Connecticut Ctdpa

Connecticut Data Privacy Act (CTDPA)

Overview

The Connecticut Data Privacy Act (CTDPA), codified as Conn. Gen. Stat. §42-515 through §42-525, was signed into law on May 10, 2022 (SB 6), and became effective July 1, 2023. Connecticut was the fifth state to enact comprehensive consumer privacy legislation. The CTDPA is notable for its explicit prohibition on dark patterns in obtaining consent, its bona fide loyalty program exemption, and its requirement to recognize universal opt-out mechanisms (effective January 1, 2025).

Applicability (§42-516)

The CTDPA applies to persons that conduct business in Connecticut or produce products or services targeted to Connecticut residents AND during the preceding calendar year:

1. Controlled or processed personal data of at least 100,000 Connecticut consumers (excluding data processed solely for payment transactions); OR
2. Controlled or processed personal data of at least 25,000 Connecticut consumers AND derived more than 25% of gross revenue from the sale of personal data.

Note: The 25% revenue threshold is lower than Virginia's 50% and mirrors no specific percentage in Colorado.

Exemptions: State/local government, GLBA institutions (entity-level), HIPAA covered entities/BAs (entity-level), nonprofits, higher education institutions, and data governed by certain federal statutes.

Liberty Commerce Inc. Assessment: Liberty Commerce Inc. processes personal data of approximately 87,000 Connecticut consumers. With 12% advertising revenue from data sale activities, it does not meet threshold (2). However, excluding payment-only transactions, the consumer count exceeds the threshold under a conservative reading. Liberty Commerce Inc. treats itself as subject to the CTDPA.

Consumer Rights (§42-520)

Six Consumer Rights

1. Right to Access (§42-520(a)(1)): Confirm processing and access personal data
2. Right to Correct (§42-520(a)(2)): Correct inaccuracies
3. Right to Delete (§42-520(a)(3)): Delete personal data
4. Right to Portability (§42-520(a)(4)): Obtain data in portable, readily usable format
5. Right to Opt Out (§42-520(a)(5)): Opt out of:
   • Targeted advertising
   • Sale of personal data
   • Profiling in furtherance of decisions producing legal or similarly significant effects
6. Right to Appeal (§42-520(f)): Appeal a denial of any rights request

Response Requirements (§42-520(b)-(e))

• Respond within 45 days of receipt
• Extension: up to 45 additional days with notice
• At least one free response per 12 months per right
• Appeal: controller must respond within 60 days

Dark Pattern Prohibition (§42-515(8), §42-518(a)(5))

The CTDPA explicitly defines and prohibits dark patterns in the context of obtaining consumer consent. A "dark pattern" is defined as:

"A user interface designed or manipulated with the substantial effect of subverting or impairing user autonomy, decision-making or choice, and includes, but is not limited to, any practice the Federal Trade Commission refers to as a 'dark pattern'."

Implications

• Consent obtained through dark patterns is not valid consent under the CTDPA
• Applies to consent for sensitive data processing (§42-518(a)(5))
• Applies to consent for processing children's data
• Any consent mechanism that uses confusing language, hidden options, visual manipulation, or other deceptive practices is invalid

Dark Pattern Examples (per FTC guidance and CTDPA legislative history)

Liberty Commerce Inc. Implementation: Liberty Commerce Inc. has conducted a dark pattern audit of all consent interfaces. Consent buttons use equal visual weight (same size, same font, same color prominence). "Accept" and "Decline" options are presented side by side. Language is affirmative and clear. No confirm-shaming language is used.