Connecticut Data Broker Law: Why the Deletion Tool Doesn't Arrive Until 2028, and How California Compares

Governor Ned Lamont signed SB 4 on May 27, 2026, and the headlines made it sound like Connecticut had just got its own version of California's Delete Act. It didn't, not yet. The Connecticut data broker law, now Public Act 26-64, is real, it's broad, and it does eventually build a one-stop deletion mechanism modelled on California's DROP. But it rolls out in stages spread across more than two years, and the deletion tool itself (the part people assume they're getting) isn't required to exist until July 1, 2028, with brokers not obliged to act on it until October 1, 2028. If you live in Connecticut and think you can file a broker deletion request any time soon, you're planning around a date that isn't real.

What the Connecticut data broker law actually does

SB 4 is an omnibus privacy bill, not a single-issue broker law. It does four things, bolted together in one statute.

First, it amends the Connecticut Data Privacy Act (CTDPA), expanding consumer rights and, notably, banning the sale of precise geolocation data outright. The act's own definition draws the line at a 1,750-foot radius, and the ban binds both controllers and third parties, so a broker can't launder location data through a partner. Second, it creates a Connecticut data broker registry run by the Department of Consumer Protection, with an "accessible deletion mechanism" attached to it later: Connecticut's answer to DROP. Third, it restricts surveillance pricing, so a retailer that raises your price using your personal data has to say so on the price tag. Fourth, it separately regulates direct-to-consumer genetic testing companies.

Most coverage flattens all four into "Connecticut passed a data broker law." That is technically true and functionally misleading, because each piece has a different date, and the piece people care about (deletion) is the slowest.

There is also a second act that almost nobody writing about SB 4 has noticed. On June 2, 2026, six days later, the Governor signed HB 5222, a 154-page consumer-protection omnibus that became Public Act 26-100. Sections 39 to 43 of it repeal and re-enact five of SB 4's broker sections, section 66 repeals the surveillance-pricing section and section 44 replaces it. Three things a consumer would notice changed: how the deletion mechanism checks who you are, how the penalty is counted, and when the pricing rules start. The law-firm summaries from May and June predate it, which is why none of them mention it. Everything below reads SB 4 as amended.

When does the Connecticut data broker law take effect? A timeline, not a date

Here is where the act's drafting trips people up. Every section of Public Act 26-64 is stamped "Effective October 1, 2026," and several summaries we've seen repeat that as the date brokers must register. The real dates sit inside the sections. Reading the act text rather than the headers, and layering in the June amendments, the Connecticut SB 4 timeline runs like this.

Four of those rows need a note the table can't hold.

October 1, 2026 is the earliest anything in SB 4 changes for consumers or businesses, and none of it is the registry or the deletion system. As signed, surveillance pricing would have started this day too. Public Act 26-100 repealed that section and re-enacted it with a February 1, 2027 start and a shorter label ("THIS PRICE WAS INCREASED USING YOUR PERSONAL DATA"), so any summary that puts pricing on October 1 is quoting the superseded version.

January 1, 2027 is a directory, not a deletion tool. Registration requires disclosing a public web page explaining how consumers can exercise their CTDPA rights, whether the broker collects minors' data, precise geolocation or reproductive and sexual health data, and whether it is already regulated under FCRA, GLBA or HIPAA. Section 2(d) lets the department run the whole thing through the Nationwide Multistate Licensing System, the platform mortgage lenders already register on, which may be why the department's own site says nothing about it yet.

July 1, 2028 is one request, sent to every registered broker, with the option to exclude specific brokers. SB 4 as signed had you prove who you were with a driver's license number that the state could use once and never retain. Public Act 26-100 struck that and now asks for "information sufficient to establish that the consumer is a resident of this state", closer to California's residency gateway than to an ID upload. The mechanism has to work in English, Spanish and any other language spoken at home by at least one per cent of the state's population, show you the status of your request, and let you update it once in any 45-day period.

October 1, 2028 is when brokers must act, subject to a defined list of exceptions. Once a broker has deleted you, it has to repeat the deletion every 45 days and may not use anything it later acquires about you (section 5(c)(2) and (4)). A request the state can't verify doesn't vanish: brokers must treat it as an opt-out of sale under the CTDPA instead. Civil penalties, after notice and a hearing, run up to $200 per day per consumer for each violation (section 10, where Public Act 26-100 added the words "per consumer").

That is a 21-month gap between when brokers first register and when they have to honour a request through the state's tool. Put another way: a Connecticut resident reading this in September 2026 is four months from the registry opening and two years from any working deletion mechanism.

