Connecticut AI & Data Privacy Stack — PA 26-15 (AI/Online Safety), PA 26-64 (Privacy/Surveillance Pricing), CTDPA as amended by PA 25-113, CID Bulletin MC-25: AI Compliance Requirements

IN FORCE SINCE 1 JULY 2026. Conn. Gen. Stat. § 42-520(b)(1), as substituted by PA 25-113 § 9, fixes what a controller's privacy notice must contain, and subparagraph (H) is the AI item: "a statement disclosing whether the controller collects, uses or sells personal data for the purpose of training large language models". Read the whole list, because the AI line is one of nine mandatory items and the others changed in the same amendment: (A) categories of personal data processed; (B) purpose of processing; (C) a description of the means for consumers to submit rights requests, including how to exercise § 42-518(a) rights and how to appeal a controller's decision on such a request; (D) the categories of personal data the controller SELLS to third parties (the amendment replaced "shares with"); (E) the categories of third parties to which it sells personal data; (F) a clear-and-conspicuous disclosure of any processing for targeted advertising or any sale for targeted advertising; (G) an active e-mail address or other online mechanism for contacting the controller; (H) the large-language-model training statement; and (I) THE MONTH AND YEAR THE NOTICE WAS LAST UPDATED. § 42-520(b)(2) then dictates publication: a conspicuous hyperlink containing the word "privacy" on the web-site home page, on the app store or download page, and in the app settings menu; a regularly used medium such as mail if there is no web site; every language in which the controller offers the product or service; and in a form reasonably accessible to and usable by people with disabilities. Note that (H) is a disclosure duty about LLM training — it does not by itself permit or forbid the training.

The opt-out has existed since 1 July 2023, but PA 25-113 § 8 rewrote it and bolted four new rights on top, all in force since 1 JULY 2026. (1) SCOPE WIDENED: the opt-out now covers "profiling in furtherance of ANY automated decision that produces any legal or similarly significant effect" — the word "solely" was struck, so keeping a human in the loop no longer takes the decision out of scope. (2) ACCESS: on a § 42-518(a)(1) request the controller must confirm whether it is processing the consumer's personal data for profiling to make such a decision, and disclose inferences derived about the consumer, subject to the trade-secret carve-out. (3) EXPLANATION: where personal data were processed for profiling in furtherance of such a decision, the consumer may, IF FEASIBLE, (a) question the result of the profiling, (b) be informed of the reason the profiling produced that decision, and (c) review the personal data that were processed. (4) HOUSING RE-EVALUATION: if the profiling decision concerned housing, the consumer may correct incorrect personal data used in the profiling and have the decision RE-EVALUATED on the corrected data. (5) SALE TRANSPARENCY: the consumer may demand a list of the third parties to which the controller has sold that consumer's personal data, or, if the controller keeps no such per-consumer list, a list of all third parties to which it has sold personal data. Build the rights-request workflow so the profiling questions can actually be answered — an opt-out toggle alone no longer satisfies § 42-518.

IN FORCE SINCE 1 AUGUST 2026 — this is a SECOND, SEPARATE assessment from the data protection assessment, and Connecticut is explicit that it is not retroactive: it applies to processing activities created or generated ON OR AFTER 1 August 2026 (the DPA duty continues to apply to activities created after 1 July 2023). Any controller that engages in profiling to make a decision producing a legal or similarly significant effect concerning a consumer must conduct an impact assessment containing, to the extent reasonably known or available: (1) a statement of the purpose, intended use cases, deployment context and benefits of the profiling; (2) an analysis of whether the profiling poses a known or reasonably foreseeable heightened risk of harm and, if so, the nature of that risk and the mitigation steps taken; (3) a description of the main categories of personal data used as INPUTS and of the OUTPUTS produced; (4) an overview of the main categories of personal data used to CUSTOMISE the profiling, if any; (5) the metrics used to evaluate performance and the known limitations; (6) a description of transparency measures, including how consumers are told profiling is happening while it is happening; and (7) a description of post-deployment MONITORING and user safeguards, including the oversight, use and learning processes established to address issues arising from the profiling. Separately, the four heightened-risk triggers for the data protection assessment are now set out up front in § 42-522(a): targeted advertising, sale of personal data, profiling carrying a reasonably foreseeable risk of unfair or deceptive treatment or unlawful disparate impact, financial/physical/reputational injury, offensive intrusion on solitude, or other substantial injury, and the processing of sensitive data. The Attorney General may demand either assessment in an investigation; both are confidential and exempt from the Freedom of Information Act, and disclosing them to the AG does not waive attorney-client privilege or work-product protection. An assessment prepared for another law counts if it is reasonably similar in scope and effect, and one assessment may cover a comparable set of processing operations.

