Connecticut SB 4: AN ACT CONCERNING CONSUMER PRIVACY AND PROTECTION.
Status: SIGNED BY GOVERNOR (as of 2026-05-27)
State: Connecticut · Session: 2026 · Bill: SB 4
Subjects: Attorney General, Audits, Brokers, Consumer Protection Department, Consumer information, Consumer protection, Disclosure, Electronic commerce, Electronic government information, Fees, Fines (Penalties), General Fund, Genetic information, Health care data, Hearings, Infertility, Law enforcement, Medical care, Motor Vehicle Department records, Motor vehicle license plates, Motor vehicle manufacturers, Notices, Personal data, Privacy, Public hearings, Reports, Sales, Scanning devices and reencoders, State funds, Transportation Department, Videos, Violations
Sponsors: Martin M. Looney, Bob Duff, Saud Anwar, Jorge Cabrera, Christine Cohen, Mae Flexer, Sujata Gadkar-wilcox, Herron Gaston, Joan V. Hartley, Jan Hochadel, Paul Honig, Julie Kushner, Matthew L. Lesser, Rick Lopes, Ceci Maher, James J. Maroney, Martha Marx, Douglas Mccrory, Patricia Billie Miller, Norman Needleman, Catherine A. Osten, Md Rahman, Derek Slap, Nicholas Menapace, Anthony L. Nolan
Bill Text
Substitute Senate Bill No. 4 Public Act No. 26-64 AN ACT CONCERNING CONSUMER PRIVACY AND PROTECTION. Be it enacted by the Senate and House of Representatives in General Assembly convened: Section 1. (NEW) (Effective October 1, 2026) As used in this section and sections 2 to 10, inclusive, of this act, unless the context otherwise requires: (1) "Accessible deletion mechanism" means the mechanism established pursuant to subsection (a) of section 5 of this act; (2) "Applicant" means any data broker that submits an application for an initial registration, or for a registration renewal, under subsection (b) of section 2 of this act; (3) "Brokered personal data" means one or more of the following personal data elements concerning a consumer, if categorized or organized for sale or license to a third party: (A) Name; (B) address; (C) date of birth; (D) place of birth; (E) mother's maiden name; (F) unique biometric data (i) generated from measurement or technical analysis of a human body characteristic, including, but not limited to, a fingerprint, retina or iris image or other unique physical or digital representation of biometric data, and (ii) used by the owner or licensee of such unique biometric data to identify or authenticate the consumer; (G) name or Substitute Senate Bill No. 4 Public Act No. 26-64 2 of 41 address of a member of the consumer's immediate family or household; (H) Social Security number or other government-issued identification number; or (I) other information that, alone or in combination with the other information sold or licensed, would allow a reasonable person to identify the consumer with reasonable certainty; (4) "Business" (A) means (i) any person who regularly engages in commercial activities for the purpose of generating income, (ii) any bank, Connecticut credit union, federal credit union, out-of-state bank, out-of-state trust company or out-of-state credit union, as such terms are defined in section 36a-2 of the general statutes, and (iii) any other person who controls, is controlled by or is under common control with any person described in subparagraph (A)(i) or (A)(ii) of this subdivision, and (B) does not include any body, authority, board, bureau, commission, district or agency of this state or of any political subdivision of this state; (5) "Commissioner" means the Commissioner of Consumer Protection; (6) "Consumer" has the same meaning as provided in section 42-515 of the general statutes, as amended by this act; (7) "Data broker" means any business or, if such business is not an individual, any portion of such business that sells or licenses brokered personal data to another person; (8) "Data service provider" means any person who maintains personal data on behalf of a registered data broker; (9) "Deletion request" means any request submitted by a consumer under subparagraph (A)(i) of subdivision (1) of subsection (a) of section 5 of this act; (10) "Department" means the Department of Consumer Protection; Substitute Senate Bill No. 4 Public Act No. 26-64 3 of 41 (11) "HIPAA" means the Health Insurance Portability and Accountability Act of 1996, 42 USC 1320d et seq., as amended from time to time; (12) "License" (A) means to grant access to, or distribute, brokered personal data in exchange for consideration, and (B) does not include using any personal data for the sole benefit of the person who provided such personal data if such person maintains control over the use of such personal data; (13) "Minor" means any consumer who is younger than eighteen years of age; (14) "Participating consumer" means any consumer who submits a verified deletion request; (15) "Person" has the same meaning as provided in section 42-515 of the general statutes, as amended by this act; (16) "Personal data" has the same meaning as provided in section 42- 515 of the general statutes, as amended by this act; (17) "Registered data broker" means any data broker that is actively registered as a data broker in accordance with the provisions of section 2 of this act; and (18) "Unregistered data broker" means any data broker that is not actively registered as a data broker in accordance with the provisions of section 2 of this act. Sec. 2. (NEW) (Effective October 1, 2026) (a) Except as provided in section 7 of this act, no data broker shall sell or license brokered personal data in this state on or after January 1, 2027, unless the data broker is actively registered with the Department of Consumer Protection in accordance with the provisions of this section. Substitute Senate Bill No. 4
View Connecticut SB 4 on LegisTrack → — full text, sponsors, votes, campaign finance, and cross-state matches.