The Connecticut Data Privacy Act (CTDPA, Public Act No. 22-15) has a few DSAR process peculiarities that set it apart from other US state privacy laws.

This page covers one piece of the picture. For the full scope of the CTDPA — who must comply, the thresholds, the consumer rights and the penalties — start with our complete guide to the CTDPA and cookies.

The most important: opt-out requests do not require authentication, but the controller may deny them if it has a documented belief of fraud. And the appeal response deadline is 60 days, not 45 like the initial request deadline.

This article covers all of it: what a DSAR is under the CTDPA, the five guaranteed rights, the specific deadlines, the authentication rules, and how to build a Privacy Portal that works for Connecticut law.

DSAR stands for Data Subject Access Request, or Data Rights request in the language of the CTDPA. It is any formal request from a Connecticut resident to exercise the rights the law grants over their own data.

Under Section 4(b), the consumer exercises their rights by a secure and reliable means established by the controller and described in the privacy notice.

If you are already familiar with the GDPR data subject rights framework, the structure will feel familiar. The CTDPA adds specific rules on opt-out authentication and the role of authorized agents via technology.

Under Section 4(a), Connecticut residents have five rights:

The consumer may confirm whether the controller processes their data and access the personal data (Section 4(a)(1)).

A CTDPA-specific limitation: if confirmation or access would require the controller to reveal a trade secret, the controller is not obligated to do so. This differs from other state laws that do not mention trade secrets in the access right context.

The consumer may request correction of inaccuracies in personal data, taking into account the nature of the data and the purposes of processing (Section 4(a)(2)).

The consumer may request deletion of personal data provided by or obtained about them (Section 4(a)(3)).

For data obtained from third parties (not from the consumer themselves), the controller may comply by retaining only the deletion request record and the minimum data necessary to ensure the data remains deleted (without using that data for any other purpose), or by opting the consumer out of processing that data (Section 4(c)(5)).

The consumer may obtain a copy of data in a portable and, where technically feasible, readily usable format that allows transmission to another controller without hindrance, where processing is by automated means (Section 4(a)(4)).

The controller is not required to reveal trade secrets to fulfill a portability request.

The consumer may refuse processing of personal data for three purposes (Section 4(a)(5)):

Targeted advertising.

Sale of personal data (except as provided in Section 6(b) on loyalty programs).

Profiling in furtherance of solely automated decisions that produce legal or similarly significant effects.

The third point is the most important CTDPA distinction: the profiling opt-out applies only to solely automated decisions. If there is any human review in the final decision, this opt-out may not apply.

Under Section 4(c)(1):

45 days to respond from receipt of the request.

Extension of +45 days when reasonably necessary, considering complexity and number of requests, with notification within the initial period.

Free once per consumer during any 12-month period (Section 4(c)(3)).

For manifestly unfounded, excessive, or repetitive requests: may charge a reasonable fee or decline, with the burden of demonstrating the excessive nature on the controller.

The CTDPA has a distinctive feature: the appeal response deadline is 60 days, not 45 like the initial request deadline (Section 4(d)).

The appeal process must be:

Conspicuously available and similar to the request submission process.

Actionable within a reasonable period after the consumer receives the decision.

The response must include any action taken or not taken, along with a written explanation of the reasons.

If the appeal is denied, the controller must provide the consumer with an online mechanism, if available, or other method through which the consumer may contact the Attorney General to submit a complaint.

The CTDPA has a different authentication rule for opt-outs (Section 4(c)(4)):

For exercising access, correction, deletion, and portability rights: the controller may deny if it cannot authenticate using commercially reasonable efforts. Must notify the consumer that authentication failed and additional information is needed.

For opt-out requests: the controller is not required to authenticate, but may deny if it has a good faith, reasonable, and documented belief that the request is fraudulent. If denying, it must send a notice to the requestor disclosing that it believes the request is fraudulent, why it believes so, and that it will not comply.

This distinction matters for Portal design: the opt-out channel must function without requiring verification, but the controller may have a fraud monitoring process.

Section 5 allows the consumer to designate another person as an authorized agent to exercise opt-out rights on their behalf. This includes via technology such as an Internet link, browser setting, browser extension, or global device setting.

The controller must comply with an opt-out from an authorized agent if it can verify, with commercially reasonable effort, the consumer's identity and the agent's authority.

From January 1, 2025, controllers processing for targeted advertising or selling data must accept opt-outs via signal sent with consumer consent (Section 6(e)(1)(A)(ii)). This includes the GPC.

Section 6(e)(1) requires the controller to establish and describe in the privacy notice one or more secure and reliable means for submitting requests. The means must take into account:

The ways consumers normally interact with the controller.

The need for secure and reliable communication.

The controller's ability to verify the consumer's identity.

The controller cannot require creation of a new account. May require use of an existing account.

Additionally, Section 6(e)(1)(A)(i) specifically requires a clear and conspicuous link on the site to an opt-out page.

Receive and authenticate with commercially reasonable efforts.

Locate all personal data about this consumer in systems.

Check whether confirmation or access would reveal trade secrets: if so, may deny that specific part.

Prepare response in accessible format within 45 days.

Receive and authenticate.

Identify the inaccurate data.

Correct in primary systems.

Confirm to the consumer within 45 days.

Receive and authenticate.

Check whether a legal exception allows retaining the data.

For data obtained from third parties: choose between deleting outright or opting the consumer out of all processing.

Confirm to the consumer what was done.

Receive and authenticate.

Generate a portable data file without revealing trade secrets.

