AI Regulation Tracker / Legislation in force

Connecticut's Amended Privacy Act Expands Opt-Out and Adds New Rights Over AI Profiling

On July 1, 2026, the profiling and automated-decision sections of Connecticut's amended Data Privacy Act took effect. Consumers can now opt out of a wider set of AI-driven decisions and get new rights to question and review them. The law was enacted back in the 2025 session as Public Act 25-113. This part is now live.

By Anthony Guerriero · The Leveraged Years Regulatory Research · Published July 16, 2026 · Last updated July 16, 2026

The short version

As of July 1, 2026, Connecticut consumers have broader rights over automated decisions made about them. The state amended its Data Privacy Act through Substitute Senate Bill 1295, enacted in the 2025 session as Public Act 25-113. The profiling and automated-decision sections carry their own effective date of July 1, 2026, so they are now in force. The opt-out for profiling was widened by deleting the old word "solely," which means a consumer can now opt out of profiling that feeds any automated decision producing a legal or similarly significant effect, not only decisions made with no human involved. Consumers also gain new rights to question the result, learn the reason for it, review the personal data used, and, for housing decisions, correct the data and have the decision reevaluated. The applicability threshold dropped to 35,000 consumers, pulling more companies in. A separate profiling impact-assessment duty starts August 1, 2026 and is not part of this. If you do business in Connecticut or target Connecticut residents and you use AI to make or shape decisions about them, this reaches you now.

Regulatory Briefing

Instrument: Substitute Senate Bill No. 1295, Public Act No. 25-113, amending the Connecticut Data Privacy Act (CTDPA), Connecticut General Statutes chapter 42
Authority: State of Connecticut; enforced by the Connecticut Attorney General
Jurisdiction: Connecticut, United States
Bindingness: Binding law. The profiling and automated-decision provisions are headed "(Effective July 1, 2026)" and are now in force.
What Changed: The profiling opt-out was expanded by deleting the prior "solely" limiter, new automated-decision rights were added, and the applicability threshold dropped to 35,000 consumers.
Who This Affects: Controllers that do business in Connecticut or target Connecticut consumers and use AI profiling or automated decisioning. Directly relevant as a benchmark for US privacy and AI-governance teams everywhere.
Original Enactment: 2025 legislative session (Public Act 25-113); profiling sections delayed to a July 1, 2026 effective date
Current Status: In force as of July 1, 2026. A separate profiling impact-assessment duty begins August 1, 2026.
Primary Source: Connecticut General Assembly, enacted text of PA 25-113 (SB 1295), cga.ct.gov
Last Verified: July 16, 2026

Connecticut did not pass a new AI law this month. What happened on July 1, 2026 is that a piece of a law already on the books switched on. Back in the 2025 session, the legislature passed Substitute Senate Bill 1295, which became Public Act 25-113 and amended the Connecticut Data Privacy Act. Most of that act took effect earlier, but the sections dealing with profiling and automated decisions were written with a later trigger. In the enacted text those sections carry the heading "(Effective July 1, 2026)." That date has now passed, so the rights below are live.

This is a good example of why the enactment date and the effective date are two different things worth tracking separately. The bill was signed in 2025. The obligations that matter to anyone using AI on Connecticut consumers only started to bite this month.

The opt-out got wider by one deleted word

The most consequential change is small on the page and large in practice. The prior version of the CTDPA let a consumer opt out of profiling used to make decisions that were, in the statute's words, made "solely" by automated processing. That word "solely" did a lot of work. If a human was involved anywhere in the loop, a company could argue the decision was not made solely by a machine, and the opt-out did not attach.

The amendment deletes "solely." Under the text now in force, a consumer can opt out of the processing of personal data for "profiling in furtherance of ... any automated decision that produces any legal or similarly significant effect concerning the consumer." The trigger is no longer whether a human touched the decision. It is whether an automated decision produced a legal or similarly significant effect. That is a much larger set of situations, and it closes the workaround that the old wording invited.

Four new rights over automated decisions

The amendment does not stop at a broader opt-out. It gives Connecticut consumers a set of new rights attached to profiling that feeds a legal or similarly significant decision. Read against the enacted text, a consumer can:

Question the result of the profiling.
Be informed of the reason the profiling produced the decision.
Review the personal data that was processed.
For a decision that concerned housing, correct the personal data and have the profiling decision reevaluated based on the corrected data.

The first three apply across covered automated decisions. The fourth, the correct-and-reevaluate right, is carved out specifically for housing decisions, which is where the legislature clearly saw the sharpest stakes. Together these rights move Connecticut past a simple opt-out and into explanation and, for housing, a do-over. That is a meaningful step for a US state law, and it is the part that privacy and AI-governance teams outside Connecticut should be reading closely as a signal of where this is heading.

More companies are now in scope

The amendment also lowered the applicability threshold. The number of Connecticut consumers whose data a controller processes before the law applies dropped to 35,000. Lowering that bar pulls smaller and mid-sized companies into coverage that would have sat under the old line. If you assumed you were too small for the CTDPA to reach you, that assumption is worth re-checking against the new threshold.