Sections 7 to 12 of Public Act 26-15 take effect 1 OCTOBER 2026, but read the trigger carefully: the deployer duties attach to automated employment-related decision technologies DEPLOYED ON OR AFTER 1 OCTOBER 2027. An AEDT is any technology that processes personal data and uses computation to generate an output — prediction, recommendation, classification, ranking, score or other information — that is a SUBSTANTIAL FACTOR used to make or materially influence an employment-related decision, meaning a factor that meaningfully alters the outcome. Ordinary word processing, spreadsheets, navigation, hosting, storage, security and similar tooling is excluded so long as it does not make or materially influence the decision, as is anything purely descriptive, diagnostic or statistical and not relied upon. "Employment-related decision" covers hiring, promotion, discipline, discharge, renewal, selection for training or apprenticeship, and tenure or terms, privileges and conditions of employment — but NOT decisions producing only a non-material change in job tasks, responsibilities, hours or assignments, and not decisions about workplace health and safety, scheduling and planning, or productivity monitoring. TWO DUTIES: (§ 9) where the AEDT is intended to interact with an employee or applicant in Connecticut, disclose in PLAIN LANGUAGE to each person who interacts with it that they are interacting with the technology — unless a reasonable person would find it obvious; and (§ 10) before the employment-related decision is made, give the employee or applicant a WRITTEN NOTICE stating (1) that the deployer has deployed an AEDT, (2) the purpose of the AEDT and the nature of the decision, (3) the TRADE NAME of the AEDT, (4) the categories of the person's personal data the AEDT will analyse or process and how that data will be assessed in reaching a decision, (5) the sources of that personal data, and (6) contact information for the deployer. Section 11 lets you withhold trade-secret or otherwise legally protected information, but then you must notify the person that information is being withheld AND the basis for withholding it. If a developer has contracted under § 8(c) to assume these duties, the contract must be binding and set out exactly which duties it takes over. NOTE THE HONEST LIMIT: Connecticut requires notice, not a bias audit — there is no impact-assessment, disparate-impact-testing or filing duty in §§ 7-12.

The developer of an automated employment-related decision technology deployed in Connecticut on or after 1 OCTOBER 2027 must provide to the deployer ALL information the deployer needs to perform its § 9 and § 10 duties — that is, everything required to disclose the interaction and to issue the pre-decision notice naming the technology, its purpose, the personal-data categories and their sources, and how that data is assessed. "Developer" means a person doing business in Connecticut who develops, or intentionally and substantially modifies, an AEDT, so a substantial modifier inherits developer duties. The duty is switched off unless the technology was advertised, marketed, configured, contracted for, sold or licensed to be USED TO MATERIALLY INFLUENCE an employment-related decision — a general-purpose model a customer repurposes for hiring on its own initiative does not by itself pull the developer in. Alternatively the developer may contract to ASSUME the deployer's § 9 and § 10 duties; that contract must be binding and clearly set out which duties it has taken over. Practical build: ship a Connecticut disclosure pack with the product (trade name, purpose, input-data categories and sources, assessment logic summary at a level that survives the § 11 trade-secret carve-out) rather than answering customer-by-customer.

