Connecticut's new privacy protections include a ban on selling consumers' precise location data, expanded deletion rights and requirements for businesses that use facial recognition, according to guidance from Attorney General William Tong.
The changes under Public Act 26-64 took effect Oct. 1. Tong's office said businesses using facial recognition on their premises must provide readable notices and a link or QR code directing consumers to their facial recognition policy.
The law also places limits and disclosure requirements on the use of personal information to set prices. Direct-to-consumer genetic testing companies face consent obligations governing samples and test results.
A separate data broker registration requirement has a Jan. 1, 2027 deadline, the guidance says.
How consumers can use their rights
The attorney general's Data Privacy Act guide says a covered business must explain in its privacy notice how people can request access, correction or deletion of their data. Consumers also have rights to opt out of data sales and targeted advertising.
Coverage has limits. The guide lists exemptions for certain entities and data already governed by other laws, including financial and health information. The new rules do not mean every business is covered by the Data Privacy Act.
A consumer whose request is denied may appeal to the business. If the appeal is denied, the business must provide information on contacting the attorney general.