Connecticut Just Removed Its Privacy Law Warning — Violations Now Cost $5,000

A small landscaping company in Hartford with 40,000 customer records has never worried about privacy law. A boutique fitness studio in New Haven that shares email addresses with a marketing vendor never thought twice either. As of July 1, 2026, both of them are now squarely inside Connecticut's privacy law — and if they mess up, the state doesn't have to warn them first.

Connecticut just finished the biggest expansion of its data privacy law since it passed in 2022. The changes lower the bar for which businesses are covered, widen what counts as sensitive information, and — most importantly for anyone who gets caught off guard — eliminate the grace period businesses used to get before facing fines.

What Actually Changed on July 1

The Connecticut Data Privacy Act (CTDPA) used to apply mainly to larger companies. The original threshold covered businesses that processed the personal data of at least 100,000 Connecticut residents, or 25,000 residents if the business made more than 25% of its revenue from selling personal data.

That threshold just dropped hard. Under the amended law, a business is now covered if it processes the personal data of at least 35,000 Connecticut residents — or the data of just one resident, if the business sells that data. Selling here isn't limited to literal data brokers; sharing data with ad-tech vendors or third parties in exchange for something of value can qualify.

That one change alone is expected to pull tens of thousands of small and mid-sized businesses into the law for the first time — companies that never had to think about privacy compliance because they were considered too small.

Sensitive Data Now Covers More Ground

The amendments also broaden what counts as "sensitive data," which requires opt-in consent before a business can collect or sell it. As of July 1, sensitive data includes:

• Driver's license and state ID numbers
• Passport numbers
• Financial account details
• Social Security numbers
• Precise geolocation and other categories already covered, like health and biometric data

If your business collects any of this — even informally, like scanning a driver's license to verify a customer's age or identity — you now need affirmative opt-in consent, not just a privacy notice buried in your terms of service.

The New AI Disclosure Requirement

Connecticut also added a requirement aimed squarely at the AI boom: businesses must now disclose in their privacy notice whether they use consumers' personal data to train large language models, or whether they sell data for that purpose. If your business uses any customer data to fine-tune a chatbot, personalize a model, or feed an AI tool, this disclosure is no longer optional.

The Part That Should Worry You Most: No More Warning Shot

Here's the change that matters most if you're a small business owner who's never dealt with privacy law before. Connecticut used to give businesses a 60-day cure period — a chance to fix a violation after getting notice from the Attorney General, before facing any penalty. That cure period expired at the end of 2024 and was never renewed.

That means starting now, the Connecticut Attorney General's office can bring an enforcement action immediately, with no requirement to warn you first or give you a chance to fix the problem. For a business that's newly covered by the law and doesn't even know it yet, that's a real risk.

The penalties themselves aren't small: up to $5,000 per willful violation and up to $2,500 per non-willful violation. There's no private right of action, meaning individual consumers can't sue you directly — only the Attorney General can bring a case. But that also means enforcement is concentrated in one office that has already shown it's paying attention; Attorney General William Tong's office has released public reports tracking compliance trends across Connecticut businesses.

Do You Actually Have to Worry About This?

If your business is a Connecticut LLC, corporation, or sole proprietorship — or you're based elsewhere but have customers in Connecticut — run the numbers. Add up how many unique Connecticut residents are in your customer database, email list, loyalty program, or point-of-sale system. If you're anywhere near 35,000, or if you share customer data with any third-party vendor for compensation, you're likely covered.

This is also a good moment to double check your basic business structure is set up to handle liability like this in the first place. If you haven't formalized your business through LLC formation, a compliance misstep like this hits you personally instead of the business. And if you're deciding between structures, our LLC vs. S corp comparison walks through how liability protection differs.

What to Do Before the Attorney General Comes Looking

You don't need a law firm on retainer to get ahead of this, but you do need to move with some urgency given there's no cure period anymore.

• Audit what you collect. List every place your business gathers customer data — website forms, point-of-sale systems, loyalty apps, email signups — and estimate how many unique Connecticut residents are represented.
• Check your vendor contracts. If you share data with a marketing platform, ad network, or SaaS tool in exchange for services or discounts, that may count as a "sale" under the law's broad definition.
• Update your privacy notice. Make sure it discloses AI/LLM data use (even if the answer is "we don't do this"), and that it reflects the expanded sensitive data categories.
• Get opt-in consent for sensitive data. If you collect IDs, passport numbers, or financial details, don't rely on a blanket terms-of-service checkbox — the law requires affirmative, specific consent.
• Talk to your insurance broker. Cyber and privacy liability coverage, often bundled into a broader business insurance policy, can help offset the cost of an enforcement action or a data breach investigation.

Connecticut isn't alone in tightening its privacy rules this year — Arkansas and Utah both made similar changes effective around the same time. If you do business across state lines, the safest assumption is that "too small to matter" no longer applies anywhere.

The Bottom Line

Connecticut's privacy law used to be something only larger companies needed to track. That's no longer true. The threshold drop, the expanded sensitive data categories, and — above all — the disappearance of the cure period mean a routine oversight can now turn into a fine with zero warning. If your business touches Connecticut customer data in any meaningful volume, this is the week to check your exposure, not the month after an Attorney General letter arrives.

Photo by Deng Xiang on Unsplash