Connecticut Consumer Data Privacy and Data Broker Act (SB 4, 2026)

Status: Signed into law by Governor Ned Lamont as Public Act No. 26-64 (SB 4, 2026 Regular Session). The Connecticut General Assembly gave the bill final passage in early May 2026, and the Governor signed it alongside the companion AI law (SB 5 / Public Act 26-15). SB 4 is the most significant expansion of the Connecticut Data Privacy Act since its original enactment.

Citation: Connecticut Public Act No. 26-64 (SB 4, 2026) — amends the Connecticut Data Privacy Act (CTDPA) and adds new data broker, surveillance-pricing, facial-recognition, genetic-data, and geolocation provisions.

Jurisdiction: Connecticut

Category: Privacy & Biometrics, Consumer Data Protection, Data Broker Regulation, Surveillance Pricing

Industries: Retail, Hospitality, Data Brokers, Consumer-Facing Technology, and any commercial establishment in Connecticut deploying facial recognition or customer-tracking technology

Enacted Date: 2026 (Public Act No. 26-64)

Effective Date: Phased — October 1, 2026 (CTDPA amendments, surveillance-pricing disclosure, facial-recognition signage, genetic-data protections, and the precise-geolocation sale ban); January 1, 2027 (data broker registration requirements).

Summary: SB 4 is an omnibus consumer-privacy statute that broadens the Connecticut Data Privacy Act and layers several new obligations on top of it. The law (1) establishes a state data broker registry with the Department of Consumer Protection and an accessible consumer deletion mechanism; (2) restricts “surveillance pricing” — the use of personal data to set individualized prices — and imposes related disclosure duties; (3) bans the sale of consumers’ precise geolocation data; (4) adds protections for genetic data and direct-to-consumer genetic testing; and (5) imposes new disclosure and signage duties on businesses that deploy facial recognition technology. Together with the companion AI law (SB 5 / Public Act 26-15), SB 4 makes Connecticut one of the most demanding consumer-data-protection environments in the country for 2026.

Key Provisions:

• Data Broker Registry & Deletion: Data brokers must register with the Connecticut Department of Consumer Protection, and the state must provide an accessible mechanism for consumers to request deletion of their data across registered brokers (registration effective January 1, 2027).
• Facial-Recognition Signage Duties: Businesses deploying facial recognition technology face new disclosure and signage obligations so that individuals are notified when facial recognition is in use.
• Surveillance-Pricing Limits: New restrictions and disclosure requirements apply to the use of personal data — including behavioral and location signals — to set individualized or “personalized” prices.
• Precise-Geolocation Sale Ban: Prohibits the sale of consumers’ precise geolocation data.
• Genetic-Data Protections: Adds requirements for direct-to-consumer genetic testing companies and strengthens protections for genetic information.
• CTDPA Expansion: Broadens the substantive obligations of the underlying Connecticut Data Privacy Act, enforced by the Connecticut Attorney General; no private right of action.

Affected Entities: Data brokers operating in Connecticut; retailers and commercial establishments that deploy facial recognition or customer-tracking technology; companies that use personal data for individualized pricing; direct-to-consumer genetic testing companies; and any business that collects, sells, or processes Connecticut residents’ personal data above the CTDPA thresholds.

IntelliSee Relevance: Adjacent. SB 4 concentrates its new duties on the data practices IntelliSee deliberately avoids: facial recognition, biometric identification, the sale of personal and geolocation data, and individualized pricing built on consumer surveillance. IntelliSee’s AI safety analytics use no facial recognition and no biometric identification; the platform detects visible safety events — a brandished firearm, a fall, an aggressive-behavior pattern, or unauthorized access — and alerts responders without identifying who anyone is, without building consumer profiles, and without selling data. The new facial-recognition signage duties in SB 4 underscore the regulatory line IntelliSee already sits on the favored side of: businesses that identify or track individuals take on disclosure obligations, while security-purpose, non-identifying video analytics do not collect a biometric identifier in the first place. For Connecticut retail, hospitality, healthcare, K-12, higher education, and commercial real estate security leaders, SB 4 is a marker of where privacy scrutiny is heading — and a reason to favor safety analytics that never collect a biometric identifier. See the State-by-State AI Security Legislation Tracker for the full Connecticut regulatory context.

Compliance Timeline

• Early May 2026 — Connecticut General Assembly gives SB 4 final passage.
• 2026 — Governor Lamont signs SB 4 into law as Public Act No. 26-64.
• October 1, 2026 — CTDPA amendments, surveillance-pricing disclosure, facial-recognition signage duties, genetic-data protections, and the precise-geolocation sale ban take effect.
• January 1, 2027 — Data broker registration requirements take effect.

Related Legislation & Resources

• Connecticut Artificial Intelligence Responsibility and Transparency Act (SB 5, 2026)
• California Data Broker Disclosure Expansion (SB 361, 2026)
• New York Retailer Biometric Tracking Disclosure Act (S2539, 2026)
• Virginia Facial Recognition Restrictions (2026 amendments)
• Colorado AI Act Repeal and Replace (SB 26-189, 2026)
• State-by-State AI Security Legislation: Q2 2026 Tracker
• IntelliSee AI Gun Detection

Sources: Connecticut General Assembly — SB 4 (2026) bill status and text; Connecticut Public Act No. 26-64. Provision summaries corroborated by Future of Privacy Forum, Hunton, Benesch, and Inside Privacy analyses of the enacted law (2026).