Connecticut CTDPA and Cookies: All You Need to Know

João Bruno Soares

The Connecticut Data Privacy Act (CTDPA, Public Act No. 22-15) has a specific requirement for the privacy notice that does not appear as explicitly in other US state privacy laws: the notice must include an **active email address** or other online mechanism that the consumer may use to contact the controller.

This page covers one piece of the picture. For the full scope of the CTDPA — who must comply, the thresholds, the consumer rights and the penalties — start with our [complete guide to the CTDPA and cookies](https://goadopt.io/en/blog/connecticut-CTDPA-and-cookies-all-you-need-to-know/).

It sounds simple. But it is an explicit requirement that many businesses overlook when building privacy policies for compliance with other legislation.

This article focuses exclusively on what the CTDPA requires from the Privacy Policy, based on the official text of the law.

## What the CTDPA calls a Privacy Notice

The law uses the term "privacy notice." In practice, it is the Privacy Policy that most sites already have, but with CTDPA-specific content elements.

Section 6(c) requires the controller to provide consumers with a privacy notice that is "reasonably accessible, clear and meaningful."

## What must be in the Privacy Policy under the CTDPA

### 1. Categories of personal data processed

The notice must list the categories of personal data processed by the controller (Section 6(c)(1)).

Categories must be described clearly enough for consumers to understand what types of data are being collected. This includes identifiers, behavioral data, geolocation data, communication data, and specifically whether sensitive data is in the list.

Sensitive data under the CTDPA (Section 1(27)) includes: racial or ethnic origin, religious beliefs, physical or mental health, sex life, sexual orientation, citizenship or immigration status, genetic or biometric data for identification, known children's data, and precise geolocation. If any of these categories are collected, they must be explicitly listed.

### 2. The purpose for processing

The notice must explain what the data is used for (Section 6(c)(2)).

The purpose must be specific enough for the consumer to understand the actual intent. The CTDPA prohibits processing for purposes incompatible with those disclosed, except with consent (Section 6(a)(2)).

If data is used for targeted advertising or sale, Section 6(d) requires clear and conspicuous specific disclosure about that use, along with the opt-out method.

### 3. How consumers exercise their rights and file appeals

The notice must describe how consumers can exercise the five rights guaranteed by the CTDPA, including how to appeal a controller decision (Section 6(c)(3)).

The five rights covered are: access and confirmation, correction, deletion, portability, and opt-out of targeted advertising, data sale, and solely automated profiling.

For exercising rights, Section 6(e)(1) requires the controller to establish one or more secure and reliable means, described in the privacy notice, taking into account:

The ways in which consumers normally interact with the controller.

The need for secure and reliable communication.

The controller's ability to verify the consumer's identity.

The controller cannot require creation of a new account, but may require use of an existing account.

### 4. Categories of personal data shared with third parties

The notice must identify the categories of personal data the controller shares with third parties (Section 6(c)(4)).

This includes analytics platforms, advertising tools, CRMs, payment processors, and any external service receiving user data. "Third party" under the CTDPA (Section 1(29)) excludes the consumer, the controller, the processor, and affiliates of the controller or processor.

### 5. Categories of third parties with whom data is shared

Beyond the categories of data, the notice must identify the categories of third parties receiving them (Section 6(c)(5)).

Categories such as "digital advertising platforms," "analytics tools," "marketing CRMs," and "payment processors" are valid examples. Categories must be identifiable enough for the consumer to understand who accesses their data.

### 6. Active email address or online contact mechanism

The notice must include an active email address or other online mechanism the consumer may use to contact the controller (Section 6(c)(6)).

This requirement is explicit and specific to the CTDPA. The consumer needs a direct contact channel with the controller available within the privacy notice itself, not just abstract rights and processes.

## Disclosure of targeted advertising and data sale

If the controller sells personal data to third parties or processes it for targeted advertising, Section 6(d) requires clear and conspicuous disclosure of this, along with the opt-out method.

