Connecticut privacy law takes effect with geolocation ban as data brokers sue Tong

Connecticut began enforcing a significantly expanded consumer data privacy regime on October 1, 2026, when Public Act No. 26-64, the legislative package drafted as Senate Bill 4, took effect. The law bans the sale of Connecticut residents' precise geolocation data, requires companies to disclose when personal data is used to set individualized prices, and orders employers to tell people when artificial intelligence is used in hiring or employment decisions. It also adds protections for genetic data and new signage duties for businesses that deploy facial recognition technology.

The measure emerged from the 2026 legislative session. The Connecticut General Assembly gave the bill final passage in early May 2026, and Governor Ned Lamont signed it as Public Act No. 26-64 alongside a companion artificial intelligence law, Senate Bill 5, which became Public Act No. 26-15. The rollout is phased. The core Connecticut Data Privacy Act amendments, the surveillance pricing disclosure duty, the facial recognition signage rules, the genetic data protections and the precise geolocation sale ban all took effect on October 1, 2026. The state's new data broker registration requirements, set to be administered by the Connecticut Department of Consumer Protection, begin on January 1, 2027.

Enforcement rests solely with the Office of Attorney General William Tong. The law provides no private right of action, so residents cannot sue on their own behalf. Under the Connecticut Data Privacy Act, penalties reach up to $5,000 for each willful violation and $2,500 for each non-willful violation. The structure makes the Attorney General the single gatekeeper for a statute that reaches pricing, hiring, biometrics and location data at once.

The rollout has not been quiet. A coalition of data brokers led by Spokeo Inc. and PeopleConnect sued Attorney General Tong on September 17, 2026, asking a court to bar the state from enforcing one of the law's central provisions: the right of Connecticut residents to ask companies to delete information about them, even when it was obtained from public records. The companies argue the deletion right violates decades of First Amendment precedent. The court has yet to weigh in.

Key Facts

Bloomberg Law reported on October 1, 2026, that Connecticut's updated privacy law took effect that day, banning precise location sales and personalized pricing while a data broker coalition sues Attorney General William Tong over the deletion right. The report says Spokeo Inc., PeopleConnect and roughly half a dozen other people-search companies filed the challenge on September 17, 2026, and that the suit asks the court to stop the state from enforcing a law described as one of the strongest in the country.

Bloomberg Government reported on October 1, 2026, in its States of Play newsletter, that the law kicked in as the industry attempt to block it continued. That account, credited to Cassandre Coyer, confirms that the litigation leaves uncertainty about the deletion right's scope and that, with the lawsuit pending, enforcement of that provision remains contested. It also notes that the ban on sales of residents' precise geolocation is among the provisions the industry opposes.

The Connecticut House Democrats published an official legislative summary on October 1, 2026, describing new protections against artificial intelligence and data overreach. That summary states that geolocation data will no longer be sold in the state, that companies must receive user consent before using data for purposes beyond what was agreed to, and that when pricing is determined by a consumer's personal data, through price setting devices or surveillance pricing, companies must disclose it to the public. It adds that companies must disclose when AI is used for job applicant screening or employment related decisions.

IntelliSee, a legislation tracker, noted on June 15, 2026, that SB 4, now Public Act No. 26-64, amends the Connecticut Data Privacy Act and adds data broker, surveillance pricing, facial recognition, genetic data and geolocation provisions. It lists five core elements: a state data broker registry at the Department of Consumer Protection with an accessible consumer deletion mechanism; restrictions on surveillance pricing plus related disclosure duties; a ban on the sale of consumers' precise geolocation data; protections for genetic data and direct to consumer genetic testing; and new disclosure and signage duties for businesses deploying facial recognition. It confirms the phased dates of October 1, 2026 and January 1, 2027, and notes that the Attorney General enforces the law with no private right of action.

In response to the companies' lawsuit, Tong's office said in a statement that it will aggressively defend the law and the privacy and data security of Connecticut residents.

Analysis

The bigger picture here is that Connecticut has moved from writing privacy rules to defending them in court, and the outcome will set a practical ceiling on how far states can regulate the data economy. The suit targets the deletion right rather than the geolocation sale ban, which suggests the brokers see the deletion provision as the more vulnerable of the two. Their theory rests on the claim that ordering companies to remove information originating in public records runs against decades of First Amendment precedent. If they win, Connecticut residents would hold a narrower deletion right than lawmakers intended, and other states watching the case would get a clear signal about the constitutional limit.

The mechanics are contested too. Ben Isaacson, a principal at In-House Privacy Inc., said it is nearly impossible, if not impossible, for data brokers to identify the residency of a particular individual in their database, so firms rely on a best guess to comply. Both the geolocation ban and the deletion right depend on residency: a broker must know whether the person in a record is a Connecticut resident before applying the rules. That suggests compliance will be uneven and enforcement will require the Attorney General to establish residency case by case.

The industry's posture has hardened. David Stauss, an attorney whose firm Stauss PLLC represents data brokers, said the dynamics have changed and predicted more challenges from data brokers, pointing to New Jersey's new data broker registration fees as an example of the pressure driving the shift. Connecticut's own registry, starting January 1, 2027, gives the Department of Consumer Protection a direct view of who operates in the state.

Connecticut is not acting alone, but it is acting more broadly than several peers. Oregon and Virginia recently enacted similar bans on precise geolocation sales, while Maryland and New Jersey went further, making sales of all sensitive information illegal. California Governor Gavin Newsom vetoed a similar sensitive data sales bill, Bloomberg Law reported on October 1, 2026. Connecticut paired its geolocation ban with surveillance pricing disclosure, facial recognition signage, genetic data protections and AI hiring disclosure, reaching into pricing, hiring and biometrics rather than stopping at data sales.

Why It Matters

For residents, the law changes the default rules of a market they rarely see. Precise geolocation data, the kind that can place a person at a specific address or storefront, can no longer be sold in the state. When a company uses a consumer's personal data to set an individualized price, through surveillance pricing or a price setting device, it must disclose the practice to the public. Employers must tell people when AI is used to screen applicants or to make employment related decisions. Those duties reach ordinary transactions and job searches, not just back office data flows.

The stakes for the Attorney General are equally concrete. The office is the sole enforcer, with penalties of up to $5,000 per willful violation and $2,500 per non-willful violation available under the Connecticut Data Privacy Act, and no private right of action to share the load. How the office deploys its resources will determine whether the statute is felt in the market or remains a paper threat while the Spokeo and PeopleConnect suit proceeds.

For the wider state privacy landscape, Connecticut is a test case. If the deletion right falls, states that copied the model may have to redraft. If it stands, data brokers face a compliance burden that, by their own industry's account, is difficult to calibrate.

Next Up

The immediate milestone is the court's response to the September 17, 2026 lawsuit. Enforcement of the deletion right remains contested while the case proceeds, and the litigation leaves the provision's scope uncertain. The next scheduled step in the statute is January 1, 2027, when the data broker registration requirements at the Department of Consumer Protection take effect, adding a registration layer on top of the October 1, 2026 amendments.

Between now and then, watch whether the court bars enforcement of the deletion right, how the Attorney General's office builds its enforcement posture after Tong's statement that the office will aggressively defend the law, and whether other states copy Connecticut's phased approach or the broader sensitive data bans adopted in Maryland and New Jersey.