Guide · US state law

CTDPA: Connecticut's law explained for those with ads

Connecticut rewrote its privacy law in 2025 and the changes have applied since July 1, 2026. The visitor threshold dropped a lot, teens gained full protection against targeted advertising and the privacy notice became more demanding. See what this means for a site with ads.

Audit my site for Connecticut Read the guide

✓Based on the law and the Connecticut attorney general's pages
✓Examples designed for sites with AdSense and Ad Manager
✓Read-only scan, no changes to the site

35,000Connecticut consumers per year: the new threshold in effect since July 2026

18age below which sale and targeted advertising are prohibited for teens 13 or older, even with consent

$5,000maximum civil penalty per violation under the state's unfair trade practices law

$85,000amount of the TicketNetwork settlement with the attorney general, announced in July 2025

What it is

A law that started out like Virginia's and got tougher

The Connecticut Data Privacy Act, or CTDPA, was signed on May 10, 2022 and took effect on July 1, 2023. It follows the Virginia and Colorado model: consumer rights, opt-out of targeted advertising, consent for sensitive data and data protection assessments.

Since then, the law has been amended several times. In 2023 it gained rules for consumer health data and for online services offered to minors. In 2025, a major revision passed as SB 1295 lowered the applicability thresholds, expanded sensitive data and toughened the rules for minors. That revision has applied since July 1, 2026.

For a site with ads, the central points are three: the visitor can refuse targeted advertising and the sale of data, the site must honor the browser's automatic opt-out signal since 2025, and teens aged 13 to 17 cannot receive targeted ads.

The law works by opt-out for adults. It does not require permission before showing personalized ads, but the opt-out must be easy, visible and actually work.

Checklist

What you need to meet

They apply to anyone who meets the criteria of the Connecticut law. Check with your legal team whether your site is covered.

Offer an easy-to-find link
Anyone who does targeted advertising or sells data needs an easy-to-access link on the site for the visitor to opt out.
Example
Footer: Do Not Sell or Share My Personal Information
Respect browser opt-out signals
Since January 1, 2025, every covered controller must respect signals such as GPC. The signal must make it possible to tell whether the person lives in Connecticut.
Explain everything in the privacy notice
The notice says which data you process, for what, whether you share it with third parties and how the visitor exercises their rights.
Example
We share browsing data with ad partners for targeted advertising. You can opt out using the link in the footer.
Ask for consent for sensitive data
Before processing sensitive data, such as health or precise location, the site needs the visitor's consent.
Protect minors
For under 16, sale and targeted advertising require prior consent. For online services aimed at under 18, the law prohibits targeted advertising and the sale of data.
Respond on time
Requests get a response within 45 days, with a possible extension of another 45. An appeal gets a written response within 60 days.
Document a risk assessment
Targeted advertising, sale of data, profiling and sensitive data require a data protection assessment before starting.

Pass the opt-out to Google

In the Connecticut section of the GPP string, an opt-out of sale or targeted advertising turns on RDP. In the AdSense tag, RDP can also be turned on for people who opted out.

<!-- AdSense: RDP no bloco de anúncio de quem recusou -->
<ins class="adsbygoogle"
     data-ad-client="ca-pub-XXXXXXXXXXXXXXXX"
     data-ad-slot="1234567890"
     data-restrict-data-processing="1"></ins>

In practice

Right and wrong

WrongThe site has no link, or the link leads to a broken page.
RightThe footer has an opt-out link that works on every page.
WrongThe site reads GPC, but the ads are still personalized.
RightThe site detects GPC and passes the opt-out to partners before the first ad.
WrongThe site uses precise location for ads without asking.
RightThe site asks for consent before using the visitor's precise location.
WrongA service for 15-year-olds shows targeted ads.
RightA service for teenagers shows only ads without targeted advertising.

Official tools

Certified CMPs and official links

Google does not require a certified CMP for Connecticut. Use Google's US states message or a CMP that reads GPC and generates GPP. These are the official links.

Who it applies to

The thresholds got much lower in 2026

The law applies to those who do business in Connecticut or direct products and services to residents of the state. Since July 1, 2026, it is enough to meet one of the criteria below in the prior year.