Targeted advertising under the CTDPA (Section 1(28)): ads based on data from consumer activities over time across **nonaffiliated** websites or online applications. Contextual ads, own-site-based ads, and ads in response to consumer requests do not constitute targeted advertising.

## The mandatory opt-out link on the site

Beyond the privacy notice, Section 6(e)(1)(A)(i) requires the controller to provide a clear and conspicuous link on its website to a page enabling the consumer to opt out of targeted advertising or sale of personal data.

This link must be visible on the page, not buried in obscure menus or footers.

## The opt-out preference signal from January 2025

Section 6(e)(1)(A)(ii) requires that from **January 1, 2025**, controllers processing for targeted advertising or selling data allow opt-out via signal sent with consumer consent.

The mechanism cannot be a default setting: must represent an affirmative, freely given, and unambiguous consumer choice. The Global Privacy Control (GPC) is the best-known mechanism meeting these criteria.

The Privacy Policy must state whether the site honors these signals and how they work.

## Protection for sensitive data

Sensitive data requires consent before processing. The Policy must identify:

Whether any sensitive data category is collected.

For what specific purpose sensitive data is used.

How consent is obtained and can be revoked.

The revocation mechanism must be at least as easy as the consent mechanism. After revocation, processing must cease within **15 days** (Section 6(a)(6)).

## Special protection for teens aged 13 to 15

If the site may have users aged 13 to 15, the Privacy Policy must describe how the business obtains consent before processing data for targeted advertising or sale (Section 6(a)(7)).

A controller with actual knowledge that willfully disregards that a user is in this age range is subject to the law's sanctions.

## The right to portability and trade secrets

The CTDPA has a specific clause for portability (Section 4(a)(4)): the controller is not required to reveal trade secrets when providing data in portable format. The Policy may mention this limitation to set consumer expectations.

## The appeal process: 60 days, not 45

The appeal response deadline under the CTDPA is **60 days** (Section 4(d)), not 45 like the initial request deadline. The Privacy Policy must describe the appeal process with the correct deadline.

If the appeal is denied, the controller must provide the consumer with an online mechanism or other method to contact the Attorney General to submit a complaint.

## The duty not to discriminate

Section 6(a) expressly prohibits discrimination against consumers who exercise their rights, including denying goods or services, charging different prices, or offering different quality.

The exception is voluntary loyalty programs, rewards, premium features, discounts, or club card programs.

## Enforcement and penalties

CTDPA violations are treated as unfair trade practices by the **Connecticut Attorney General**. There is no private right of action.

From January 2025, the cure period is discretionary. The AG may or may not grant a correction period before acting.

## How AdOpt supports CTDPA compliance

AdOpt ensures that what is written in the Policy has real correspondence with what actually happens on the site.

The automatic scan identifies all active technologies, feeding the list of data categories and third parties. The [consent management platform](https://goadopt.io/en/blog/how-to-choose-cmp-consent-management-platform/) ensures the consent and opt-out mechanism works as described, the GPC is honored from January 2025, and consent revocations are processed within 15 days.

Every interaction is logged. If the AG requests evidence, the record is available.

Over 60,000 websites already run with AdOpt.

Privacy is not a banner. It is a position.

[Want to build a Privacy Policy for your site that complies with the CTDPA? Talk to our team.](https://meetings.hubspot.com/vrumor/adopt-meeting-valquiria)

