Data Broker Registration and Accessible Deletion Mechanism (P.A. 26-64, ss. 1-10)

CT Data Broker Registry

Data brokers

Creates Connecticut's first data broker registry: from January 1, 2027 no data broker may sell or license brokered personal data in the state unless registered with the Department of Consumer Protection. By July 1, 2028 the Department must launch a one-stop deletion mechanism, and from August 2028 registered brokers must check it at least every 45 days and delete participating consumers' data.

Where: Connecticut
Citation: P.A. 26-64, ss. 1-10 (not yet codified as of the 2026 Supplement)
Status: Enacted, not yet in force
In force since: 2026-10-01
Enforced by: Connecticut Department of Consumer Protection (Commissioner of Consumer Protection)
People can sue: No
Penalties: After notice and hearing, the Commissioner of Consumer Protection may impose a civil penalty of up to $200 per day for each violation of ss. 2-8 (s. 10). Registration fee $2,500 per year (s. 2(b)).
Applies to: Data brokers: businesses (or portions of businesses) that sell or license 'brokered personal data' (name, address, birth date or place, mother's maiden name, biometric identifiers, family members' names or addresses, SSN or government ID, or other identifying information categorized for sale) to another person (s. 1(3), (7))
Exempt: FCRA-regulated consumer reporting activity, GLBA-regulated activity, businesses collecting data about their own customers, investors or donors and their service providers, 21 USC 830 chemical-regulation data, political committees, and others listed in s. 7

What a privacy notice must say

Post annual public statistics on deletion requests received and how they were handled, beginning July 1, 2029.P.A. 26-64, s. 6 · From 2029-07-01

Rights it gives people

Consumers may submit one free, verified deletion request through a state-run accessible deletion mechanism to all registered data brokers (with the option to exclude specific brokers); the Department must establish it by July 1, 2028.P.A. 26-64, s. 5(a) · From 2028-07-01

Practices it requires

Do not sell or license any personal data in violation of the data broker provisions or the CTDPA, and maintain a privacy policy with measures to ensure compliance.P.A. 26-64, s. 3
Access the deletion mechanism at least every 45 days, delete verified requesters' data and direct service providers to delete it, treat unverified requests as sale opt-outs, and not maintain or use later-acquired data about participating consumers.P.A. 26-64, s. 5(c) · From 2028-10-01

Registration

Register annually with the Department of Consumer Protection (fee $2,500) before selling or licensing brokered personal data in Connecticut on or after January 1, 2027, disclosing contact and other information the application requires.P.A. 26-64, s. 2(a)-(c) · From 2027-01-01

Sources

Checked against these sources on 2026-09-25 by research agent (Claude), primary sources.

Unverified: Section 5(b)-(c) contain several different start dates (August 15, 2028 and October 1, 2028); summarized from the enrolled act text only. | Whether DCP has published registration forms or regulations under s. 9 was not checked.

Research reference, not legal advice.