What is the CTDPA?
CTDPA stand for Connecticut Data Protection Act.
Right to opt out. In Connecticut consumers have the right to “opt out of the processing of the personal data for the purposes of:
- targeted advertising;
- the sale of personal data; or
- profiling in furtherance of solely automated decisions that produce legal or similarly significant effects concerning the consumer.”
Controllers are required to provide “clear and conspicuous” links on their websites that give consumers the choice to opt out.
Beginning Jan. 1, 2025, however, controllers must recognize universal “opt-out preference signal[s]” indicating a consumer’s intent to opt out of targeted advertising and sales, which will trump any conflicting controller-specific privacy setting. This is similar to Colorado’s law mandating recognition of universal opt-out signals beginning July 1, 2024.
The CTDPA defines “sale of personal data” as “the exchange of personal data for monetary or other valuable consideration by the controller to a third party.” This definition considers an exchange for “other valuable consideration” to also constitute a sale.
Most provisions of the law will go into effect on July 1, 2023.