## Checklist: what the Privacy Policy must contain for the CTDPA

**Visible and accessible link** on all pages of the site.

**Categories of personal data processed**, including sensitive data if collected (Section 6(c)(1)).

**Purpose for processing** each category (Section 6(c)(2)).

**How to exercise all 5 rights** guaranteed by the CTDPA, with processes and timelines (Section 6(c)(3)).

**Appeal process** with **60-day** deadline (not 45) (Section 4(d)).

**Categories of personal data shared with third parties** (Section 6(c)(4)).

**Categories of third parties** that receive data (Section 6(c)(5)).

**Active email address or online mechanism** for consumer contact with the controller (Section 6(c)(6)).

**Disclosure of targeted advertising or data sale** with accessible opt-out (Section 6(d)).

**Clear and conspicuous link** for opt-out on the site (Section 6(e)(1)(A)(i)).

**Opt-out preference signal**: statement of how GPC is processed from January 2025 (Section 6(e)(1)(A)(ii)).

**Treatment of sensitive data** with how consent is obtained and revoked.

**15-day deadline** for honoring consent revocation mentioned (Section 6(a)(6)).

**Protection for teens aged 13 to 15** described (Section 6(a)(7)).

**Non-discrimination policy** for consumers exercising rights (Section 6(a)).

## FAQ: CTDPA and Privacy Policy

**1. Why does the CTDPA require an active email or online mechanism in the Privacy Policy?**
Section 6(c)(6) specifically requires the privacy notice to include an active email address or other online mechanism the consumer may use to contact the controller. This ensures consumers have a direct communication channel available in the privacy document itself, not just abstract rights and processes.

**2. What is the difference between the response deadline for requests and for appeals in the CTDPA?**
For initial requests: 45 days, extendable by 45 more (Section 4(c)(1)). For appeals: 60 days, with no mentioned extension (Section 4(d)). The Privacy Policy must correctly describe both deadlines.

**3. Does the Privacy Policy need to mention the 15-day consent revocation deadline?**
Yes. Section 6(a)(6) requires the controller to cease processing within 15 days after receiving consent revocation. As this is unique among US state laws, it is important to explicitly mention this deadline in the Policy so consumers know what to expect.

**4. What is the opt-out preference signal and when does the CTDPA require it?**
It is a signal sent by a browser, extension, or device (like the GPC) communicating an opt-out preference. Section 6(e)(1)(A)(ii) makes it mandatory for controllers to honor these signals from January 1, 2025. The Privacy Policy must describe how these signals are processed.

**5. Does the Privacy Policy need to mention the protection for teens aged 13 to 15?**
Yes, if the site may have users in that age range. Section 6(a)(7) prohibits processing data for targeted advertising or sale of 13-to-15-year-old consumers without their consent when the controller has actual knowledge. The Policy must describe how consent is obtained for this specific group.

[Ready to build a Privacy Policy for your site that complies with the CTDPA? Talk to our team.](https://meetings.hubspot.com/vrumor/adopt-meeting-valquiria)

## Continue learning about Connecticut CTDPA compliance

Connecticut CTDPA compliance rests on documents that need to agree with each other: the [cookies policy](https://goadopt.io/en/blog/connecticut-ctdpa-cookies-policy/), which declares every tracker and its purpose; the [privacy portal](https://goadopt.io/en/blog/connecticut-ctdpa-dsar-privacy-portal/), which is where the consumer exercises their rights and you keep the record of it.

## Go further

To put this into practice, read what a [consent management platform (CMP)](https://goadopt.io/en/blog/what-is-a-cmp-consent-management-platform/) does.


Connecticut CTDPA: Privacy Policy

The Connecticut Data Privacy Act (CTDPA, Public Act No. 22-15) has two specific requirements for sites that process personal data for targeted advertising or sell personal data.

This page covers one piece of the picture. For the full scope of the CTDPA — who must comply, the thresholds, the consumer rights and the penalties — start with our [complete guide to the CTDPA and cookies](https://goadopt.io/en/blog/connecticut-CTDPA-and-cookies-all-you-need-to-know/).

The first is immediate: a clear and conspicuous link on the site to an opt-out page.

The second took effect on **January 1, 2025**: the obligation to honor opt-out signals sent by platforms, technologies, or mechanisms with consumer consent, such as the **Global Privacy Control (GPC)**.