EFFECTIVE 1 OCTOBER 2026 — five weeks after this entry was verified, and years ahead of the AEDT notice duties. Public Act 26-15 § 13 rewrites Conn. Gen. Stat. § 46a-60(b)(1) and § 14 rewrites § 46a-81c(1) to add the same sentence: the use of an automated employment-related decision technology, as defined in § 7 of the act, SHALL NOT BE A DEFENCE against a complaint alleging a discriminatory practice. The Commission on Human Rights and Opportunities or the court "may consider evidence of anti-bias testing or similar proactive efforts to avoid such discriminatory practice, including, but not limited to, the quality, efficacy, recency and scope of such testing or efforts, the results of such testing or efforts and the response thereto." Two consequences. First, "the vendor's model did it" is dead as a liability shield for hiring, promotion, discipline, discharge, terms and conditions across every protected characteristic in § 46a-60(b)(1) and for sexual orientation and civil union status under § 46a-81c. Second, anti-bias testing is now MITIGATION EVIDENCE with named quality criteria — quality, efficacy, RECENCY, scope, results and the response to those results — so testing that is stale, narrow or ignored after a bad result is worth little. Connecticut does not mandate the testing; it rewards being able to produce it. Keep dated test reports, the population and outcome measures used, and a record of what changed after each result.

EFFECTIVE 1 OCTOBER 2026. A "covered provider" — any person who creates, codes or otherwise produces a generative AI system that has MORE THAN ONE MILLION USERS PER MONTH and is publicly accessible to consumers for personal use (government agencies excluded) — must, to the extent commercially and technically reasonable, embed PROVENANCE DATA in any audio, image or video content, or combination of them, that its system creates or MATERIALLY ALTERS, in a way that lets a consumer assess whether the content was created or materially altered by that system. The provenance data must be made difficult to tamper with, remove or disassociate using commercially and technically reasonable methods, "including, but not limited to, the relevant standard established by the COALITION FOR CONTENT PROVENANCE AND AUTHENTICITY" — the statute names C2PA on its face. "Generative artificial intelligence system" is defined as technology using machine learning to generate images, audio or video, including deep learning, natural language processing or comparable techniques; "provenance data" is data embedded in the content or its metadata for verifying authenticity, origin or modification history. "Materially alter" excludes minor modifications that do not significantly change perceived content or meaning — brightness, contrast, colour, sharpening, saturation, filters, resizing, scaling, cropping, format conversion, resampling, denoising and background-noise removal. CARVE-OUTS: the duty never requires embedding information about an identified or identifiable individual, nor disclosure of trade secrets or confidential design information; and it does not apply to business-to-business use, sale, licensing or distribution of a generative AI system, to products or services solely providing video game or interactive experiences (including in-experience commerce), or to systems used solely for upscaling, noise reduction or compression. Note the scope limit honestly: § 15 covers audio, image and video — TEXT output is not within the provenance duty.

EFFECTIVE 1 JANUARY 2027. An operator — any individual or business entity (or its affiliate, member, subsidiary or beneficial owner) that provides or operates an AI companion for a user — may not provide or operate one unless BOTH conditions in § 5(a)(1) are met. (A) The companion includes a protocol that uses evidence-based methods to detect user expressions clearly indicating a risk of suicide, self-harm or imminent physical violence AND institutes measures preventing the companion from generating output that encourages suicide, self-harm or physical violence; on detection it must refer the user to appropriate mental-health evaluation and treatment resources INCLUDING the 9-8-8 National Suicide Prevention Lifeline; and on a repeat detection after such a referral it must refer the user to mental-health services consistent with clinical best practices and expertise. (B) The operator has implemented reasonable measures preventing the companion from claiming to be a human being — including when asked directly — and from generating output that refutes or conflicts with any disclosure that it is not human. § 5(a)(2) then requires the PROTOCOL ITSELF to be posted in a prominent, publicly accessible location on the operator's web site. § 5(b) sets the disclosure CADENCE where the companion would cause a reasonable user to believe they are talking to a human: either a static written notice visible throughout the entire interaction, or an audible or written notice at the start of the first interaction in any 24-hour period AND at least ONCE PER HOUR for users under 18, or at least once every THREE HOURS for users 18 and over, during continuous interaction. § 6 adds minor-specific duties where the operator knows or has reason to believe the user is under 18: safeguards meeting or exceeding the measures the section specifies, plus tools made available to minor users and their parents or guardians to manage the minor's use — with a safe harbour where the operator knew or had reason to believe, before providing the companion, that the user was 18 or older.

