Connecticut's Amended Privacy Act Raises the Bar on Minors' Data
Connecticut's SB 1295 amendments to the CTDPA take effect July 1, 2026, banning targeted advertising and data sales for under-18s, lowering the applicability threshold, and expanding sensitive-data protections.
What Changed
In June 2025, Governor Ned Lamont signed SB 1295, amending the Connecticut Data Privacy Act (CTDPA), with the core changes effective July 1, 2026. The amendments lower the threshold for which businesses fall under the CTDPA, broadening its reach to more processors. They impose a full ban on processing the personal data of Connecticut residents under 18 for targeted advertising or data sales, restrict design features intended to extend minors' engagement, and require impact assessments for processing that presents a heightened risk of harm. The amendments also expand the categories of sensitive data and sharpen protections tied to consumer health data. Heightened-risk impact assessments apply to activities created on or after August 1, 2026.
Who It Affects
Companies processing personal data of Connecticut residents, especially any platform whose audience includes teenagers, and businesses previously below the CTDPA threshold now pulled into scope. Advertising-technology firms, social and gaming platforms, and health and wellness services face the sharpest changes. Because the minors ban applies where a controller has actual knowledge, or willfully disregards, that a user is under 18, reliable age determination becomes the gate deciding which data practices are lawful, making age assurance a privacy-compliance function, not just a safety one.
What to Do
Map whether the lowered threshold now captures your business, and if so stand up the CTDPA obligations before July 1, 2026. Establish reliable age determination so under-18 users are excluded from targeted advertising and data sales and shielded from engagement-extending design features. Prepare data protection and heightened-risk impact assessments for activities created on or after August 1, 2026, and refresh disclosures for the broadened consumer-health-data definition. Age assurance that yields a verifiable, minimal-data record lets you enforce the minors ban without over-collecting.
What is deepidv?
Not everyone loves compliance — but we do. deepidv is the AI-native verification engine and agentic compliance suite built from scratch. No third-party APIs, no legacy stack. We verify users across 211+ countries in under 150 milliseconds.
Learn More