Connecticut Enacts a New Data Broker Law: What Businesses Need to Know Before October 2026

June 15, 2026

On May 27, 2026, Connecticut Governor Ned Lamont signed Public Act 26-64, establishing a new regulatory framework for data brokers in Connecticut. The law creates registration and disclosure requirements for qualifying data brokers and directs the Connecticut Department of Consumer Protection to establish a centralized mechanism through which consumers will be able to request deletion of their personal data.

The new framework generally takes effect October 1, 2026, with an important registration requirement applying to data brokers that sell or license brokered personal data in Connecticut on or after January 1, 2027.

For businesses involved in the commercial exchange of consumer information, Connecticut represents another state that should now be included in data broker compliance reviews.

What Changed?

Public Act 26-64 establishes a dedicated regulatory framework for data brokers administered by the Connecticut Department of Consumer Protection (“DCP”).

Among other requirements, the law establishes a registration program for qualifying data brokers, requires specified information to be disclosed as part of registration, creates public transparency requirements, and establishes a framework for a future statewide consumer deletion mechanism.

The legislation also builds on Connecticut’s existing consumer privacy framework rather than replacing it. As a result, organizations potentially subject to the new data broker provisions should evaluate them alongside other applicable Connecticut privacy requirements.

Who May Be Affected?

Whether an organization qualifies as a data broker depends on the statutory definitions and the organization’s actual activities.

Under Public Act 26-64, a “data broker” generally means a business, or part of a business, that sells or licenses brokered personal data to another person. The statute separately defines brokered personal data and provides exclusions and other provisions that can affect whether the requirements apply.

This means organizations should not rely solely on how they describe their business. A company does not necessarily avoid data broker requirements simply because it does not call itself a “data broker.”

Businesses involved in selling or licensing consumer information should therefore determine whether their activities fall within Connecticut’s new framework.

Key Compliance Dates.

These dates give businesses time to evaluate the new law before registration begins. However, determining whether the requirements apply may require more than simply reviewing a company’s industry or business description.

A Centralized Consumer Deletion Mechanism Is Coming.

One of the most significant features of Connecticut’s new framework is the requirement for DCP to establish an accessible deletion mechanism.

Under the enacted law, the mechanism is intended to allow consumers to submit a verifiable deletion request directing registered data brokers and their data service providers to delete the consumer’s personal data, subject to the requirements and exceptions established by the statute. Consumers will also be able to exclude specified registered data brokers from a request.

DCP must establish the mechanism no later than July 1, 2028. The law also establishes additional requirements governing how registered data brokers will interact with the mechanism as the program becomes operational.

For businesses, this means Connecticut’s framework extends beyond registration and creates future operational responsibilities associated with consumer deletion requests.

How Does Connecticut Compare With California?

Connecticut’s approach reflects a broader movement toward centralized consumer controls over information maintained by data brokers.

California’s DELETE Act similarly established a centralized mechanism for consumers to direct deletion requests to registered data brokers. Connecticut is developing its own framework, with its own definitions, requirements, exemptions, and implementation schedule.

The practical lesson for organizations operating nationally is important: data broker compliance should be evaluated state by state. Compliance with one state’s data broker requirements should not automatically be treated as compliance with another state’s law.

What Should Businesses Do Before October 2026?

Organizations involved in selling or licensing consumer information should determine whether Connecticut’s new data broker requirements may apply to their activities.

If the organization may fall within the law, the next step is understanding the applicable registration, disclosure, consumer rights, and other compliance requirements and determining what preparation may be necessary before those obligations become effective.

Businesses operating across multiple states should also consider Connecticut as part of their broader data broker compliance analysis rather than evaluating the law in isolation.

The important point is not simply whether an organization uses the term “data broker.” The analysis should focus on what the organization actually does with personal data and how those activities fit within the applicable statutory definitions.

CLIClaw Data Broker Compliance Solutions.

Understanding that Connecticut enacted a new data broker law is only the starting point. Organizations still need to determine whether the requirements apply to their activities and what compliance obligations may follow.

CLIClaw has added Connecticut to its growing Data Broker Compliance Solutions library to help organizations evaluate these questions and prepare for applicable requirements.

Current Connecticut materials include:

• Connecticut Data Broker Quick Self-Assessment

• Connecticut Data Broker Law – At-a-Glance

• Connecticut Data Broker Law

Explore Data Broker Compliance Solutions →

Final Thoughts.

Connecticut’s enactment of Public Act 26-64 adds another state-specific framework to the expanding U.S. data broker regulatory landscape.

For businesses that sell or license consumer information, the immediate question is whether Connecticut’s new requirements apply. Organizations that may be covered have time before registration requirements begin, but applicability should be evaluated before assuming that no action is necessary.

As additional states develop their own approaches to data broker regulation, organizations operating across jurisdictions will increasingly need to understand where their activities trigger different state requirements.

© 2026 CLIClaw.com

This article is for information purposes only. It is not intended to be and should not be relied on as legal advice for any particular matter.