Connecticut Senate approves data-broker registry, bans sale of precise geolocation data

The Connecticut Senate on April 23 approved an amended substitute for Senate Bill 4, a sweeping consumer-privacy package that creates a state registry for data brokers and an accessible deletion mechanism allowing residents to request that brokers remove their personal data.

Sponsor Sen. John Maroney, chair of the General Law Committee, said the measure builds on the Connecticut Data Privacy Act and would require registered data brokers to re-register annually and to consult a state deletion portal every 45 days to remove information requested by residents. Maroney said the bill also tightens definitions for technologies such as facial recognition, prohibits the sale of precise geolocation data and requires clearer notice when businesses use individualized "surveillance pricing." He told colleagues that the Department of Consumer Protection (DCP) will operate the registry and build the deletion portal, funded in part by a $2,500 annual registration fee assessed on data brokers.

"This amendment is a strike-all amendment, which in effect becomes the bill," Maroney said in presenting the measure. "We create a data broker registry ... and an accessible deletion mechanism ... and we set protections for genetic and biometric data. We do not ban facial recognition outright but regulate its use and require disclosure." (Sen. Maroney)

Opposing and questioning senators repeatedly pressed Maroney on specific definitions and exemptions. Sen. Ciccarella asked whether a business that sells its own customer list would be treated as a data broker; Maroney and other proponents said the bill keeps a first-party/third-party distinction and exempts entities already regulated federally under statutes such as the Fair Credit Reporting Act or Gramm-Leach-Bliley. Maroney said the list of exemptions is in section 7 of the bill.

Senators also probed operational details: how identity verification will work for deletion requests, what information residents must provide and how DCP will verify those requests before forwarding bulk deletion instructions to brokers. Maroney said if the state cannot verify a request, the portal will place the resident in an opt-out posture prospectively rather than require deletion.

The measure includes a surveillance-pricing provision intended to curb individualized, secret price-setting: online tailored prices must be labeled and disclosed; in-person customized pricing that singles out an individual is generally prohibited, with exemptions for bona‑fide loyalty programs and certain delivery-cost differentials. Retail facial-recognition uses are limited to matching against an exclusive, store-maintained loss-prevention database; stores must post notice at public entrances and make a policy available online.

The bill gives enforcement authority over registration and deletion duties primarily to the Commissioner of Consumer Protection, who may impose civil fines (the amendment discussed a $200-per-day penalty for violations). It also references enforcement authorities and existing statutes that govern consumer protection enforcement.

Supporters argued the bill brings Connecticut in line with states that have begun to regulate data brokers and to give residents an easier way to exercise deletion rights. Opponents urged more protections for legitimate uses of aggregated data and questioned the costs and technical burdens on businesses that must categorize and scrub large datasets.

With amendments adopted on the floor, the Senate voted to pass the measure. The clerk announced the result and the bill was transmitted according to the Senate's calendar procedure.