Connecticut PA 26-64: geolocation data sale ban due October 1, 2026

Connecticut Public Act 26-64 (Substitute for S.B. 4, 2026 Reg. Sess.), signed by the Governor on May 27, 2026, applies from October 1, 2026, when four obligations take effect under the act. They are enforced by the Connecticut Attorney General under the Connecticut Unfair Trade Practices Act (CUTPA) and, for data-broker breaches, by the Department of Consumer Protection (DCP) with civil penalties up to USD 200 per day per violation.

Connecticut data brokers and CTDPA controllers selling or licensing personal data, persons doing business in Connecticut who use algorithmic price-setting devices to advertise online, direct-to-consumer genetic-testing companies serving Connecticut consumers, and companies deploying facial-recognition technology in Connecticut must cease the sale, sharing or transfer of consumers' precise geolocation data, disclose algorithmic price-setting and stop consumer-specific surveillance pricing, honor genetic-testing consumer rights and consent duties, and limit facial-recognition use to database matching with prescribed signage by October 1, 2026, or face CUTPA enforcement by the Attorney General and DCP civil penalties.

• Deadline : October 1, 2026 (four obligations due)
• Who : Connecticut data brokers and CTDPA controllers, online advertisers using algorithmic price-setting devices, direct-to-consumer genetic-testing companies, and firms deploying facial-recognition technology in Connecticut
• What : cease sale of precise geolocation data, disclose algorithmic pricing and stop surveillance pricing, honor genetic-testing consumer rights, and limit facial-recognition use to database matching with signage
• Otherwise : CUTPA enforcement by the Connecticut Attorney General (no private right of action); DCP civil penalties up to USD 200 per day per violation for data-broker breaches
• Official source : Public Act 26-64 (CGA)

What is due on October 1, 2026

From October 1, 2026, four obligations under PA 26-64 take effect. Controllers under the CTDPA are prohibited from selling, sharing, transferring or allowing access to consumers' precise geolocation data. Persons doing business in Connecticut who use a price-setting device, an automated process using a consumer's personal data to set a price, to advertise a good or service online must disclose that a device was used, and consumer-specific surveillance pricing, a customized price based on the consumer's personal data, is prohibited. Direct-to-consumer genetic-testing companies must grant consumers a property right and exclusive control over biological samples and results, disclose specified policies, and obtain consent for defined uses. Use of facial-recognition technology is limited to matching still images or video to a database, with prescribed consumer signage and the other CTDPA requirements.

PA 26-64 was signed by the Governor on May 27, 2026 and takes effect on October 1, 2026. Data-broker registration with DCP, fee USD 2,500, opens on January 1, 2027, and the DCP accessible deletion mechanism program is due by July 1, 2028; both fall outside the October 1, 2026 obligations. Senate Amendment A (LCO 4531) removed the automobile-tariff and automated-license-plate-reader contract provisions, so those are not in the enacted act.

Who is covered

The obligations reach four categories of actors by market exposure. Data brokers and CTDPA controllers that sell or license personal data in Connecticut must stop trading in precise geolocation data. The CTDPA layer applies to persons conducting business in Connecticut or targeting Connecticut residents that control or process personal data of at least 100,000 consumers, or at least 25,000 consumers with at least 25 percent of gross revenue from the sale of personal data, excluding data governed by HIPAA, GLBA or FCRA. Persons doing business in Connecticut who use an algorithmic price-setting device to advertise online fall under the disclosure and surveillance-pricing rules. Direct-to-consumer genetic-testing companies serving Connecticut consumers fall under the new property-right and consent duties, and any company deploying facial-recognition technology in Connecticut must limit use to database matching with signage.

What to do before October 1, 2026

• Audit data flows for precise geolocation data and stop its sale, sharing, transfer or access by October 1, 2026.
• Review online advertising pricing logic: if a price-setting device uses consumer personal data, prepare the consumer disclosure and end consumer-specific surveillance pricing.
• For direct-to-consumer genetic-testing services, update policies on biological samples and results, implement the consumer property-right controls, and build the consent workflow for defined uses.
• For facial-recognition deployments, limit use to matching still images or video against a database and install the prescribed consumer signage.
• Register as a data broker with DCP before January 1, 2027 if selling or licensing brokered personal data, fee USD 2,500.
• Brief privacy, ad-tech and product teams on the CUTPA enforcement risk and the DCP penalty regime.

What happens otherwise

Violations are enforced by the Connecticut Attorney General as unfair or deceptive acts under CUTPA, with no private right of action. Data-broker violations carry DCP civil penalties up to USD 200 per day per violation, and the CTDPA-amendment, genetic-testing and streaming-volume violations are deemed CUTPA violations. The sources do not state a separate fine amount for the non-data-broker obligations beyond the CUTPA regime. Continuous, per-jurisdiction real-time monitoring surfaces this kind of change when it publishes.

Follow this topic in real time with a free monitoring job

Sources

• Public Act No. 26-64 (Substitute for S.B. 4, 2026 Reg. Sess.), Connecticut General Assembly