Privacy Law Library

Consumer Health Data Privacy (CTDPA consumer health data provisions)

CT Consumer Health Data

Health · Location

P.A. 23-56 added 'consumer health data' (including reproductive, sexual and gender-affirming health data) to the CTDPA as sensitive data and imposed threshold-free duties on anyone handling it. It bars selling consumer health data without consent and bans geofences within 1,750 feet of mental health or reproductive or sexual health facilities used to track or message consumers about their health data.

Where
Connecticut
Citation
Conn. Gen. Stat. 42-526; 42-515(9)-(10); 42-520(a) (sensitive data consent); enacted by P.A. 23-56, ss. 1-2
Status
In force
In force since
2023-10-01
Last amended
2026-07-01
Enforced by
Connecticut Attorney General (exclusive; Conn. Gen. Stat. 42-525(a))
People can sue
No
Penalties
CUTPA unfair trade practice enforced solely by the Attorney General; up to $5,000 per wilful violation (42-525(e); 42-110o). The mandatory 60-day cure period for consumer health data controllers ran October 1, 2023 to December 31, 2024 (42-525(b)(2)).
Applies to
  • Any person doing business in Connecticut or producing products or services targeted to residents, with no revenue or volume threshold, for consumer health data (42-526(a)(2))
  • Exempt: state and municipal bodies and their contractors processing health data for them, institutions of higher education, national securities associations, GLBA financial institutions, HIPAA covered entities and business associates, tribal governments and air carriers (42-526(b)); nonprofits are NOT exempt from 42-526

Practices it requires

  • Do not sell or offer to sell consumer health data without first obtaining the consumer's consent.Conn. Gen. Stat. 42-526(a)(1)(D)
  • Do not use a geofence within 1,750 feet of a mental health facility or reproductive or sexual health facility to identify, track, collect data from, or send notifications to consumers about their health data.Conn. Gen. Stat. 42-526(a)(1)(C)
  • Give processors access to consumer health data only under a CTDPA-compliant processor contract.Conn. Gen. Stat. 42-526(a)(1)(B)
  • Consumer health data is sensitive data, so its processing requires the consumer's consent under the CTDPA.Conn. Gen. Stat. 42-515 (sensitive data); 42-520(a)

Security duties

  • Give employees or contractors access to consumer health data only if they owe a contractual or statutory duty of confidentiality.Conn. Gen. Stat. 42-526(a)(1)(A)

Sources

Checked against these sources on 2026-09-25 by research agent (Claude), primary sources.

Unverified: P.A. 25-113 redefined 'consumer health data' in 42-515 effective 2026-07-01; the exact new wording was not reviewed.

Research reference, not legal advice.