The Connecticut Data Privacy Act (CTDPA, Public Act No. 22-15) has a specific requirement for the privacy notice that does not appear as explicitly in other US state privacy laws: the notice must include an active email address or other online mechanism that the consumer may use to contact the controller.

This page covers one piece of the picture. For the full scope of the CTDPA — who must comply, the thresholds, the consumer rights and the penalties — start with our complete guide to the CTDPA and cookies.

It sounds simple. But it is an explicit requirement that many businesses overlook when building privacy policies for compliance with other legislation.

This article focuses exclusively on what the CTDPA requires from the Privacy Policy, based on the official text of the law.

The law uses the term "privacy notice." In practice, it is the Privacy Policy that most sites already have, but with CTDPA-specific content elements.

Section 6(c) requires the controller to provide consumers with a privacy notice that is "reasonably accessible, clear and meaningful."

The notice must list the categories of personal data processed by the controller (Section 6(c)(1)).

Categories must be described clearly enough for consumers to understand what types of data are being collected. This includes identifiers, behavioral data, geolocation data, communication data, and specifically whether sensitive data is in the list.

Sensitive data under the CTDPA (Section 1(27)) includes: racial or ethnic origin, religious beliefs, physical or mental health, sex life, sexual orientation, citizenship or immigration status, genetic or biometric data for identification, known children's data, and precise geolocation. If any of these categories are collected, they must be explicitly listed.

The notice must explain what the data is used for (Section 6(c)(2)).

The purpose must be specific enough for the consumer to understand the actual intent. The CTDPA prohibits processing for purposes incompatible with those disclosed, except with consent (Section 6(a)(2)).

If data is used for targeted advertising or sale, Section 6(d) requires clear and conspicuous specific disclosure about that use, along with the opt-out method.

The notice must describe how consumers can exercise the five rights guaranteed by the CTDPA, including how to appeal a controller decision (Section 6(c)(3)).

The five rights covered are: access and confirmation, correction, deletion, portability, and opt-out of targeted advertising, data sale, and solely automated profiling.

For exercising rights, Section 6(e)(1) requires the controller to establish one or more secure and reliable means, described in the privacy notice, taking into account:

The ways in which consumers normally interact with the controller.

The need for secure and reliable communication.

The controller's ability to verify the consumer's identity.

The controller cannot require creation of a new account, but may require use of an existing account.

The notice must identify the categories of personal data the controller shares with third parties (Section 6(c)(4)).

This includes analytics platforms, advertising tools, CRMs, payment processors, and any external service receiving user data. "Third party" under the CTDPA (Section 1(29)) excludes the consumer, the controller, the processor, and affiliates of the controller or processor.

Beyond the categories of data, the notice must identify the categories of third parties receiving them (Section 6(c)(5)).

Categories such as "digital advertising platforms," "analytics tools," "marketing CRMs," and "payment processors" are valid examples. Categories must be identifiable enough for the consumer to understand who accesses their data.

The notice must include an active email address or other online mechanism the consumer may use to contact the controller (Section 6(c)(6)).

This requirement is explicit and specific to the CTDPA. The consumer needs a direct contact channel with the controller available within the privacy notice itself, not just abstract rights and processes.

If the controller sells personal data to third parties or processes it for targeted advertising, Section 6(d) requires clear and conspicuous disclosure of this, along with the opt-out method.

Targeted advertising under the CTDPA (Section 1(28)): ads based on data from consumer activities over time across nonaffiliated websites or online applications. Contextual ads, own-site-based ads, and ads in response to consumer requests do not constitute targeted advertising.

Beyond the privacy notice, Section 6(e)(1)(A)(i) requires the controller to provide a clear and conspicuous link on its website to a page enabling the consumer to opt out of targeted advertising or sale of personal data.

This link must be visible on the page, not buried in obscure menus or footers.

Section 6(e)(1)(A)(ii) requires that from January 1, 2025, controllers processing for targeted advertising or selling data allow opt-out via signal sent with consumer consent.

The mechanism cannot be a default setting: must represent an affirmative, freely given, and unambiguous consumer choice. The Global Privacy Control (GPC) is the best-known mechanism meeting these criteria.

The Privacy Policy must state whether the site honors these signals and how they work.

Sensitive data requires consent before processing. The Policy must identify:

Whether any sensitive data category is collected.

For what specific purpose sensitive data is used.

How consent is obtained and can be revoked.