EFFECTIVE 1 OCTOBER 2026 — an unusual duty that catches every AI vendor selling to Connecticut consumers on a subscription. A "subscription-based provider" (a person doing business in Connecticut who provides or offers an AI technology to a consumer under a subscription for any fee or other compensation) may not enter into or renew a subscription, or collect any fee for an initial subscription or renewal, unless (A) it has given the consumer a WRITTEN NOTICE disclosing the key terms and conditions and (B) the consumer has given the provider a written notice ACCEPTING those key terms. For an INITIAL subscription the notice must set out material information sufficient for a reasonable consumer to decide whether to buy or keep the subscription, including at minimum (i) any quantitative or qualitative LIMITATIONS the provider may impose under the terms — expressly including limits it may impose in response to the consumer's own conduct — and (ii) whether the provider has DISCRETION to limit or eliminate access to, or reduce the quantity or quality of, any functionality of the AI technology. For a RENEWAL the notice must set out any such limitation or discretion that will apply for the first time in the renewal term, or that applied in the immediately preceding term but has been MODIFIED for the renewal term. In plain terms: rate limits, usage caps, throttling, model downgrades, feature removal and conduct-based restrictions have to be disclosed up front and re-disclosed when they change, and a click-through that never surfaces them will not do — the statute requires the consumer's written acceptance of the key terms.

EFFECTIVE 1 OCTOBER 2026. A "price setting device" is defined broadly as ANY automated or programmed process that uses a consumer's personal data to establish a price for a consumer good or service — algorithmic and AI pricing squarely included. TWO DUTIES. (1) DISCLOSURE: any person doing business in Connecticut who uses a price setting device for any purpose other than establishing a DISCOUNTED price for an online transaction, and who advertises, promotes, labels, publishes or displays that price online, must include the following disclosure or one substantially similar, readily visible to the average consumer: "THIS PRICE WAS INCREASED BY A PRICE SETTING DEVICE USING YOUR PERSONAL DATA". A "discounted price" means one verifiably lower than the generally available, publicly disclosed, bona fide market price. (2) PROHIBITION: no RETAIL SELLER (a retailer as defined in Conn. Gen. Stat. § 12-407 making retail sales of tangible personal property, including a retail food establishment) and no THIRD-PARTY DELIVERY SERVICE doing business in Connecticut may engage in SURVEILLANCE PRICING at all. Surveillance pricing means establishing a customised price for a consumer good or service that is specific to a consumer based in whole or in part on the consumer's personal data collected through any technology, method, system or tool — expressly including biometric monitoring, cameras, device tracking or sensors — capable of gathering personal data about the consumer's behaviour, characteristics, location or other attributes in a physical or digital environment, whether the person setting the price gathered that data directly or acquired it from a third party. The act carves out retention discounts and price differences that reflect justifiable differences in the cost of providing the good or service.

