CT SB01356

Expands Connecticut's data privacy law applicability to businesses processing personal data of 35,000+ consumers (down from 100,000) or 10,000+ consumers while deriving 20%+ revenue from data sales (down from 25,000/25%), effective October 1, 2025

Adds "neural data" (brain/nervous system activity measurements) to the definition of sensitive data requiring consumer consent, alongside expanded categories including financial account information and government-issued ID numbers

Creates a mandatory data broker registration system through the Department of Consumer Protection with $600 annual fees and civil penalties up to $500/day (capped at $10,000/year) for violations

Establishes protections for domestic violence survivors to terminate abusers' access to connected vehicle services within 2 business days of request, effective January 1, 2026

Strengthens minor privacy protections on social media platforms by prohibiting targeted advertising, data sales, and addictive design features for users under 18, and requiring platforms to unpublish accounts within 15 business days upon request