The Pulse

Connecticut’s AI and Privacy Rules Take Effect Oct. 1

Connecticut’s CART Act and expanded data privacy protections begin taking effect October 1, 2026. The changes cover AI disclosures, whistleblower protections, facial recognition, surveillance pricing and consumer data.

AI.info Team · Written with AI · fact-checked · 2026-09-28

Connecticut’s first wave of new artificial intelligence and data privacy rules takes effect October 1, bringing fresh requirements for businesses and new protections for residents. The changes sit in two laws: the Connecticut Artificial Intelligence Responsibility and Transparency Act, known as the CART Act, and a separate measure expanding the Connecticut Data Privacy Act.

October brings AI disclosures and whistleblower protections

The 39-section CART Act covers a broad set of subjects, including AI workforce training, employment decisions, chatbots and social media protections for minors. Provisions already underway include the Connecticut AI Academy and a state AI working group. October 1 activates other parts of the law, including disclosures related to AI subscriptions and whistleblower protections for people involved in developing or deploying large frontier AI models.

Sen. James Maroney, a Milford Democrat and co-chair of the legislature’s General Law Committee, described the law as a starting point. “This is a start. This is not a finish; this is not a ceiling. This is the floor,” he said at a recent press conference.

Privacy changes reach pricing, location and facial recognition

Public Act 26-64 amends the state’s data privacy law and adds protections involving personal information. The changes include a ban on selling consumers’ precise geolocation data, limits and disclosure requirements for facial recognition technology, and restrictions on using personal data to set prices. Businesses using facial recognition must post legible notices and provide a conspicuous link or QR code to their policy.

The law also gives consumers added control over genetic data collected by direct-to-consumer testing companies, including consent requirements and rights over the collection, use, retention and destruction of samples and results. Connecticut’s attorney general says the changes do not cover every business: the state privacy law has revenue thresholds and exemptions for certain industries subject to other privacy rules.

Data-broker registration comes later

October 1 starts the process for a state registry of data brokers, but registration itself is due by January 1, 2027. The staggered dates mean businesses may face different requirements on different schedules, rather than a single compliance deadline for both laws.

The CART Act also sets later start dates for provisions aimed at children. Requirements for AI companion chatbots, including safeguards around self-harm and disclosures that a chatbot is not human, take effect January 1, 2027. Youth social media rules, including parental controls and limits on notifications, are scheduled for January 1, 2028.

Employment obligations extend into 2027

Employers using automated systems in employment decisions will not be shielded from discrimination claims simply because they used AI. The law calls for companies to prepare a framework explaining when and how AI factors into employment decisions; businesses using these systems must have that framework in place by October 1, 2027, and provide plain-language notices to applicants and employees about AI interactions.

The new laws divide responsibilities among state agencies, with much of the enforcement authority assigned to the attorney general’s office. Connecticut’s provisions therefore arrive in stages: consumer privacy changes and selected AI rules begin October 1, while chatbot, employment and youth protections continue on through 2027 and 2028.