This article focuses exclusively on what the CTDPA requires from a Cookies Policy: what must be in the document, how consent and opt-out must work, and what the law's specific requirements mean for each tracker on your site.

## Cookies Policy vs. cookie banner: the necessary distinction

The [cookie banner](https://goadopt.io/en/blog/how-to-choose-a-cookie-banner-for-your-website/) is the visual consent interface. It is what the visitor sees when they first access the site.

The Cookies Policy is the detailed document. It is where the user finds complete information about each technology: what it collects, what it is for, who receives the data, and how to exercise rights.

Both need to exist. Both need to be aligned. And the Cookies Policy must be accessible from a clear link within the [consent notice](https://goadopt.io/en/blog/operation-of-cookie-banner/) itself.

## What the CTDPA specifically requires for cookies

### Specific purpose for each category

Section 6(a)(1) requires the controller to limit collection to what is adequate, relevant, and reasonably necessary for the disclosed purposes. And Section 6(c)(2) requires the purpose to be in the privacy notice.

For cookies, each tracker category needs a specific purpose description, not a generic one.

What does not work: "cookies to improve your experience."

What works: "Analytics cookies: collect browsing behavior data including pages visited, traffic source, and session duration. Used to identify content improvement opportunities. Data is not sold or used for targeted advertising."

"Advertising cookies: collect behavioral identifiers shared with advertising platforms for targeted advertising on non-affiliated websites. Include pixels from Meta Ads and Google Ads. Consumers may exercise opt-out via the opt-out link on this page."

### Cookie categories present on the site

The Policy must list tracker categories:

**Necessary cookies:** essential for basic functionality. Do not constitute targeted advertising or data sale. Must be documented but do not require opt-out.

**Analytics cookies:** depends on configuration. If data stays internal, generally does not constitute targeted advertising. If sent to third parties for targeting on other sites, may qualify.

**Advertising cookies:** almost always constitute "targeted advertising" under the CTDPA, which defines it as ads based on data "obtained or inferred from the consumer's activities over time and across nonaffiliated Internet web sites or online applications" (Section 1(28)).

**Functional cookies:** remember preferences. Generally do not constitute targeted advertising or sale.

**Third-party cookies:** fired by external services. [Correct tag categorization](https://goadopt.io/en/blog/difference-cookies-local-storage-session-storage/) is what makes accurate documentation possible.

### Targeted advertising: non-affiliated websites

The CTDPA defines targeted advertising (Section 1(28)) as displaying ads based on personal data obtained or inferred from the consumer's activities over time and across **nonaffiliated** Internet web sites or online applications.

What does not constitute targeted advertising:

Advertisements based on activities within the controller's own websites or online applications.

Advertisements based on the context of a current search query or visit.

Advertisements directed to a consumer in response to an information request.

Processing personal data solely to measure or report advertising frequency, performance, or reach.

Retargeting campaigns using behavioral data from other sites therefore almost always constitute targeted advertising under the CTDPA.

### Sale of personal data

The CTDPA defines sale (Section 1(26)) as the exchange of personal data for monetary or other valuable consideration by the controller to a third party.

Not a sale: disclosure to processors, disclosure for products/services requested by the consumer, disclosure to affiliates, consumer-directed disclosure, publicly made available data, and M&A transfers.

If the site shares data with partners in exchange for services or other economic benefits, it may constitute a sale even without direct cash payment.

### Categories of third parties receiving data via cookies

The Policy must identify the categories of third parties receiving data via cookies (Section 6(c)(5)).

This includes digital advertising platforms, analytics tools, programmatic advertising networks, email marketing platforms receiving behavioral data, and any other partner receiving identifiers or user behaviors collected via cookie.

### Retention period

The obligation to limit collection to what is necessary (Section 6(a)(1)) implies data should also be retained only for as long as necessary. The Cookies Policy must document how long each cookie category stays active and how long data is retained in systems.