EFFECTIVE 1 OCTOBER 2026, added to Conn. Gen. Stat. § 42-524. A controller or consumer health data controller that uses ANY facial recognition technology on its premises to prevent, detect, protect against or respond to security incidents, identity theft, fraud, harassment, malicious or deceptive activity or illegal activity, to preserve system integrity or security, or to investigate, report or prosecute those responsible, must do BOTH of the following. (i) Use the technology EXCLUSIVELY to match still images or video against a database maintained exclusively by that controller — matching against third-party watchlists, purchased face databases or shared retail-crime databases is out. (ii) Post CLEARLY LEGIBLE SIGNAGE at each entrance to the premises where the technology is in use — other than entrances to areas restricted to authorised employees — that both alerts consumers entering that facial recognition technology is in use AND includes a conspicuous hyperlink or QR CODE directing them to the controller's facial-recognition technology policy. That policy must include CONTACT INFORMATION FOR THE OFFICE OF THE ATTORNEY GENERAL, and may disclose the controller's policies on interactions between its loss-prevention officers and consumers. This is the security-purpose branch of the sensitive-data rules: biometric data processed to uniquely identify an individual remains CTDPA sensitive data requiring consent outside these security uses, and the same section preserves the narrow processing allowance only where safeguards protect the consumer and a professional under confidentiality obligations is responsible.

IN FORCE SINCE 26 FEBRUARY 2024, with a RECURRING ANNUAL DEADLINE — the next falls on 1 SEPTEMBER 2026. Connecticut Insurance Department Bulletin No. MC-25, addressed to all insurers licensed to do business in Connecticut, adopts the NAIC Model Bulletin on the Use of Artificial Intelligence Systems by Insurers and expressly "updates and replaces the Department's Notice issued on April 20, 2022, concerning the usage of big data and avoidance of discriminatory practices" — so the 2022 big-data notice is superseded, not cumulative. The bulletin reminds insurers that decisions or actions affecting consumers made or supported by advanced analytical and computational technologies, including AI systems, must comply with all applicable insurance laws, including unfair trade practice and unfair discrimination law, and it sets out the Department's expectations for governance of the development, acquisition and use of AI, plus the information and documentation the Department may request in an investigation or market conduct examination. THE CONNECTICUT-SPECIFIC DUTY: "Connecticut domestic Insurers must complete the Artificial Intelligence Certification ('Certification'), which is due on or before September 1, 2024, and annually thereafter", filed through the Department's data-certification application; an insurer certifying that it demonstrates compliance through ALTERNATIVE MEANS must describe those alternative means as part of the Certification. The bulletin names its own legal footing: the Connecticut Unfair Insurance Practices Act (Conn. Gen. Stat. §§ 38a-815 to 38a-819, including the unfair claim settlement standards in § 38a-816(6)); the Corporate Governance Annual Disclosure report under § 38a-142a, whose § 38a-142a(c)(5) description of board and senior-management oversight of critical risk areas the Department reads as covering the insurer's use of AI systems; the Rating Laws (property and casualty §§ 38a-663 to 38a-696, health §§ 38a-481, 38a-501a, 38a-528a and 38a-556, life §§ 38a-446 and 38a-447), which apply regardless of the methodology used to develop rates so an AI- or predictive-model-derived rate is judged by the same standard; and the market conduct examination and investigation framework in §§ 38a-15 and 38a-16.

Connecticut's breach statute is the backstop when an AI system, vendor or training pipeline leaks personal information. Notice to each affected Connecticut resident must go out "without unreasonable delay but not later than SIXTY DAYS after the discovery of such breach". Notice to the ATTORNEY GENERAL is required "not later than the time when notice is provided to the resident" — simultaneous, not a follow-up filing, which is stricter in sequencing than several neighbouring states. Where the breach exposes personal information, the person who owns or licenses the data must OFFER appropriate identity-theft prevention services and, where applicable, identity-theft mitigation services, at NO COST to the resident, for a period of NOT LESS THAN TWO YEARS. Failure to comply is an unfair trade practice, enforceable by the Attorney General, with penalties directed to the state privacy protection account. Practical note for AI deployments: a compromise of model training data, embeddings stores or vendor-side logs containing Connecticut residents' personal information starts the same 60-day clock as any other breach, and the AG-notice timing means the regulator learns of it on the same day the consumers do.

