Skip to content
TrustList
News

Connecticut’s new AI and data-privacy rules take effect on 1 October; data brokers must register by 1 January

Editorial

By TrustList Editorial

Connecticut’s Public Acts 26-64 and 26-15 take effect on 1 October 2026: limits on pricing with personal data, facial-recognition signage, a ban on selling precise geolocation, AI notices for employees, and data-broker registration by 1 January 2027.

About Connecticut’s new AI and data-privacy rules take effect on 1 October; data brokers must register by 1 January

Connecticut's new AI and data-privacy rules take effect on 1 October; data brokers must register by 1 January

28 September 2026 — Two Connecticut laws enacted in May 2026 bring new rights and obligations into force on 1 October 2026. Public Act 26-64 amends the Connecticut Data Privacy Act, and Public Act 26-15 covers artificial intelligence in employment and chatbots. Attorney General William Tong, whose office enforces most of them, set out what changes in a notice of 16 September; CT Mirror summarised the laws for businesses on 28 September.

Privacy changes (Public Act 26-64)

  • Pricing with personal data. Businesses that use personal data to set prices face limits and must disclose it.
  • Facial recognition. Businesses using the technology must post clearly legible signs saying so, with a link or QR code to their facial-recognition policy.
  • Genetic data. Direct-to-consumer genetic-testing companies need consent and must give consumers control over their samples and results.
  • Publicly available information is defined more narrowly, and consumers get wider rights to have profiles built from it deleted.
  • Precise geolocation data may no longer be sold.
  • Data brokers must register with the Department of Consumer Protection by 1 January 2027.

The privacy act's revenue thresholds and industry exemptions still decide whether a business is covered.

AI changes (Public Act 26-15)

  • Employment. Employers must give written notice when AI is used to make decisions affecting employees, and discrimination through AI is treated as employment discrimination. CT Mirror reports that a written framework for automated employment decisions is due by 1 October 2027.
  • Chatbots and minors. Operators must have self-harm detection protocols and parental controls, and may not engage minors in harmful or sexual conversations. CT Mirror reports these rules start on 1 January 2027.

Who is affected

Businesses that serve Connecticut residents and meet the privacy act's thresholds, retailers and venues using facial recognition, ad-tech and data vendors that sell location data, data brokers, employers with Connecticut staff who use AI in hiring or management, and chatbot providers.

What to do

  • Review any dynamic or personalised pricing that uses personal data, and prepare the disclosure.
  • Put up facial-recognition signs with a link to the policy before 1 October.
  • Stop selling precise geolocation data about Connecticut residents, and check what your ad-tech and analytics vendors do with it.
  • Data brokers: prepare the registration for 1 January 2027.
  • HR teams: list where AI touches hiring, promotion or discipline, write the employee notice, and ask your HR-software vendors what they will provide.

Sources

Categories & features

Keep exploring

More on TrustList

Everything here links back to the same verified catalogue. Pick your next stop.