Connecticut's privacy law lets you ask data brokers to delete your data, including public-record profiles since October 2026

If you live in Connecticut, the Connecticut Data Privacy Act (CTDPA) says a consumer "shall have the right to" "delete" "personal data provided by, or obtained about, the consumer." You send the request through the method in the company's privacy notice. The statute gives the company 45 days to respond, one 45-day extension, and 60 days to answer an appeal. Only the Attorney General can enforce it. Two things have limited what this does for data broker and people-search listings: the law only applies to companies that meet its applicability test, and its definition of personal data excludes "publicly available information," which is what people-search sites say their profiles are made of. Since October 1, 2026, the deletion right also names publicly available information that is "collated and combined to create a consumer profile." A Connecticut data broker registry starts on January 1, 2027, and a single-request deletion tool is due by July 1, 2028; neither exists yet. This guide quotes the statute, shows how to send a request, and reports what the Attorney General has done with the law so far.

What the CTDPA lets you ask for

The CTDPA is Public Act 22-15, effective July 1, 2023, codified at Connecticut General Statutes sections 42-515 to 42-526. It has been amended twice since: Public Act 25-113, effective July 1, 2026, and Public Act 26-64, effective October 1, 2026. The Attorney General's FAQ says it protects "a Connecticut resident acting in an individual or household context," not "an individual acting in an employment context."

Section 42-518(a), as rewritten by Public Act 26-64, lists seven things a consumer "shall have the right to." The first five: confirm processing and access the data; "correct inaccuracies"; delete; obtain a portable copy; and opt out of "targeted advertising," "the sale of personal data," and certain automated profiling. The deletion item now reads: delete "(A) personal data provided by, or obtained about, the consumer, (B) publicly available information that is (i) collated and combined to create a consumer profile that is made available to a user of a publicly accessible Internet web site for compensation or free of charge, or (ii) made available for sale, or (C) any inference generated from" that information.

The words "or obtained about" matter for data brokers, which never got your data from you. The Attorney General's February 2024 report says the Office "advocated for the inclusion of this specific language in order to ensure that data brokers are appropriately covered under the law." Section 42-518(c)(5) lets a company that obtained your data elsewhere comply by "retaining a record of the deletion request and the minimum data necessary" to keep you deleted, which in plain terms is a suppression record.

How to send a request

Find the method. Section 42-518(b) says a consumer "may exercise rights under this section by a secure and reliable means established by the controller and described to the consumer in the controller's privacy notice." Section 42-520 adds that a controller "shall not require a consumer to create a new account" to do so. Start at the privacy notice: a state-rights section, a form, or an email address.

Expect an identity check. Section 42-518(c)(4) says a controller that "is unable to authenticate a request" for deletion "using commercially reasonable efforts" does not have to act and must tell you what additional information it needs. The same subsection says a controller "shall not be required to authenticate an opt-out request."

The clock. Section 42-518(c)(1): "A controller shall respond to the consumer without undue delay, but not later than forty-five days after receipt of the request." It "may extend the response period by forty-five additional days when reasonably necessary," but only if it "informs the consumer of any such extension within the initial forty-five-day response period" and of the reason.

Cost. Section 42-518(c)(3): a response "shall be provided by a controller, free of charge, once per consumer during any twelve-month period." For "manifestly unfounded, excessive or repetitive" requests the controller may charge a reasonable fee or decline, and "bears the burden of demonstrating" that.

Denial and appeal. If a controller declines, it must tell you within 45 days "of the justification for declining to take action and instructions for how to appeal the decision." Section 42-518(d): "Not later than sixty days after receipt of an appeal, a controller shall inform the consumer in writing of any action taken or not taken," with "a written explanation of the reasons." If the appeal is denied, the controller must also give you a "method through which the consumer may contact the Attorney General to submit a complaint."

Complaining to the Attorney General. Use the AG's complaint form and choose "Consumer Data Privacy" as the subject. The 2024 report says the Office "does not represent private individuals" but seeks "to resolve consumer complaints on behalf of Connecticut residents." Keep the dates of your request, any extension notice, the denial and the appeal.

