The Pulse
Connecticut’s AI and Privacy Rules Take Effect as 14 Companies Sue
Connecticut’s October 1 privacy changes include limits on selling precise geolocation data, expanded deletion rights and new obligations involving facial recognition and pricing. Separately, 14 companies sued over the expanded right to dele
AI.info Team · Written with AI ·
“These laws going into effect are significant steps to protect our kids from dangerous chatbots, safeguard our privacy, and prevent unfair pricing practices.”
Attorney General William Tong, Connecticut Office of the Attorney General
Connecticut’s latest AI and privacy requirements took effect October 1, bringing new restrictions on personal-data sales and new obligations for some AI providers. The package includes parts of the Connecticut Artificial Intelligence Responsibility and Transparency Act, or CART Act, and amendments to the Connecticut Data Privacy Act. Other provisions have later deadlines for chatbots, social media and employment decisions.
New limits on location data and profiling
Public Act 26-64 bars the sale of consumers’ precise geolocation data. It also expands deletion rights tied to consumer profiles generated from publicly available information and adds requirements for businesses using facial recognition technology. Those businesses must post clearly legible notices and provide a link or QR code to their policy.
The act establishes protections for genetic data collected by direct-to-consumer testing companies, including consumer control over how samples and results are collected, used, retained, disclosed and destroyed. It also creates a data-broker registry administered by the Department of Consumer Protection; brokers must register by January 1, 2027. The state’s existing privacy law does not cover every business: it sets thresholds and exempts some industries subject to other privacy frameworks.
The law also limits surveillance pricing and requires disclosures in specified circumstances when businesses use personal data to set prices. Its provisions address facial recognition and information generated from publicly available records, extending new duties beyond AI developers.
The CART Act sets duties for AI providers
Public Act 26-15 establishes requirements and consumer protections related to artificial intelligence. Provisions taking effect October 1 include disclosures around AI subscriptions and whistleblower protections for people involved in developing and deploying large frontier AI models. The act also addresses automated employment decisions: their use does not protect companies from discrimination claims.
Some employment requirements have a later deadline. Companies using covered automated employment decision-making must have a framework for notifying applicants and employees by October 1, 2027. The law’s AI companion chatbot regulations, including disclosures and mental-health protections, begin January 1, 2027. Separate youth social media protections take effect January 1, 2028.
Fourteen companies challenge a privacy provision
The new rules took effect as 14 companies that publish people-search information challenged part of Public Act 26-64 in federal court. Spokeo Inc. and 13 other companies filed suit against Attorney General William Tong on September 17, seeking to block enforcement. The complaint targets the expanded ability of residents to seek deletion of personal information, including information drawn from public records; the companies argue the provision violates the First Amendment.
As of October 1, the court had not ruled on the challenge. Tong’s office told Bloomberg Law that it “will aggressively defend the law and the privacy and data security of Connecticut residents.” The lawsuit challenges one part of the new regime; it does not mean the state’s other provisions have been suspended.
Compliance dates stretch into 2028
The staggered schedule gives businesses separate deadlines to track. The data-broker registry deadline falls in January 2027, while chatbot regulations begin the same month. The employment-notice framework is due by October 2027, and youth social media protections start in January 2028.
Sen. James Maroney, a lead architect of the measures, described the laws as a starting point: “This is a start. This is not a finish; this is not a ceiling. This is the floor.”