The revocation mechanism must be at least as easy as the consent mechanism. After revocation, processing must cease within 15 days (Section 6(a)(6)).

If the site may have users aged 13 to 15, the Privacy Policy must describe how the business obtains consent before processing data for targeted advertising or sale (Section 6(a)(7)).

A controller with actual knowledge that willfully disregards that a user is in this age range is subject to the law's sanctions.

The CTDPA has a specific clause for portability (Section 4(a)(4)): the controller is not required to reveal trade secrets when providing data in portable format. The Policy may mention this limitation to set consumer expectations.

The appeal response deadline under the CTDPA is 60 days (Section 4(d)), not 45 like the initial request deadline. The Privacy Policy must describe the appeal process with the correct deadline.

If the appeal is denied, the controller must provide the consumer with an online mechanism or other method to contact the Attorney General to submit a complaint.

Section 6(a) expressly prohibits discrimination against consumers who exercise their rights, including denying goods or services, charging different prices, or offering different quality.

The exception is voluntary loyalty programs, rewards, premium features, discounts, or club card programs.

CTDPA violations are treated as unfair trade practices by the Connecticut Attorney General. There is no private right of action.

From January 2025, the cure period is discretionary. The AG may or may not grant a correction period before acting.

AdOpt ensures that what is written in the Policy has real correspondence with what actually happens on the site.

The automatic scan identifies all active technologies, feeding the list of data categories and third parties. The consent management platform ensures the consent and opt-out mechanism works as described, the GPC is honored from January 2025, and consent revocations are processed within 15 days.

Every interaction is logged. If the AG requests evidence, the record is available.

Over 60,000 websites already run with AdOpt.

Privacy is not a banner. It is a position.

Want to build a Privacy Policy for your site that complies with the CTDPA? Talk to our team.

Visible and accessible link on all pages of the site.

Categories of personal data processed, including sensitive data if collected (Section 6(c)(1)).

Purpose for processing each category (Section 6(c)(2)).

How to exercise all 5 rights guaranteed by the CTDPA, with processes and timelines (Section 6(c)(3)).

Appeal process with 60-day deadline (not 45) (Section 4(d)).

Categories of personal data shared with third parties (Section 6(c)(4)).

Categories of third parties that receive data (Section 6(c)(5)).

Active email address or online mechanism for consumer contact with the controller (Section 6(c)(6)).

Disclosure of targeted advertising or data sale with accessible opt-out (Section 6(d)).

Clear and conspicuous link for opt-out on the site (Section 6(e)(1)(A)(i)).

Opt-out preference signal: statement of how GPC is processed from January 2025 (Section 6(e)(1)(A)(ii)).

Treatment of sensitive data with how consent is obtained and revoked.

15-day deadline for honoring consent revocation mentioned (Section 6(a)(6)).

Protection for teens aged 13 to 15 described (Section 6(a)(7)).

Non-discrimination policy for consumers exercising rights (Section 6(a)).

1. Why does the CTDPA require an active email or online mechanism in the Privacy Policy?
Section 6(c)(6) specifically requires the privacy notice to include an active email address or other online mechanism the consumer may use to contact the controller. This ensures consumers have a direct communication channel available in the privacy document itself, not just abstract rights and processes.

2. What is the difference between the response deadline for requests and for appeals in the CTDPA?
For initial requests: 45 days, extendable by 45 more (Section 4(c)(1)). For appeals: 60 days, with no mentioned extension (Section 4(d)). The Privacy Policy must correctly describe both deadlines.

3. Does the Privacy Policy need to mention the 15-day consent revocation deadline?
Yes. Section 6(a)(6) requires the controller to cease processing within 15 days after receiving consent revocation. As this is unique among US state laws, it is important to explicitly mention this deadline in the Policy so consumers know what to expect.

4. What is the opt-out preference signal and when does the CTDPA require it?
It is a signal sent by a browser, extension, or device (like the GPC) communicating an opt-out preference. Section 6(e)(1)(A)(ii) makes it mandatory for controllers to honor these signals from January 1, 2025. The Privacy Policy must describe how these signals are processed.

5. Does the Privacy Policy need to mention the protection for teens aged 13 to 15?
Yes, if the site may have users in that age range. Section 6(a)(7) prohibits processing data for targeted advertising or sale of 13-to-15-year-old consumers without their consent when the controller has actual knowledge. The Policy must describe how consent is obtained for this specific group.

Ready to build a Privacy Policy for your site that complies with the CTDPA? Talk to our team.