Connecticut Data Privacy Act (CTDPA) Compliance Guide

CTDPA compliance requires transparent notice, consumer rights operations, and consent controls for sensitive data and targeted advertising in Connecticut.

This page is designed for privacy, legal, security, and engineering teams implementing controls in production systems.

Key Legal Requirements

• • Provide clear privacy notice and rights mechanisms
• • Support rights to access, correction, deletion, and portability
• • Offer opt-out for targeted advertising, sale, and profiling
• • Require consent for sensitive personal data processing

• • Controllers processing Connecticut resident data at statutory scale
• • Organizations monetizing or profiling Connecticut resident data
• • Businesses relying on sensitive data that require consent controls

• • Capture explicit consent for sensitive data use cases
• • Record consent metadata and policy versions
• • Enable revocation workflows and downstream suppression

Cookie Governance Implications

• • Targeting and profiling cookies must honor opt-out controls
• • Category mapping should distinguish essential and non-essential tracking
• • Continuous scan coverage reduces post-release consent regressions

• • Authenticate and fulfill consumer rights requests
• • Maintain appeal process for denied requests
• • Track request outcomes and operational response timing

Exposure: Enforcement occurs under Connecticut consumer protection authority with potential penalties and mandated remediation.

Enforcement Authority: Connecticut Attorney General

• • Maintaining consistent opt-out enforcement across fragmented tag environments
• • Operationalizing appeal workflows with legal review gates
• • Managing overlapping obligations with other US state privacy laws

• • Automates CTDPA preference routing for cookies and downstream activations
• • Provides DSAR and appeal workflow visibility for operations teams
• • Unifies multi-state control mapping to reduce engineering overhead