Universal opt-out signals

Section 42-520 says a controller's means for exercising rights shall include "allowing a consumer to opt out of any processing of the consumer's personal data for the purposes of targeted advertising, or any sale of such personal data, through an opt-out preference signal sent, with such consumer's consent, by a platform, technology or mechanism to the controller." The original text set a start date of January 1, 2025. The signal must "not make use of a default setting." If it conflicts with a loyalty program or site setting, "the controller shall comply with such consumer's opt-out preference signal."

The AG's FAQ says that "starting January 1, 2025, all controllers subject to the CTDPA must honor" such signals and names Global Privacy Control (GPC), sent "through a privacy protective browser or browser extension." The AG's April 2025 report notes that the browsers and extensions that send it do not "come preinstalled on consumer devices." The 2025 enforcement report says GPC "should trigger an opt-out across all personal data, not just data collected and shared via tracking technologies such as cookies."

What the signal does not do: it is not a deletion request, and it does not reach a people-search site you never visit. For listings about you, you still send a request.

Who is covered and who is not

Thresholds. Until June 30, 2026, section 42-516 covered persons doing business in Connecticut that in the preceding year "controlled or processed the personal data of not less than one hundred thousand consumers," or 25,000 consumers while deriving "more than twenty-five per cent of their gross revenue from the sale of personal data." Section 6 of Public Act 25-113 replaced that section "effective July 1, 2026," and the 2026 Supplement prints the new version as the text in force "on and after July 1, 2026": persons that "controlled or processed the personal data of not fewer than thirty-five thousand consumers," or that "control or process consumers' sensitive data," or that "offer consumers' personal data for sale in trade or commerce." So for a request sent today (October 2026), the 35,000 consumer threshold, the sensitive data prong or the sale prong governs. The sale prong has no volume limit, which the AG's 2025 enforcement report calls "unique to Connecticut."

Entity exemptions. Section 42-517(a) excludes government bodies, nonprofits, institutions of higher education, HIPAA covered entities and others. Section 7 of Public Act 25-113 removed the entity-level exemption for Gramm-Leach-Bliley financial institutions from July 1, 2026; the AG's 2025 report notes that "the law retains a GLBA data-level carveout."

Publicly available information. Personal data under the act does not include publicly available information. As restated by Public Act 26-64 (section 42-515, effective October 1, 2026), that means information that "is made available through federal, state or local government records or to the general public from widely distributed media," or that a controller or processor "has a reasonable basis to believe that the consumer has lawfully made available to the general public." The restated definition excludes "biometric data about a consumer collected by a business without the consumer's knowledge" and "personal data that are created by combining" personal data with public information, among other items.

People-search sites. The exemption was the recurring problem in the AG's reports, all of which predate the October 2026 change. The 2024 report describes "websites that post individual profiles, combining public records like contact information and addresses, property records, court documents, and public social media posts," and says "these companies allege that the profiles are pulled from publicly available information." The 2025 enforcement report says 22 of almost 70 new complaints "involved entities or data potentially exempt under the CTDPA," many of them "people search websites," and the AG "continue[s] to recommend that the legislature narrow the too-broad definition." The 2024 report says that in most such complaints the Office still "reached out to the company involved." Public Act 26-64 then wrote profile data into the deletion right itself, quoted above, effective October 1, 2026.

Registry. Connecticut has no data broker registry yet, so there is no list to check a site against. Public Act 26-64 says that "no data broker shall sell or license brokered personal data in this state on or after January 1, 2027, unless the data broker is actively registered with the Department of Consumer Protection," with a registration fee of "two thousand five hundred dollars." Our data broker directory and people-search category describe each site's own opt-out where we have tested it.

What enforcement has looked like

Section 42-525 gives the Attorney General "exclusive authority to enforce" the act; there is no private right of action. A violation "shall constitute an unfair trade practice," and the AG's FAQ puts civil penalties at up to $5,000 per violation. From July 1, 2023 to December 31, 2024, the AG had to issue a notice of violation and allow 60 days to cure. Since January 1, 2025, the AG "may" weigh listed factors "in determining whether to grant" a cure opportunity. The AG's three reports give these numbers:

• February 2024 (first six months): "over a dozen" cure notices; more than 30 complaints, "primarily" about "the 'right to delete'"; around one-third involving exempt data or entities. One case began with a cremation-services mailer sent to a resident after chemotherapy; the AG wrote to "the data broker that identified the individual for the marketing list."
• April 2025 (calendar 2024): "dozens" of cure notices, including three privacy notice sweeps with "over two dozen cure notices in total."
• February 2026 (calendar 2025): "almost seventy (70) new complaints"; the first CTDPA settlement, with TicketNetwork, which got a cure notice in November 2023, fixed its privacy notice in December 2024, and paid $85,000; an August 2025 opt-out signal sweep with California and Colorado; "a notice of violation and inquiry letter to a large data broker"; and an open investigation of "a data broker in the digital advertising space."

