Connecticut Data Privacy Act Amendments of 2025: Key AI-Related Rights and Obligations
The Connecticut Data Privacy Act (CTDPA) underwent significant amendments in 2025 through Senate Bill 1295, introducing rights specifically addressing automated decision-making and profiling. These changes, effective July 1, 2026, position Connecticut as a leader among U.S. states in regulating AI-driven data processing practices. The amendments expand consumer protections by granting individuals the right to contest automated decisions and challenge profiling results, ensuring greater transparency and accountability in AI systems.
The CTDPA originally took effect on July 1, 2023, as Senate Bill 6, establishing baseline data privacy rights for Connecticut residents. These updates align with broader trends in global privacy regulation, where automated decision-making and profiling are increasingly scrutinized for their potential to reinforce biases or infringe on individual autonomy.
Scope of the Amended CTDPA: Who Must Comply?
The CTDPA applies to businesses operating in Connecticut or targeting Connecticut residents, with specific thresholds determining coverage.
- Control or process the personal data of at least 35,000 consumers (excluding data used solely for payment transactions),
- Control or process sensitive personal data (excluding payment transaction data), or
Unlike other provisions, the CTDPA imposes no size or volume exemptions for Consumer Health Data Controllers, meaning any entity processing health-related data—including nonprofits—must adhere to the law. This broad applicability reflects Connecticut’s emphasis on protecting sensitive health information, particularly in light of AI’s growing role in diagnostics, treatment recommendations, and predictive analytics.
Processors are legally bound by contractual obligations to controllers and may not independently decide how data is used. Violations of these roles—such as a processor assuming controller-like authority—trigger full compliance obligations under the CTDPA.
New Rights for Connecticut Residents: Contesting AI Decisions and Profiling
The 2025 amendments introduce two critical rights for consumers interacting with AI systems:
- Right to Contest Automated Decisions: Consumers can challenge decisions made solely by automated means, including those involving algorithms, machine learning models, or other AI-driven processes.
These rights are exercisable through the same mechanisms as other CTDPA consumer rights, such as accessing personal data, correcting inaccuracies, or deleting information. However, the amendments clarify that controllers must provide meaningful explanations for automated decisions and profiling results upon request, ensuring transparency in AI-driven processes.
Exemptions and Compliance Considerations for Businesses
While the CTDPA’s scope is broad, certain entities are exempt from full compliance obligations, though with critical exceptions:
- Nonprofit Organizations: Generally exempt from CTDPA provisions, except for those handling Consumer Health Data, which remain fully subject to the law.
- Financial Institutions: Covered under the Gramm-Leach-Bliley Act (GLBA), Health Insurance Portability and Accountability Act (HIPAA), or other federal regulations may still face CTDPA requirements if they process data beyond these frameworks.
For instance, processing neural data—such as brainwave patterns collected via wearable devices—requires explicit consumer consent, reflecting Connecticut’s proactive stance on emerging biometric and neurotechnological risks.
Practical Implications for AI Developers and Deployers
- Connecticut’s focus on profiling and automated decisions suggests that proactive fairness assessments will be critical to avoiding enforcement actions.
- Consumer Request Handling: Controllers must establish clear processes for receiving and responding to consumer requests related to automated decisions and profiling. This includes maintaining records of such requests and providing timely, accessible responses—potentially within 45 days of receipt, as outlined in the original CTDPA framework.
Organizations processing Connecticut residents’ data—even if headquartered elsewhere—must align with CTDPA requirements, particularly if their AI models produce decisions or profiles subject to contestation.
Enforcement and Future Outlook
The law’s effectiveness will depend on its alignment with other state and federal privacy frameworks, particularly as AI regulation evolves.
Looking ahead, the CTDPA’s amendments signal a trend toward AI-specific privacy regulations in the U.S., where traditional data protection laws often lack teeth in addressing algorithmic risks. Organizations operating in the state should prioritize compliance with these new rights, particularly in designing, deploying, and monitoring AI-driven processes.
Required actions
- Provide opt-outs from profiling for significant decisions and, from July 2026, rights to question the result of profiling and contest automated decisions - Conduct data protection assessments and comply with duties of care for minors, including limits on addictive design