Connecticut Senate advances major update to state data-privacy law with new protections for children and data-broker registry

Hartford ' Senate lawmakers on May 14 adopted a strike-all amendment and passed a broad rewrite of Connecticut's data-privacy statute aimed at expanding protections for children, tightening exemptions and increasing enforcement tools.

Senator Will Maroney, the bill's lead proponent, said the measure updates a 2022 law after the attorney general's office documented enforcement gaps and changing technology. "We have had some learnings since then, and so this bill attempts to update that," Maroney said as he summarized the amendment, which became the bill on the floor.

Key changes in the Senate'passed measure include: a requirement that social platforms aimed at children host cyberbullying and mental-health resource pages and have written cyberbullying policies; an expanded definition of "sensitive data" to include precise geolocation and financial-account information; a lowered threshold for applicability from 100,000 to 35,000 Connecticut residents (or if the entity sells data or processes sensitive data); a data-broker registration requirement; strengthened protections for minors (including prohibitions on targeted advertising and design features intended to addict children); and narrower, data-level rather than entity-level, exemptions for HIPAA- or GLBA-covered activity.

"Section 1'I would like to thank Senator Huang for a proposed bill in reference to trying to do more for cyberbullying... Section 2 updates the definition [of sensitive data]," Maroney told the chamber during his floor summary (Sen. Maroney said that in 2024 Connecticut recorded about 1,900 data breaches). He emphasized added rights for residents to know if they are being profiled and to see which businesses have their data.

Senators pressed the bill on several fronts. Republican and some Democratic members voiced concerns about costs and compliance burdens for small and mid-sized businesses brought in by the lower 35,000-person threshold, with Senator Sampson warning it could ‘‘spill over into a much sector of industry.''" Maroney and supporters said the change follows other states (Maryland, Delaware and Montana were cited) and that registration, exemptions and an opt-out sales default would protect small entities. "If you're generating revenue from the sale of data, you are probably collecting a more valuable data set," Maroney said in response to a question about proportionality.

The bill also tightens prior entity-level exemptions. Sponsors argued the previous GLBA cover had been claimed too broadly — for example, by vehicle manufacturers that shared precise location information — and that data-level exemptions better protected individuals without creating blanket carve-outs for large organizations. "The GLBA entity-level exemption was too broad," Maroney said on the floor.

Senators also debated hospital and nonprofit "closed-loop" referral systems that link health providers with social-service organizations. Senator Summers filed an amendment to restore hospital exceptions; the amendment failed on a roll call, and proponents noted section 9 preserves public-research and HIPAA-covered exemptions and internal-use exemptions for security and fraud prevention.

The amendment to SB 1356 was approved by roll call and the bill passed later in the session. The Senate recorded the amendment vote as passing and the final passage as "legislation passes" on the floor record. (Amendment and final tally appear in the official roll-call record.)

What comes next: The Senate-passed version now goes to the House for consideration; if adopted, the measure would go to the governor for signature. Supporters said it would give the attorney general stronger enforcement tools and give residents clearer rights when consequential decisions about them are made with algorithms. Opponents urged careful oversight of compliance costs for smaller firms.

Speakers quoted here and elsewhere in this article are taken from the Senate floor record and are attributed to the senators who spoke on the record: "We are creating a data broker registry," Maroney said during his summary; "You cannot take publicly available information down," he added when explaining limits on removing public-information sources.