## The mandatory opt-out link

Section 6(e)(1)(A)(i) requires a clear and conspicuous link on the controller's website to a page enabling the consumer or their agent to opt out of targeted advertising or sale of personal data.

This link must be visible on the page, not in obscure locations. The Cookies Policy must identify this link and describe how the opt-out works.

## The opt-out preference signal from January 2025

Section 6(e)(1)(A)(ii) requires that from **January 1, 2025**, controllers processing for targeted advertising or selling data allow opt-out via signal sent with consumer consent.

In practical terms for cookies: when a user visits the site with the GPC activated in their browser, the site must interpret this signal as an opt-out of targeted advertising and data sale, and automatically block the corresponding trackers.

The mechanism must meet CTDPA-specific requirements (Section 6(e)(1)(A)(ii)):

Cannot unfairly disadvantage another controller.

Cannot be a default setting: must represent an affirmative, freely given, and unambiguous consumer choice.

Must be consumer-friendly and easy for the average consumer.

Must be as consistent as possible with similar mechanisms required by other laws.

Must enable the controller to accurately determine whether the consumer is a Connecticut resident.

When the opt-out signal conflicts with an existing controller-specific setting or loyalty program participation, the controller must comply with the signal but may notify the consumer of the conflict and give them the option to confirm their prior preference.

The Cookies Policy must describe how the site processes these signals.

## What constitutes valid consent for cookies under the CTDPA

Section 1(6) defines consent as a clear affirmative act signifying a consumer's freely given, specific, informed, and unambiguous agreement.

What is not valid consent:

Accepting general terms with data processing descriptions alongside unrelated information.

Hovering over, muting, pausing, or closing a piece of content.

Any agreement obtained through dark patterns.

Dark patterns are defined in Section 1(11) as interfaces designed or manipulated with the substantial effect of subverting or impairing user autonomy, decision-making, or choice, including any practice the FTC refers to as a dark pattern.

The correct standard for cookies: non-essential cookies off by default. The user chooses what to enable, not what to disable.

## Consent revocation in 15 days

If the user granted consent for non-essential cookies and then decides to revoke, Section 6(a)(6) requires the controller to:

Provide a revocation mechanism at least as easy as the consent mechanism.

Cease processing not later than **15 days** after receiving the revocation.

This 15-day deadline is exclusive to the CTDPA and means the [consent management platform](https://goadopt.io/en/blog/how-to-choose-cmp-consent-management-platform/) must be configured to process revocations promptly, not just log them.

## Protection for teens aged 13 to 15 via cookies

Section 6(a)(7) prohibits processing data of consumers aged 13 to 15 for targeted advertising or sale without their consent when the controller has actual knowledge of that age range.

If the site may have users in this range, the Cookies Policy must describe how advertising cookies are blocked for this audience and how consent is obtained when required.

## When to update the Cookies Policy

The CTDPA does not specify a minimum privacy notice update frequency like the CCPA/CPRA does. But Section 6(a)(2) prohibits processing for purposes not disclosed without consent, and Section 6(a)(1) requires limiting collection to what is necessary for the disclosed purposes.

In practice, situations requiring a Cookies Policy update:

Adding a new advertising pixel or tracker.

New analytics tool sending data to third parties.

New partner receiving behavioral data.

Change in the use of cookie data for new purposes.

Any modification to opt-out mechanisms.

Continuous [data mapping](https://goadopt.io/en/blog/what-is-privacy-by-design/) is what keeps the cookie inventory synchronized with the document.

## Enforcement and penalties

Violations are treated as unfair trade practices by the **Connecticut Attorney General**. There is no private right of action.

From January 2025, the cure period is discretionary. The AG may act without a guaranteed prior correction period.

## How AdOpt helps with the Cookies Policy under the CTDPA

AdOpt's automatic scan identifies all active technologies on the site, feeding the list of categories that must appear in the Cookies Policy.