Who the Connecticut data broker law leaves out

Section 7, as rewritten in June, lists nine kinds of business the broker sections never touch: data handled under the federal Driver's Privacy Protection Act, HIPAA covered entities and protected health information, consumer reporting agencies and the companies that feed or use them under FCRA, financial institutions under Gramm-Leach-Bliley, any business collecting data on its own customers, investors or donors, the service providers acting for such a business or for a government body, listed-chemical regulation, political committees, and HIPAA business associates. The first two were added by Public Act 26-100. The credit bureaus and the bank that already has your data were exempt from the start.

Section 7(b) is the one that matters for people-search sites. An unregistered business may still sell publicly available information that concerns a person's business or profession, feeds a health or safety alert, or comes from a government record, unless that information is "collated and combined to create a consumer profile" on a public website or used to draw inferences. A site that pulls county records into a profile page is inside the law even though every field came from a public source. That clause is aimed squarely at the FastPeopleSearch model, and it is the line most of the sites in our opt-out catalogue sit on.

How the Connecticut data broker law compares to California's live system

California isn't a preview of where Connecticut is headed. California is most of the way through the process Connecticut is just beginning.

The California column is not theoretical. Since August 1, 2026, registered brokers have been required to check DROP every 45 days and process what's there, on pain of $200 per request per day. By August 25, more than 500,000 Californians had signed up, with 654 registered brokers on the receiving end. CalPrivacy had fined two brokers within two weeks of the deadline, LocateSmarter, $116,490 on August 11 and Cybba, $52,400 on August 13, and a third, SalesIntel, $36,400, on September 1. All three were registration failures rather than ignored DROP requests, which tells you the agency is working through the registry before it works through the deletion queue. Our DROP explainer tracks the enforcement record as it grows.

By the time Connecticut's brokers have to act on a deletion request in October 2028, CA DROP will have run an enforced 45-day deletion cycle for more than two years. Connecticut has copied the cadence, the $200-a-day penalty and the audit requirement (Connecticut's three-year audits begin in July 2031 under section 5(d), California's in January 2028 under Civil Code 1798.99.86(e)). Connecticut vs California privacy law, on the broker question, is a difference of years rather than design. The Connecticut data broker law borrows California's mechanics almost line for line and pushes every date out by two to three years.

What SB 4 changed in the Connecticut Data Privacy Act beyond data brokers

If you searched for the CTDPA amendments 2026 and landed here, two bills are in play. Public Act 25-113, passed in 2025, took effect on July 1, 2026 and did the threshold and sensitive-data work: the Attorney General's summary now puts the coverage floor at 35,000 consumers and lists a right to the names of the third parties a company sold your data to. SB 4 is the second bill, effective October 1, 2026, and sections 12 to 20 change the CTDPA in these ways.

The deletion right now reaches public-record profiles. Section 13 rewrites the right to delete so that it covers not just personal data a company collected about you but "publicly available information that is collated and combined to create a consumer profile" on a public website or offered for sale, and any inference drawn from it. Publicly available information sits outside the CTDPA's definition of personal data, which is how people-search sites argued the deletion right did not apply to them. For a Connecticut resident this is the sharpest tool in the act, and it arrives 21 months before the deletion mechanism does. Section 12 narrows the definition of publicly available information to match: it no longer covers a public record combined with other personal data, or anything you posted to a restricted audience.

Precise geolocation can no longer be sold, by anyone. The CTDPA already treated location within 1,750 feet as sensitive data needing consent to process. Section 14 adds a flat rule that "no controller shall sell any consumer's precise geolocation data" and section 15 repeats it for third parties, so the ban follows the data downstream. The content of communications and utility smart-meter data are the only carve-outs. On minors, section 14 restates the duty not to target ads at, or sell the data of, a consumer a controller knows or wilfully disregards is between 13 and 17, and the broker sections make registrants say whether they collect minors' data at all.

Two smaller pieces round it out. Section 16, which Public Act 26-100 repealed and re-enacted as its own section 45 with the same substance, lets a shop use facial recognition for loss prevention only against a database it maintains itself, with signage at every public entrance linking to a policy that names the Attorney General. Sections 17 to 19 give you a property right in any sample you hand a consumer genetic-testing company, require express consent before your genetic data is used or shared, bar disclosure to employers and insurers, and require a way to delete the data and confirm the sample was destroyed.

Enforcement of all of this stays with the Attorney General, who per the AG's own page "has exclusive authority to enforce violations of the Act", with civil penalties of up to $5,000 per violation. The pricing, genetic and facial-recognition sections each say the same in their own words: unfair trade practice, Attorney General only, no private right of action.

