What does Connecticut require right now?

Requires automated decision-making technology reporting for employment contexts. Prohibits AI companion chatbots for users under 18 without verified parental consent. Mandates employer whistleblower systems for AI risk disclosure. Creates regulatory sandbox for AI development (by Jan 1, 2028). Signed by Gov. Lamont in 2026.

Data broker registration: the registration section is effective Oct 1, 2026, and on or after Jan 1, 2027 no data broker may sell or license brokered personal data in Connecticut unless actively registered with the Department of Consumer Protection (except as provided in section 7 of the act). Separately bans controllers from selling any consumer's precise geolocation data. Adds facial recognition restrictions to the existing CTDPA framework; consumer opt-out and data deletion mechanisms effective July 1, 2028. Signed by Gov. Lamont in 2026. Broker-registration and geolocation provisions hand-verified against the official act PDF Aug 3, 2026 (Claire). CTDPA 2026 amendments (same act; this portion not yet hand-verified): effective July 1, 2026 — age-appropriate design code requirements, neural data added as a sensitive data category, strengthened minors' rights and restrictions on sale/use of minors' personal data.

Comprehensive privacy law with consumer rights (access, delete, correct, portability, opt-out for targeted ads/profiling/sales). 2025 amendments strengthened facial recognition restrictions and expanded biometric consent obligations. Actively enforced — $85,000 settlement precedent set.