Connecticut Cut Its Privacy Law Threshold to 35,000 — Is Your Business Now Covered?

If your business collects customer emails, runs a loyalty program, or tracks website visitors — and you have customers in Connecticut — a law that took effect on July 1, 2026 may have just pulled you into a compliance regime you've never had to think about before. The Connecticut Data Privacy Act (CTDPA) just got a lot broader, and the businesses most likely to be caught off guard are small and mid-sized companies that assumed privacy law was a "big tech" problem.

The Threshold Just Dropped by Two-Thirds

Before July 1, the CTDPA only applied to businesses that controlled or processed the personal data of at least 100,000 Connecticut residents in a calendar year. That number excluded most small businesses by design. As of July 1, 2026, that threshold fell to just 35,000 residents — an amendment that legal analysts say pulls tens of thousands of small and mid-sized businesses into the law's scope for the first time.

To put that in perspective: 35,000 customer records is a number an active regional e-commerce store, a multi-location service business, or a growing SaaS company could hit without ever thinking of itself as a "data company." If you run email marketing campaigns, operate a customer rewards app, or use website analytics and retargeting pixels, you may be counting Connecticut residents in that pool without realizing it.

You Don't Even Need to Hit the Threshold in Two Cases

The volume threshold isn't the only way in. Connecticut regulators say a business is covered regardless of size if it does either of the following:

• Sells personal data of Connecticut residents — even just one resident's data qualifies, aside from a narrow payment-processing exception.
• Processes "sensitive data" belonging to Connecticut residents, at any volume.

That second point matters more than it might seem, because Connecticut also just expanded what counts as sensitive data.

What Counts as "Sensitive Data" Just Got Bigger

The July 2026 amendments add several new categories to the CTDPA's definition of sensitive personal data, including:

• Disability and medical information
• Transgender or nonbinary status
• Neural data (information generated by neurotechnology, such as wellness or biometric wearables)
• Financial account details
• Government-issued identification numbers

Any business processing this type of information about Connecticut residents is now covered by the CTDPA no matter how small it is. A local healthcare-adjacent business, a wellness app, a financial services shop, or even an HR platform that stores employee ID numbers could be swept in through this door alone.

The AI Disclosure Requirement Nobody's Talking About

Buried in the amendments is a requirement that's likely to catch even privacy-conscious businesses off guard: covered businesses must now disclose in their privacy notices whether they use consumers' personal data to train large language models, or whether they sell that data for that purpose. If your business uses any AI tool that ingests customer data — even a customer service chatbot or an analytics platform with AI features — you need to understand what that vendor does with the data and reflect it accurately in your own privacy notice.

Why the Timing Is So Risky

Connecticut used to give businesses a 60-day "cure period" to fix violations before facing enforcement. That grace period expired for good in December 2024. That means any business newly pulled into scope by the July 1 threshold change faces immediate enforcement exposure — there's no warning shot. If the Connecticut Attorney General's office finds a violation, the business is already exposed, not given a chance to quietly fix it first.

This is a meaningfully different risk profile than many owners are used to. A business that was fully compliant with data laws on June 30 could be in violation on July 2 simply because its customer count crossed 35,000 — with no cure period to fall back on.

What Small Business Owners Should Do Now

1. Count Your Connecticut Records

Pull a rough count of how many Connecticut residents are in your customer database, email list, or app user base. If you're anywhere near 35,000, or if you sell any data or handle sensitive categories, assume you're covered.

2. Update Your Privacy Notice

Make sure your privacy notice discloses what data you collect, whether you sell it, and — critically — whether any of it is used to train AI models. Vague or outdated privacy notices are one of the easiest things for regulators to flag.

3. Review Vendor and AI Tool Contracts

If you use third-party tools that process customer data — email platforms, CRM software, AI chatbots, ad pixels — check their data-handling terms. You're responsible for how your vendors handle your customers' data, not just how you handle it directly.

4. Loop In Your Business Structure and Insurance

Privacy violations can carry real financial exposure, which is worth factoring into how you think about business insurance coverage, especially if you haven't reviewed your policy since scaling up your customer base. Businesses that are still choosing between structures should also understand how liability exposure differs by entity when working through LLC formation.

You Don't Have to Be Based in Connecticut

One detail trips up a lot of owners: the CTDPA doesn't care where your business is headquartered. It applies based on whose data you're processing, not where your office is. A business based in Ohio, Texas, or anywhere else that sells online and has 35,000 or more Connecticut customers — or that handles sensitive data belonging to any Connecticut resident — is covered just the same as a business physically located in Hartford or New Haven. If you sell nationally through an online store, a subscription service, or an app, you can't assume this law is a "Connecticut business" problem.

A Realistic Example

Consider a regional online retailer based in another state that ships nationwide and runs an email marketing list of 400,000 subscribers. If even 35,000 of those subscribers list a Connecticut address, the retailer is now covered by the CTDPA — required to honor consumer rights requests (access, correction, deletion, opt-out of targeted advertising), maintain a compliant privacy notice, and disclose any AI training use of that data. Before July 1, this same retailer would have needed 100,000 Connecticut subscribers to trigger the same obligations. Nothing about the business changed; the law simply moved the goalposts.

How Connecticut Compares to Other States Right Now

Connecticut isn't legislating in isolation. Arkansas and Utah both updated their own privacy laws effective the same week in July 2026 — Arkansas banning targeted-advertising tracking of anyone under 16, and Utah granting residents a new right to correct inaccurate data held about them. None of these changes are identical, which is exactly the problem for a multi-state business: a compliance program built around one state's rules won't automatically satisfy another's. Owners operating across state lines should treat 2026 as the year to build a single, defensible privacy program rather than patching compliance state by state as thresholds keep moving.

The Bottom Line

The takeaway for small business owners isn't panic — it's a quick audit. A business that was too small to worry about privacy law a year ago may not be too small anymore, and Connecticut just proved how fast that line can move.

Photo by Deng Xiang on Unsplash