive data processing, provide clear privacy notices, and establish mechanisms for consumer requests with 45-day response deadlines

Mandates data protection assessments for high-risk processing including targeted advertising, data sales, profiling, and sensitive data handling, with assessments available to Attorney General upon request

Grants exclusive enforcement authority to Connecticut Attorney General; violations constitute unfair trade practices; includes 60-day cure period for violations from July 1, 2023 through December 31, 2024