What is not in this, and the date you should not conflate

I want to be precise about scope, because there are two July-adjacent dates in this bill and mixing them up is an easy mistake to make. Everything above, the expanded opt-out, the four new rights, and the lower threshold, took effect July 1, 2026. That is the change I am describing here.

There is a separate obligation in the same act, a profiling impact-assessment duty, that begins August 1, 2026. That is a distinct requirement with a distinct start date, and it is out of scope for this piece. Do not read the July 1 rights as if they included the August 1 assessment duty, and do not tell your team the assessment duty was live on July 1. It was not. Two dates, two things.

What this means if you use AI on Connecticut consumers

The reach is defined by conduct, not by where you are headquartered. If you are a controller doing business in Connecticut or targeting Connecticut consumers, and you use AI profiling or automated decisioning to make or shape decisions that carry a legal or similarly significant effect, this law now applies to you. Credit, insurance, housing, employment-adjacent screening, and similar high-stakes calls are the obvious candidates.

The practical work is not exotic. You need to honor the wider opt-out, which means your systems have to recognize that the old "a human was in the loop" defense no longer keeps profiling outside the opt-out. You need a real path for a consumer to question a result, to get the reason behind it, and to review the personal data you used. And for housing decisions specifically, you need a correction-and-reevaluation process that actually reruns the decision on corrected data. Being able to explain why your model produced an outcome is now a legal capability in Connecticut, not just a nice-to-have.

For teams outside Connecticut, treat this as a precedent to benchmark against. A US state has now moved consumer rights over automated decisions from opt-out into explanation and, for housing, reevaluation. That direction of travel is the thing to watch, because it tends to spread.

What to do now

Confirm whether you cross the 35,000-consumer threshold in Connecticut, since the lower bar may pull you in for the first time. Inventory where AI profiling feeds any decision with a legal or similarly significant effect on a Connecticut consumer. Update your opt-out handling so it no longer depends on the deleted "solely" standard. Stand up the question, reason, and review rights as real workflows, not policy language. Build the correct-and-reevaluate path for housing decisions. And put the August 1, 2026 profiling impact-assessment duty on a separate line of your calendar so nobody conflates it with the rights that went live July 1. Confirm how any of this applies to your business with counsel licensed in Connecticut.

Source File

Primary: Connecticut General Assembly, enacted text of Public Act No. 25-113 (Substitute Senate Bill No. 1295), amending the Connecticut Data Privacy Act; profiling and automated-decision sections headed "(Effective July 1, 2026)," at cga.ct.gov
Secondary: Wiley, "Major Changes to Connecticut Consumer Privacy Law Will Take Effect July 1, 2026," wiley.law
How to verify: Open the CGA enacted-act PDF and find the profiling and automated-decision sections marked "(Effective July 1, 2026)." The opt-out language reads "profiling in furtherance of ... any automated decision that produces any legal or similarly significant effect concerning the consumer," followed by the rights to (A) question the result, (B) be informed of the reason, (C) review the personal data, and (D) for housing, have the decision reevaluated.

Questions professionals are asking

Is this a brand-new Connecticut AI law?

No. It is an amendment to the existing Connecticut Data Privacy Act. The change was enacted in the 2025 legislative session as Public Act 25-113 (Substitute Senate Bill 1295). The profiling and automated-decision sections were written with a delayed effective date of July 1, 2026, which is why they only took effect this month.

What is the significance of deleting the word "solely"?

Under the old text, the profiling opt-out attached only to decisions made "solely" by automated processing, so companies could argue that any human involvement placed a decision outside the opt-out. Deleting "solely" means a consumer can now opt out of profiling that feeds any automated decision producing a legal or similarly significant effect, whether or not a human was involved.

What new rights do consumers have?

For profiling that feeds a legal or similarly significant automated decision, a consumer can question the result, be informed of the reason for it, and review the personal data that was processed. For decisions that concerned housing, the consumer can also correct the personal data and have the profiling decision reevaluated based on the corrected data.

Does the August 1, 2026 impact-assessment duty come with these rights?

No. The expanded opt-out, the new automated-decision rights, and the lower 35,000-consumer threshold took effect July 1, 2026. The profiling impact-assessment duty is a separate obligation that begins August 1, 2026. They are two different requirements with two different start dates and should not be conflated.

Does this reach companies outside Connecticut?

Yes, based on conduct. The CTDPA applies to controllers that do business in Connecticut or that target Connecticut consumers and meet the applicability threshold, which was lowered to 35,000 consumers. Where you are headquartered does not matter; whether you process Connecticut consumers' data and make automated decisions about them does. For teams elsewhere, it is also a precedent worth benchmarking against.

RELATED BRIEFINGS

Browse the full AI Regulation News tracker

Informational analysis for working professionals, not legal advice. Confirm how any law or requirement applies to your situation with qualified counsel in the relevant jurisdiction.