Deliver securely within 45 days.

Receive the request (via Portal, site link, or opt-out signal like GPC).

No authentication required; however, monitor for fraud signals.

If there is reasonable, documented suspicion of fraud: notify the requestor.

Otherwise: cease processing for the indicated purposes.

If the opt-out signal conflicts with an existing controller-specific setting or loyalty program, comply with the opt-out but may notify the consumer of the conflict.

Receive via Portal.

Assess whether the profiling in question is solely automated (no human review). If there is significant human review, the opt-out may not apply.

If solely automated: cease using the data for those decisions.

Inform the consumer of the outcome.

Under Section 4(c)(2), the controller must inform the consumer without undue delay, but not later than 45 days, with:

The justification for not taking action.

Instructions on how to appeal the decision.

If the consumer had consented to processing of sensitive data or other consent-based processing and then revokes, Section 6(a)(6) requires:

A revocation mechanism at least as easy as the consent mechanism.

Cessation of processing not later than 15 days after receiving the revocation.

This 15-day deadline must be factored into consent management systems and Privacy Portal operational processes.

For known children (under 13 under COPPA): parents or legal guardians may exercise rights on the child's behalf (Section 4(b)).

For consumers under guardianship or conservatorship: the guardian or conservator may exercise rights on the consumer's behalf (Section 4(b)).

For teens aged 13 to 15: the controller cannot process data for targeted advertising or sale without their consent (Section 6(a)(7)).

Section 6(a) expressly prohibits discrimination against consumers who exercise their rights, including denying goods or services, charging different prices, or offering different quality.

The exception is voluntary loyalty programs, rewards, premium features, discounts, or club card programs.

Section 11(a) grants the Connecticut Attorney General exclusive authority to enforce the CTDPA. No District Attorneys are involved (unlike Colorado) and there is no private right of action.

From January 2025, the cure period is discretionary. The AG may consider multiple factors before acting or not.

AdOpt logs every consent, opt-out, and revocation interaction with a timestamp and unique identifier. When the consumer exercises opt-out via Portal or via signal like the GPC, the system automatically updates the corresponding trackers.

The system processes consent revocations and ensures cessation within 15 days. AdOpt's auditable log serves as evidence of compliance for the Attorney General.

Over 60,000 websites already run with AdOpt.

Privacy is not a banner. It is a position.

Want to build a Privacy Portal for your site that complies with the CTDPA? Talk to our team.

One or more secure and reliable channels described in the privacy notice (Section 6(e)(1)).

Clear and conspicuous link on the site for opt-out of targeted advertising/sale (Section 6(e)(1)(A)(i)).

Opt-out preference signal honored from January 2025 (Section 6(e)(1)(A)(ii)).

Coverage of 5 rights: access/confirmation, correction, deletion, portability, opt-out.

Profiling: only solely automated decisions covered by the opt-out (Section 4(a)(5)(C)).

Opt-out without mandatory authentication: process accepting opt-outs without requiring verification (Section 4(c)(4)).

Documented fraud denial process if opt-outs are denied based on fraud suspicion, including mandatory notification.

Authorized agents accepted for opt-out via technology (Section 5).

Deadlines: 45 days for initial response (+45 ext.); 60 days for appeals (not 45).

Conspicuously available appeal process similar to the original submission process.

Reference to AG provided when appeal is denied (Section 4(d)).

Free first request per 12-month period (Section 4(c)(3)).

Consent revocation honored within 15 days (Section 6(a)(6)).

Parents/guardians may exercise rights for children (Section 4(b)).

Guardians/conservators may exercise rights for consumers under protection (Section 4(b)).

Teen 13-15 protection: process for obtaining consent before targeted advertising/data sale.

1. Why do opt-outs not require authentication under the CTDPA?
Section 4(c)(4) establishes that the controller is not required to authenticate opt-out requests. The rationale is that opt-out is a basic right that should not have unnecessary barriers. The controller may, however, deny if it has a documented good-faith belief of fraud and must notify the requestor with the justification. This balances ease of exercising the right with protection against abuse.

2. Why does the appeal have a 60-day deadline instead of 45 like initial requests?
Section 4(d) explicitly establishes 60 days for appeal responses, while initial requests have a 45-day deadline (Section 4(c)(1)). The longer deadline for appeals likely reflects the need for more careful review of an already-made decision. There is no mentioned extension for appeal deadlines.

3. Is the CTDPA profiling opt-out more restrictive than in other laws?
Yes. Section 4(a)(5)(C) limits the profiling opt-out to solely automated decisions with legal or significant effects. Virginia's VCDPA and Colorado's CPA cover such decisions without the sole-automation requirement. In practice, if the controller uses automated profiling but a human reviews and makes the final decision, the CTDPA profiling opt-out may not apply.

4. Who can exercise rights on behalf of other consumers under the CTDPA?
Section 4(b) allows parents or legal guardians to exercise rights on behalf of known children, and guardians or conservators to exercise rights on behalf of consumers under protective arrangements. Additionally, Section 5 allows any consumer to designate an authorized agent to exercise the opt-out, including via technology such as a browser extension or device setting.

5. What happens if the controller denies an opt-out for fraud suspicion?
Section 4(c)(4) allows denial if there is a good faith, reasonable, and documented belief that the opt-out is fraudulent. But it requires notification to the requestor with three elements: that the controller believes the request is fraudulent, why it believes so, and that it will not comply. Without this notification, the denial may itself constitute a violation of the law.

Ready to build a Privacy Portal for your site that complies with the CTDPA? Talk to our team.