What a data broker registry does and doesn't tell you

Because Connecticut's first step is a registry, it's worth being clear about what a registry gives a consumer, based on the one we use most. California's registry is a downloadable CSV in which each broker self-reports its websites, what categories it collects, and how many privacy requests it received and honoured the previous year. It is useful, and it is uneven.

Two examples from the copy we pulled on September 1, 2026. Spokeo, Inc.'s entry lists ThatsThem, AnyWho and Freepeopledirectory as trade names, which is how we confirmed that ThatsThem is a Spokeo property, and yet the ThatsThem opt-out does not clear your spokeo.com listing or vice versa; each site keeps its own suppression queue. That same entry reports eight deletion requests received in all of 2024. Mississippi Tornado Alley, LLC registers ten people-search sites on one line (FastPeopleSearch, USPhoneBook, CyberBackgroundChecks and seven more) and reports zero deletion requests across all of them. CalPrivacy's September 3 advisory now threatens $200 a day for incorrect registry information, which suggests the agency has noticed the same thing.

The Connecticut data broker registry will inherit the same self-reporting problem in January 2027, and its disclosures are thinner. Connecticut brokers don't have to publish deletion-request counts at all until July 1, 2029 (section 6 of the act), and when they do it goes on the broker's own website rather than into the state registry. If you want to know how many requests a broker actually honoured, California's CSV will stay the better source for a while.

Data broker laws by state: New Jersey, Vermont, Texas and Oregon

Staging it this way is the norm. Six states now have, or have enacted, a broker registration law. Only California has a working deletion tool, and the Connecticut data broker law is the only other one that commits to building one.

Two rows deserve a sentence. New Jersey signed A.5328 on June 30, 2026, a month after SB 4, and its distinguishing feature is a flat ban on selling ten categories of sensitive data, which the state said in July it will not enforce until the legislature fixes defects in the text. Vermont's is the oldest law on the table, and when it rewrote it on June 16, 2026 the central deletion portal in the House version was stripped out in the Senate and replaced by a Secretary of State feasibility study, with an interim report due December 1, 2027 and a final one December 1, 2028. Texas is the outlier in the other direction: a $10,000 annual cap on penalties is less than the fee schedule at some of the brokers it covers.

So with state data broker deletion laws compared side by side, the map reads: pass the law, stand up a registry months to years later, and then maybe build a deletion mechanism. California is the outlier because it is the only state that has finished all three steps.

What a Connecticut resident can do today, and what to expect later

Through September 2026, nothing in the Connecticut data broker law has taken effect. You will not have a state-run deletion mechanism until July 1, 2028 at the earliest, brokers do not have to act on it until October 1, 2028, and dates like these have slipped in other states before. Here is what is usable now, in order.

1. Use the CTDPA rights that already exist. You can ask any covered company to confirm what it holds on you, correct it, delete it, hand you a copy, name the third parties it sold it to, and stop selling it or using it for targeted ads. The Attorney General's page says a controller "must respond to a consumer's requests no later than 45 days after receipt". The request goes to the company, not the state.
2. From October 1, cite the new profile-deletion language. A people-search site that has been refusing deletion because it is all public record loses that argument under section 42-518(a)(3)(B) as amended. Quote it in the request.
3. If a company refuses, it has to offer an appeal, and if the appeal fails it has to give you the Attorney General's contact details. Keep the refusal and the appeal response, because that is the file the AG's office will ask for.
4. For people-search sites, don't wait. Each site's own opt-out form works today, and our opt-out guides walk through them with screenshots of what each form actually asks. Two things from our own runs that no statute will fix: the PeopleConnect family (TruthFinder, Instant Checkmate, Intelius) verifies opt-outs by phone before it acts, and a Spokeo removal leaves the ThatsThem listing standing, so budget one request per domain, not per company.
5. From January 1, 2027, check the Department of Consumer Protection's registry page for any broker you are dealing with. Each entry must link to a rights page on the broker's own site that, under section 2(c)(3), may not use dark patterns. A missing or buried page is itself something the department can fine.
6. Mark July 2028. When the mechanism opens you will need proof of Connecticut residency, you can exclude named brokers, and you can amend the request once every 45 days. Brokers begin acting on it October 1, 2028, and the first deletion counts appear on their sites in July 2029.

In the meantime the gap between "a state passed a broker law" and "residents have a working deletion tool" is the same as it has always been: opt out with each broker individually, one request per site rather than per company, or use a service that does it broker by broker regardless of which registry that broker is listed on.