35,000 consumers

Controlling or processing data of at least 35,000 Connecticut consumers, not counting data used only to complete a payment. Before, the threshold was 100,000.

Any sensitive data

Controlling or processing sensitive consumer data, in any volume, also puts the company within the law.

Any sale of data

Offering personal data for sale, in any volume, also puts the company within the law. Before, you needed 25,000 consumers and more than 25% of revenue coming from sales.

Individual consumers only

The law protects Connecticut residents acting as consumers, and not in a work context.

Definitions

The terms that matter for people who sell ads

Connecticut has one of the longest lists of sensitive data among US states.

Personal data

Information linked, or reasonably linkable, to an identified or identifiable person. De-identified and public data are left out.

Sensitive data

Racial origin, religion, health, disability, sexual orientation, transgender or nonbinary identity, immigration status, documents, financial account logins, neural, genetic and biometric data, children's data and precise location within a 1,750-foot radius.

Sale

Exchanging personal data for money or other value with a third party. Passing data to an ad partner in exchange for a service may fall under this definition.

Targeted advertising

An ad chosen based on data about the person's activities over time on other companies' sites and apps. Contextual ads do not count.

Rights and opt-out

Visitor rights, opt-out link and GPC since 2025

A Connecticut visitor can access their data, including the conclusions drawn from it, correct it, delete it, take a copy, ask for the list of third parties that bought their data and opt out of targeted advertising, sale and high-risk profiling. Since 2026, they can also challenge decisions based on profiling. The company has 45 days to respond and 60 days to respond to an appeal.

Those who do targeted advertising or sell data need a clear, visible link on the site that lets people opt out. The law does not define the exact text, but the link must lead to a simple path, without creating a new account.

Since January 1, 2025, the site must also accept automatic opt-out signals, such as Global Privacy Control, or GPC. The law says the signal must reflect an active choice by the consumer, and not a setting that comes turned on by default, and it must allow the company to know whether the person lives in Connecticut.

If the signal conflicts with a setting the visitor chose earlier on the site, the signal prevails. The site may notify the visitor of the conflict and offer the option to keep the earlier choice. In practice, the CMP should detect GPC and pass the opt-out to ad partners before the first request.

Notice, minors and assessments

The privacy notice got more detailed in 2026

With the 2025 revision, the privacy notice needs a link with the word privacy on the home page, the update date with month and year, the categories of data sold to third parties and a clear explanation of targeted advertising and sale. It must also say whether the data is used to train large language models.

Sensitive data can only be processed with consent. For children under 13, parental consent in the format of the federal COPPA law applies.

For teens aged 13 to 17, the 2025 revision prohibits the sale of data and targeted advertising, even with consent. For online services offered to minors, the law also limits profiling and the collection of precise location.

Targeted advertising, sale of data, sensitive data and high-risk profiling require a documented data protection assessment. For profiling used in important decisions, the 2025 revision also requires an impact assessment for activities started from August 1, 2026.

Timeline

The dates of Connecticut's law

Dates confirmed in the text of the law and on the Connecticut attorney general's pages.

May 10, 2022
Law signed
The CTDPA is signed as Senate Bill 6.
July 1, 2023
Entry into force
The rights, the opt-out and the mandatory 60-day cure period take effect.
January 1, 2025
GPC mandatory and end of the mandatory cure period
The site must accept universal opt-out signals. The chance to cure before an action becomes the attorney general's decision.
July 8, 2025
TicketNetwork settlement
TicketNetwork pays $85,000 for an unreadable privacy notice and request mechanisms that did not work.
July 1, 2026
SB 1295 revision in effect
New thresholds, more sensitive data, a ban on targeted ads for teens aged 13 to 17 and a more complete privacy notice.

Enforcement and fines

Attorney general, public reports and fine per violation

The Connecticut attorney general has exclusive authority to enforce the law. Individuals cannot sue a company under the CTDPA.

Between July 2023 and December 2024, when the failure could be cured, the attorney general had to give notice and allow 60 days for the cure. Since January 1, 2025, that chance became his decision, which takes into account the number of violations, the size of the company, the sensitivity of the data and whether the error was human or technical.

