Connecticut Data Privacy Act (Children's Privacy Amendments)
Connecticut Data Privacy Act (Children's Privacy Amendments) in Connecticut: active, effective October 1, 2025; Phase 2 July 1, 2026. Applies to Phase 1: 100K+ consumers OR 25%+ revenue from sales with 25K+ consumers. Phase 2: 35K+ consumers OR processing sensitive data OR offering data for sale. Ch
Key facts
| Jurisdiction | Connecticut |
|---|---|
| Category | Consumer Privacy |
| Status | active |
| Effective date | October 1, 2025; Phase 2 July 1, 2026 |
| Age range | Phase 1 (July 1, 2023 - June 30, 2026): Ages 13-15, Phase 2 (July 1, 2026): Ages 13-17 |
| Applies to | Phase 1: 100K+ consumers OR 25%+ revenue from sales with 25K+ consumers. Phase 2: 35K+ consumers OR processing sensitive data OR offering data for sale. Children's Amendments: Controllers offering online services to known minors |
Key requirements
- Prohibits endless scrolling and addictive features
- Bans unsolicited adult-to-minor messaging
- Geolocation opt-in consent required
- Data protection assessments
Notes
Phase 2 (SB 1295) expanded coverage to minors 13-17 and lowered thresholds effective July 1, 2026. Fully enforceable; no court challenges on record.
Frequently asked
What does Connecticut Data Privacy Act (Children's Privacy Amendments) require?
Prohibits endless scrolling and addictive features Bans unsolicited adult-to-minor messaging Geolocation opt-in consent required Data protection assessments
Who must comply with Connecticut Data Privacy Act (Children's Privacy Amendments) in Connecticut?
Phase 1: 100K+ consumers OR 25%+ revenue from sales with 25K+ consumers. Phase 2: 35K+ consumers OR processing sensitive data OR offering data for sale. Children's Amendments: Controllers offering online services to known minors
When does Connecticut Data Privacy Act (Children's Privacy Amendments) take effect and what is its status?
Effective October 1, 2025; Phase 2 July 1, 2026. Current status: active. Phase 2 (SB 1295) expanded coverage to minors 13-17 and lowered thresholds effective July 1, 2026. Fully enforceable; no court challenges on record.
Related laws
| Law | Jurisdiction | Category | Status | Effective |
|---|---|---|---|---|
| Arkansas Children and Teens' Online Privacy Protection Act (HB 1717) | Arkansas | Consumer Privacy | active | July 1, 2026 |
| California Consumer Privacy Act (CCPA) | California | Consumer Privacy | active | September 2025 |
| California Mental Health Warnings (AB 56) | California | Consumer Privacy | pending | January 1, 2027 |
| Colorado Privacy Act (Minors Amendments) | Colorado | Consumer Privacy | active | October 1, 2025 |
| Delaware Personal Data Privacy Act | Delaware | Consumer Privacy | active | January 1, 2025 |
| Indiana Consumer Data Protection Act | Indiana | Consumer Privacy | active | January 1, 2026 |
| Iowa Consumer Data Protection Act | Iowa | Consumer Privacy | active | January 1, 2025 |
| Kentucky Consumer Data Protection Act | Kentucky | Consumer Privacy | active | January 1, 2026 |
Put it into practice
- Generate the policy: Connecticut CTDPA policy generator (generatepolicy.com)
- Buy the policy pack: State Privacy Law Checklist (cyberpolicy.shop)
- Build it yourself: 2026 US Privacy Program Workbook (ciso.diy)