EFFECTIVE 1 OCTOBER 2026, with the internal-channel build due 1 JANUARY 2027. A "frontier developer" is any person doing business in Connecticut who intends to train, initiates the training of, or trains a foundation model using more than 10^26 integer or floating-point operations, counting original training plus any fine-tuning, reinforcement learning or other material modification applied to a preceding model. A "large frontier developer" is one whose group (including entities under common control) had annual gross revenues above $500,000,000 in the most recently completed calendar year. DUTIES. (§ 2(b)) No frontier developer may make, adopt, enforce or enter into any rule, policy or contract providing that it may discharge, discipline or penalise an employee for activity protected by Conn. Gen. Stat. § 31-51m(b), or that anyone with authority over a covered employee may retaliate against that covered employee for reporting an issue they have reasonable cause to believe indicates activity posing a specific and substantial danger to public health or safety due to a CATASTROPHIC RISK. (§ 2(c)) Every LARGE frontier developer must, by 1 January 2027, establish and maintain a reasonable internal process for a covered employee to submit an ANONYMOUS report of such activity and to receive reasonable updates on the investigation and the actions taken; reports and updates must be shared with the officers and directors at least QUARTERLY, except that a report alleging wrongdoing by an officer or director must not be shared with that person. (§ 2(d)) Every frontier developer must give covered employees clear notice of their rights either by posting a notice at all times in every workplace, giving an equivalent notice to each new covered employee and periodically to remote covered employees, or by providing a written notice at least ANNUALLY to each covered employee and obtaining their acknowledgement of receipt. "Catastrophic risk" is defined against a threshold of death or serious injury to more than fifty people or more than one billion dollars in damage or loss of covered property from a single incident involving expert-level CBRN uplift or unsupervised model conduct constituting a cyberattack or, if done by a person, murder, assault, extortion or theft. HONEST LIMIT: Connecticut stops at whistleblower protection — unlike some other states there is NO published-safety-framework duty and NO safety-incident reporting duty to a regulator in § 2.

THE ONE CONNECTICUT AI-ADJACENT STATUTE THAT IS NOT AG-EXCLUSIVE. House Bill 5312 of the 2026 session — "AN ACT ESTABLISHING A CIVIL ACTION FOR THE OFFICE OF THE ATTORNEY GENERAL AND A PRIVATE RIGHT OF ACTION FOR VICTIMS OF UNLAWFUL DISSEMINATION OF A SYNTHETICALLY CREATED INTIMATE IMAGE" — passed the House on 1 May 2026 and the Senate on 5 May 2026, was designated PUBLIC ACT 26-55 on 14 May 2026 and was SIGNED BY THE GOVERNOR ON 26 MAY 2026. Per the General Assembly's own statement of purpose, the act establishes a private right of action and a civil action for the Office of the Attorney General to pursue damages from an OPERATOR OF AN ELECTRONIC DIGITAL PLATFORM that fails to take down a synthetically created intimate image. Any platform that hosts user-generated imagery and serves Connecticut users should therefore run a notice-and-takedown path for synthetic intimate imagery and be able to evidence its response times. HONEST LIMIT ON THIS ENTRY, RECORDED DELIBERATELY: the enrolled text of PA 26-55 could NOT be retrieved this session — cga.ct.gov was unreachable from this toolchain and the Wayback Machine holds no capture of 2026PA-00055-R00HB-05312-PA.PDF — so the takedown deadline, the damages figures, the definition of "operator of an electronic digital platform" and the effective date are NOT stated here rather than guessed. The facts above come from the CGA's own bill-status record for HB-5312 (bill title, statement of purpose, and the history lines "5/14/2026 (LCO) Public Act 26-55" and "5/26/2026 Signed by the Governor"). NEXT VERIFIER: pull 2026PA-00055-R00HB-05312-PA.PDF and fill in the operative detail, then set a real deadline and penaltyAmount.