A CTDPA violation is treated as an unfair trade practice. The civil penalty is up to $5,000 per violation, and the attorney general can also seek a court order, restitution and disgorgement of gains.

The office publishes annual enforcement reports. In the settlement announced on July 8, 2025, TicketNetwork paid $85,000 because the privacy notice was hard to read and the paths for exercising rights were broken, even after warnings.

AdSense and Ad Manager

How Google treats Connecticut visitors

AdSense and Ad Manager read the GPP string, the IAB Tech Lab format for privacy signals. For Connecticut, Google accepts the state's own section and the US National section. When the string indicates an opt-out of sale or targeted advertising, Google turns on restricted data processing, or RDP, and starts showing only non-personalized ads.

In the Connecticut section, Google also reads the minors fields. Without consent for the sale or targeted advertising to teens aged 13 to 15, it turns on RDP. For sensitive data of a known child, it applies child treatment. With the 2026 rules, the CMP must reflect that teens aged 13 to 17 cannot receive targeted ads.

The Privacy message for US states, in AdSense and Ad Manager, includes Connecticut. It shows the opt-out link and saves the choice in GPP. Google reminds publishers that legal responsibility lies with the site.

Header bidding, video, pixels and widgets from other companies must also receive the opt-out. Turning off only Google does not solve it.

In practice

What is and is not allowed in Connecticut

Everyday examples from a site with ads and Connecticut visitors.

Allowed

Showing personalized ads to adults, with a visible opt-out link
Treating GPC as an opt-out and notifying the visitor if it conflicts with an earlier choice
Show contextual ads to minors and to people who opted out
Putting a link with the word privacy in the footer of the home page
Dating the policy with the month and year of the last review

Not allowed

Showing targeted ads to a user you know to be between 13 and 17
Ignoring GPC because the visitor did not click on the banner
Leaving the policy without saying which data categories are sold
Keeping rights forms that give an error or reach no one
Processing health data or precise location without consent

Common errors

Failures the attorney general has already pointed out

The reports and the TicketNetwork settlement show that the basics still fail on many sites.

Unreadable notice

A long, confusing policy without Connecticut consumer rights, as in the TicketNetwork case.

Broken form

The rights request link leads to a form that does not submit or to an email nobody reads.

Old thresholds

The company thought it was outside because it had fewer than 100,000 visitors, but the threshold dropped to 35,000 in July 2026.

GPC with no effect

The banner recognizes GPC, but the GPP string sent to ads still lacks the opt-out.

In ConsentMode

What the audit checks about the CTDPA

Opens the site as a Connecticut visitor with GPC off and on and compares the ad requests.
Reads the GPP string and shows whether the Connecticut section or US National indicates the opt-out.
Looks on the home page for a link with the word privacy and a visible opt-out link.
Reads the policy and points out whether the update date, categories sold, targeted advertising and use for training language models are missing.
Identifies the CMP and checks whether the ad tags wait for its response.

Run an audit See everything that is checked

Frequently asked questions about Connecticut's law

My site has 40,000 Connecticut visitors per year. Does the law apply?

Since July 1, 2026, yes, if you control or process data of those visitors, such as cookies and ad identifiers. The threshold dropped from 100,000 to 35,000 consumers.

Do I need a consent banner for Connecticut?

For adults, the law asks for an opt-out, not prior permission. Consent is required for sensitive data, and for teens aged 13 to 17 targeted advertising is prohibited.

How will I know if the visitor is a minor?

The law looks at what the company knows about the visitor's age. If the site asks for age at signup or has content aimed at teens, this must be taken into account in the ad setup.

Is there still a period to cure before a fine?

It has not been mandatory since January 1, 2025. The attorney general may offer that chance, but decides case by case.

Does ConsentMode update my policy?

No. ConsentMode does not change your site. It reads the policy and the signals sent and delivers a report on what is missing and how to fix it.

Library

Official sources

This guide was written from these official pages. Read them directly at the source:

Check your site against the 2026 rules

The audit opens the site as a Connecticut visitor and shows what to fix in the notice and signals, without changing anything.

Start the audit