The 2026 report also names why complaints stall: businesses' "failure to maintain an active privacy email address or other mechanism to respond promptly."

Connecticut vs California

California already has a single-request tool, DROP; the AG's 2024 report describes California's Delete Act as letting residents delete data held by data brokers "through a single, verified request." See California's Delete Act and DROP. Connecticut's version is on the way. The AG's 2024 report said Connecticut "should enact a 'one-stop-shop' deletion mechanism such as that contained in California's Delete Act," and the April 2025 report repeated that such a mechanism "is sorely needed." The 2025 amendments did not include one. Public Act 26-64 does: "not later than July 1, 2028, the Commissioner of Consumer Protection shall establish an accessible deletion mechanism program," and "on and after October 1, 2028" each registered data broker "shall access the accessible deletion mechanism at least once every forty-five days." Until it opens, deletion in Connecticut is one request per company.

Practical order

1. Turn on a signal. Set Global Privacy Control in a browser or extension that supports it. The AG says that covers targeted advertising and sale by sites you visit.
2. Take an inventory. Search your name and note which brokers and people-search sites show you. How to remove your information from the internet has the full order of work; What is a data broker explains who these companies are.
3. Send each request through the company's own method. Ask for deletion of "personal data provided by, or obtained about" you, cite Conn. Gen. Stat. 42-518(a)(3), and keep the date. For a people-search profile, also quote subparagraph (B): "publicly available information that is (i) collated and combined to create a consumer profile."
4. Wait 45 days. An extension must come with a reason inside those 45 days. A denial must come with a reason and an appeal route.
5. Appeal. The written answer is due within 60 days.
6. Complain to the AG if the appeal is denied or the company never answers. Include the dates; the AG's 2026 report says complaints "drive our enforcement efforts and priorities."
7. Re-check. A broker that complied by suppression should not re-list you. A site that relies on the public-records exemption may; the profile language is new, and the AG's latest report (February 2026) predates it. Search your name again on a schedule.

We cannot promise any listing stays gone, and a Connecticut request reaches one company at a time.

If you are at risk

If someone is using a people-search listing to find you, deletion requests are slow by design: 45 days plus appeal. Contact local law enforcement first. The Connecticut Secretary of the State runs the Address Confidentiality Program (Connecticut Safe at Home), described on its page as "A Confidential Address Program for Domestic Violence, Sexual Assault, and Stalking Survivors"; it offers a substitute mailing address and certification cards.

FAQ

Does the CTDPA cover people-search sites? Since October 1, 2026, the deletion right in section 42-518(a)(3) names publicly available information that is collated and combined to create a consumer profile on a public website or made available for sale, plus inferences from it. Before that date the statute's exemption for publicly available information was the recurring problem in the Attorney General's reports, which say people-search sites argue their profiles are built from public records; the AG asked the legislature three times to narrow it. The AG's latest report (February 2026) predates the change, so there is no enforcement record for the new text yet. Send the request and quote the new wording.

How long does a company have to answer a deletion request in Connecticut? The statute says a controller shall respond not later than 45 days after receipt, and may extend by 45 more days if it tells you why within the first 45. If it declines, it must say why and how to appeal. An appeal gets a written answer within 60 days.

Does Connecticut have a data broker registry or a one-request deletion tool? Not yet. Public Act 26-64, signed on May 27, 2026, says no data broker shall sell or license brokered personal data in Connecticut on or after January 1, 2027 unless registered with the Department of Consumer Protection, and tells the Commissioner to establish an accessible deletion mechanism not later than July 1, 2028. The Attorney General's 2024 and 2025 reports had recommended a one-stop-shop mechanism like California's Delete Act; the 2025 amendments did not add one.

Does a deletion request cost anything? The statute says information in response to a request shall be provided free of charge once per consumer in any twelve-month period. A controller may charge a reasonable fee or decline if requests are manifestly unfounded, excessive or repetitive, and it bears the burden of showing that.