Privacy Law Library

Online Services, Products or Features Offered to Minors (heightened-risk duty of care)

CT Minors Online Services

Children · Location · Artificial intelligence

Requires online services that know or wilfully disregard that users are minors to use reasonable care to avoid a heightened risk of harm to them, document data protection assessments, and limit how minors' data is used. From July 1, 2026 (P.A. 25-113), targeted advertising and sale of minors' data are flatly banned regardless of consent, adult-to-minor unsolicited messaging must be blocked by default, and engagement-maximizing design features are restricted.

Where
Connecticut
Citation
Conn. Gen. Stat. 42-529 to 42-529e (ch. 743jj, part II); enacted by P.A. 23-56, ss. 8-13; amended by P.A. 25-113, ss. 14-18
Status
In force
In force since
2024-10-01
Last amended
2026-07-01
Enforced by
Connecticut Attorney General (solely; Conn. Gen. Stat. 42-529e(a))
People can sue
No
Penalties
CUTPA unfair trade practice enforced solely by the Attorney General, up to $5,000 per wilful violation (42-529e(a); 42-110o). Mandatory notice-and-cure from October 1, 2024 to December 31, 2025; discretionary cure since January 1, 2026 (42-529e(b)-(c)).
Applies to
  • Controllers that offer any online service, product or feature to consumers they actually know, or wilfully disregard, are minors (under 18); no revenue or volume threshold (42-529a)
  • Exempt: government bodies, 501(c)(3)/(4)/(6)/(12) organizations, higher-education institutions, national securities associations, GLBA financial institutions and data, HIPAA covered entities and business associates, tribal governments and air carriers (42-529d(a))

Practices it requires

  • Use reasonable care to avoid any heightened risk of harm to minors caused by the service; compliance with the assessment requirement creates a rebuttable presumption of reasonable care.Conn. Gen. Stat. 42-529a(a)
  • Do not process minors' data for targeted advertising or sale (through 2026-06-30, allowed with consent; from 2026-07-01, prohibited outright), beyond what is reasonably necessary, for undisclosed purposes, or for longer than necessary.Conn. Gen. Stat. 42-529a(b)(1) as amended by P.A. 25-113, s. 15 · From 2026-07-01
  • Collect a minor's precise geolocation only when strictly necessary to provide the service, only for the time necessary, and while showing the minor a signal that collection is occurring.Conn. Gen. Stat. 42-529a(b)(2)
  • Profiling of minors in furtherance of consequential automated decisions requires the minor's consent (parental consent under age 13) and must be reasonably necessary.Conn. Gen. Stat. 42-529a(b)(3) as amended by P.A. 25-113, s. 15 · From 2026-07-01
  • Do not use dark-pattern consent mechanisms; any direct messaging must let minors or parents block unsolicited adult contact, and from 2026-07-01 that blocking must be on by default; do not use design features to significantly increase or extend a minor's use (educational services excepted).Conn. Gen. Stat. 42-529a(c)

Other duties

  • Conduct a data protection assessment for each online service offered to minors covering purpose, categories of minors' data, processing purposes and foreseeable heightened risks; create a plan to mitigate identified risks and give assessments to the Attorney General on request.Conn. Gen. Stat. 42-529b

Sources

Checked against these sources on 2026-09-25 by research agent (Claude), primary sources.

Research reference, not legal advice.