Frequently asked questions about the Connecticut data broker law

Does Connecticut have a data broker registry yet?

No. Section 2 of Public Act 26-64 requires registration from January 1, 2027, and as of September 15, 2026 the Department of Consumer Protection's site does not mention data brokers. Section 2(d) lets the department run registration through the Nationwide Multistate Licensing System, so the eventual form may live there rather than on ct.gov. Section 4 requires a public page listing every registered broker's disclosures once it opens.

Who enforces the Connecticut data broker law?

Two agencies, depending on the section. The Department of Consumer Protection enforces the registration and deletion-mechanism rules and may fine up to $200 per day per consumer per violation after notice and a hearing (section 10, as amended by Public Act 26-100). The Attorney General enforces the CTDPA itself and the pricing, genetic-testing and facial-recognition rules. Nothing in the act creates a private right of action.

Is the Connecticut Data Privacy Act the same thing as SB 4?

No. The CTDPA is the 2022 comprehensive privacy law, codified at sections 42-515 to 42-526 of the general statutes, amended in 2023, 2025 and now 2026. SB 4 is the 2026 amendment package plus four stand-alone programmes: the broker registry, surveillance pricing, genetic testing and a rule on streaming-ad volume. When someone says the CTDPA changed in 2026, they may mean the 2025 act that took effect July 1, the SB 4 changes that take effect October 1, or both.

Does Connecticut ban the sale of location data?

Yes, from October 1, 2026. Sections 14 and 15 of Public Act 26-64 bar controllers and third parties from selling any consumer's precise geolocation data, defined as location within a 1,750-foot radius, with no consent exception. The only carve-outs are the content of communications and utility smart-meter data. Registered brokers must also disclose whether they collect precise geolocation at all (section 2(c)(4)).

What is surveillance pricing under Connecticut law?

Charging you a personalised price based on personal data collected about you, whether through a camera, a sensor, device tracking or a purchased profile. From February 1, 2027, section 44 of Public Act 26-100 bans retail sellers and third-party delivery services from doing it, and requires anyone else who raises an online price this way to label it "THIS PRICE WAS INCREASED USING YOUR PERSONAL DATA". Posted discounts for loyalty members, students, veterans and the like are allowed. Insurers and lenders pricing on credit reports are outside it.

Can a Connecticut resident use California's DROP?

No. DROP verifies California residency through the state's Identity Gateway before it accepts a request, and brokers only have to act on requests from California residents. Our DROP explainer covers what the sign-up asks for. A Connecticut resident's equivalent does not exist until July 2028, and until then the working route is the individual opt-out on each site.

Delist My Data is in pre-launch. We're building removal that works site by site, without waiting on any state's registry or portal to catch up. If that sounds useful, join the waitlist for founding-member access.

Sources

• Public Act 26-64 (SB 4), Connecticut General Assembly
• SB 4 bill status and history, Connecticut General Assembly
• Public Act 26-100 (HB 5222), Connecticut General Assembly
• HB 5222 bill status and history, Connecticut General Assembly
• The Connecticut Data Privacy Act, Office of the Attorney General
• Connecticut Privacy Law Updates: Data Broker Rules, Geolocation Sale Ban, Surveillance Pricing Restrictions, and Genetic Data Regulations, Hunton
• Connecticut passes law to establish data broker registry and one-stop deletion mechanism, Privado
• Connecticut's newly enacted data broker law: how it stacks up against California's Delete Act, Davis+Gilbert
• CalPrivacy: Data Brokers and the Delete Request and Opt-Out Platform
• CalPrivacy: Half a million Californians have signed up for DROP (August 25, 2026)
• CalPrivacy: First action against a data broker under both the CCPA and Delete Act, LocateSmarter (August 11, 2026)
• CalPrivacy: Second data broker enforcement action in less than a week, Cybba (August 13, 2026)
• CalPrivacy: Enforcement action against Virginia data broker SalesIntel (September 1, 2026)
• CalPrivacy: Enforcement Advisory 2026-01 (September 3, 2026)
• SB 362, the Delete Act (Chapter 709, Statutes of 2023), California Legislative Information
• Vermont Enacts Significant Amendments to Data Broker Legislation, Hunton
• H.211 (Act 138) bill status, Vermont General Assembly
• 9 V.S.A. § 2446, Annual registration, Vermont General Assembly
• Data Brokers, Texas Secretary of State
• SB 2105 (2023), enrolled text, Texas Legislature Online
• Data Broker Registry, Oregon Division of Financial Regulation
• ORS chapter 646A, including 646A.593, Oregon Legislature
• California Data Broker Registry (CSV download)