Connecticut’s new AI and data-privacy rules take effect on 1 October; data brokers must register by 1 January

Connecticut's new AI and data-privacy rules take effect on 1 October; data brokers must register by 1 January

28 September 2026: Two Connecticut laws enacted in May 2026 bring new rights and obligations into force on 1 October 2026. Public Act 26-64 amends the Connecticut Data Privacy Act, and Public Act 26-15 covers artificial intelligence in employment and chatbots. Attorney General William Tong, whose office enforces most of them, set out what changes in a notice of 16 September; CT Mirror summarised the laws for businesses on 28 September.

Privacy changes (Public Act 26-64)

• Pricing with personal data. Businesses that use personal data to set prices face limits and must disclose it.
• Facial recognition. Businesses using the technology must post clearly legible signs saying so, with a link or QR code to their facial-recognition policy.
• Genetic data. Direct-to-consumer genetic-testing companies need consent and must give consumers control over their samples and results.
• Publicly available information is defined more narrowly, and consumers get wider rights to have profiles built from it deleted.
• Precise geolocation data may no longer be sold.
• Data brokers must register with the Department of Consumer Protection by 1 January 2027.

The privacy act's revenue thresholds and industry exemptions still decide whether a business is covered.

AI changes (Public Act 26-15)

• Employment. Employers must give written notice when AI is used to make decisions affecting employees, and discrimination through AI is treated as employment discrimination. CT Mirror reports that a written framework for automated employment decisions is due by 1 October 2027.
• Chatbots and minors. Operators must have self-harm detection protocols and parental controls, and may not engage minors in harmful or sexual conversations. CT Mirror reports these rules start on 1 January 2027.

Who is affected

Businesses that serve Connecticut residents and meet the privacy act's thresholds, retailers and venues using facial recognition, ad-tech and data vendors that sell location data, data brokers, employers with Connecticut staff who use AI in hiring or management, and chatbot providers.

What to do

• Review any dynamic or personalised pricing that uses personal data, and prepare the disclosure.
• Put up facial-recognition signs with a link to the policy before 1 October.
• Stop selling precise geolocation data about Connecticut residents, and check what your ad-tech and analytics vendors do with it.
• Data brokers: prepare the registration for 1 January 2027.
• HR teams: list where AI touches hiring, promotion or discipline, write the employee notice, and ask your HR-software vendors what they will provide.

Related on TrustList:

• California widens the right to delete: from 1 January, businesses must also delete data they bought and offer a webform
• What North American governments asked of software buyers this autumn
• Consultations closing in October: Brazil’s ANPD sanctions rules (26 October), Anatel’s 6 GHz auction with data-centre duties, and Paraguay’s telecoms plan (15 October)

Sources

• Connecticut Attorney General: Rights and Requirements Related to New and Updated Privacy Laws - 16 September 2026
• CT Mirror: New CT AI, data privacy laws go into effect Oct. 1. What to know - 28 September 2026