Connecticut SB 4 — Data-broker registration + geolocation-sales ban + facial recognition (CTDPA amendment)

Connecticut SB 4 is a privacy bill signed by Governor Ned Lamont on May 28, 2026, alongside the broader AI bill Connecticut SB 5 — Broad AI law (frontier reporting + ADMT + AI companions + sandbox). It introduces annual data-broker registration modeled on California's Delete Act, amends the Connecticut Data Privacy Act (CTDPA) to ban geolocation-data sales, and adds specific provisions for facial recognition technology. SB 4 was led by Sen. James Maroney (D), author of the original CTDPA.

Status and timeline

SB 4 was enacted as Public Act 2026-PA-00064 and signed by Gov. Ned Lamont (D) on May 28, 2026, the same day as the companion AI bill Connecticut SB 5 — Broad AI law (frontier reporting + ADMT + AI companions + sandbox). The two were signed together as the 2026 Connecticut AI-and-privacy package (Source: iapp.org). The bill is part of a sequence of privacy legislation led by Sen. James Maroney (D), following the original CTDPA in 2022 and subsequent CTDPA amendments.

The statute sets staged effective dates: data-broker registration takes effect January 1, 2027, and the Commissioner of Consumer Protection's deletion mechanism is due before July 1, 2028.

Key provisions

Data-broker registration

SB 4 prohibits data brokers from processing Connecticut residents' data without annual registration, effective January 1, 2027. The structure mirrors California's Delete Act, which created the Delete Request and Opt-out Platform (DROP) administered by the California Privacy Protection Agency (CPPA). As of May 2026, more than 285,000 California residents had used CalPrivacy's DROP since its January 1 launch. Connecticut is the first state after California to mandate broker registration combined with a centralized opt-out.

Streamlined single-opt-out / deletion mechanism

The bill tasks Connecticut's Commissioner of Consumer Protection with creating a consumer mechanism for streamlined single opt-out and deletion from data-broker lists before July 1, 2028. Connecticut officials are expected to consult California's CPPA for technical expertise on building the deletion system; the two states have collaborated previously through The Consortium of State Privacy Regulators.

Geolocation-data-sales ban and facial recognition

SB 4 amends the CTDPA to ban geolocation-data sales and adds specific provisions for facial recognition technology. Connecticut joins a small group of U.S. states, alongside Washington and Maryland, with statutory geolocation-sales prohibitions. The facial-recognition provisions follow earlier biometric-regulation statutes, including Illinois BIPA and the Washington biometric law (cf. biometric regulation).

Context and reactions

SB 4 is described as the most direct U.S. state-level emulation of California's Delete Act to date and the first state after California to combine broker registration with a centralized opt-out. Observers have positioned it as a potential template for other states with comprehensive privacy laws, including Colorado, Virginia, Utah, Iowa, Indiana, Tennessee, Texas, Oregon, Delaware, Maryland, Minnesota, and New Hampshire. The bill is also characterized as a continuation of Sen. Maroney's privacy legislation, progressing from the original CTDPA in 2022 through CTDPA amendments to SB 4.

The geolocation-sales ban and facial-recognition provisions intersect with AI policy because the same geolocation and facial datasets feed many AI training pipelines and biometric-AI deployments (cf. the Headway/Persona facial-scan story from May 28, 2026). Debates over training-data provenance, biometric AI, and location-based agent services frequently resolve as data-broker, opt-out, and deletion questions, and SB 4 strengthens the data-rights framework underpinning the companion AI bill Connecticut SB 5 — Broad AI law (frontier reporting + ADMT + AI companions + sandbox).

Relationships

• paired-with: Connecticut SB 5 — Broad AI law (frontier reporting + ADMT + AI companions + sandbox) (companion AI bill, signed same day)
• modeled-on: California's Delete Act (cf. Data Broker Regulation)
• amends: the Connecticut Data Privacy Act (CTDPA)
• related: Surveillance Technology, Data Broker Regulation, State Level Privacy Regulation, Cppa (CalPrivacy as the technical-template partner), Healthcare — AI Deployment (facial-recognition relevance via biometric ID-verification deployments)

Sources

• IAPP — "Notable AI, privacy bills hit finish line in Illinois, Connecticut and New York" (May 28, 2026) (Source: iapp.org)
• Connecticut General Assembly — SB 4 / Public Act 2026-PA-00064 primary text (Source: cga.ct.gov)