The [cookie notice](https://goadopt.io/en/blog/operation-of-cookie-banner/) configured through AdOpt blocks non-essential trackers before acceptance, presents categories with clear descriptions, offers real opt-out options, detects and honors the GPC from January 2025, processes revocations within 15 days, and logs every interaction.

Over 60,000 websites already run with AdOpt.

Privacy is not a banner. It is a position.

[Want to build a Cookies Policy for your site that complies with the CTDPA? Talk to our team.](https://meetings.hubspot.com/vrumor/adopt-meeting-valquiria)

## Checklist: what your Cookies Policy needs for the CTDPA

**Visible link** in the footer and within the cookie banner.

**Listing of cookie categories** with a description of what each does.

**Specific purpose for each category**, without vague descriptions (Section 6(c)(2)).

**Identification of cookies constituting targeted advertising or sale** (Section 6(d)).

**Categories of third parties** receiving data via cookies (Section 6(c)(5)).

**Clear and conspicuous link** for opt-out of targeted advertising/sale on the site (Section 6(e)(1)(A)(i)).

**Opt-out preference signal**: description of how GPC is honored from January 2025 (Section 6(e)(1)(A)(ii)).

**15-day consent revocation**: mechanism and deadline described (Section 6(a)(6)).

**Non-essential cookies disabled by default**, without dark patterns (Section 1(11)).

**Protection for teens aged 13 to 15** described where applicable (Section 6(a)(7)).

**Retention period** for each cookie category.

**Active email address or online mechanism** for contacting the controller (Section 6(c)(6)).

**Accessible language**, without legal jargon.

**No cookie walls**.

## FAQ: CTDPA and Cookies Policy

**1. Is the CTDPA opt-out link different from the CCPA's "Do Not Sell" link?**
They are similar in function but different in requirement. The CCPA requires specific link texts: "Do Not Sell or Share My Personal Information" and "Limit the Use of My Sensitive Personal Information." The CTDPA simply requires a clear and conspicuous link to an opt-out page for targeted advertising or data sale, without mandating specific text. Businesses that already have the CCPA links likely satisfy the CTDPA requirement, depending on the link's scope.

**2. Is the CTDPA's opt-out preference signal the same as the GPC?**
The GPC is the best-known mechanism meeting the CTDPA's technical specifications. The law does not name the GPC specifically, but the GPC was developed precisely for this type of legal requirement. As long as the mechanism is an affirmative consumer choice (not a default), does not create unfair disadvantage for the controller, and allows verification that the consumer is a Connecticut resident, it meets Section 6(e)(1)(A)(ii).

**3. Does the 15-day consent revocation deadline apply to all cookies?**
It applies when consent is the basis for processing. For advertising cookies where the consumer gave consent and then revokes it, Section 6(a)(6) requires cessation within 15 days. For opt-outs of targeted advertising or sale (which do not require prior consent but rather an opt-out mechanism), the law does not specify the 15-day deadline, but requires cessation as soon as practicable.

**4. Do analytics cookies constitute targeted advertising under the CTDPA?**
It depends on the tool and configuration. If analytics data stays internal or is sent to the provider only to generate reports without use for targeting on other sites, it generally does not qualify. If the tool sends data used for targeting on other sites, it may. The CTDPA's criterion is data "obtained or inferred from activities across nonaffiliated websites" (Section 1(28)).

**5. Does the CTDPA require teens aged 13 to 15 to consent before any cookie?**
Section 6(a)(7) is specific: it prohibits processing data of 13-to-15-year-olds for targeted advertising or sale without their consent. It does not require consent for other types of processing such as internal analytics. The restriction applies when the controller has actual knowledge of the user's age.

[Ready to build a Cookies Policy for your site that complies with the CTDPA? Talk to our team.](https://meetings.hubspot.com/vrumor/adopt-meeting-valquiria)

## Continue learning about Connecticut CTDPA compliance

Connecticut CTDPA compliance rests on documents that need to agree with each other: the [privacy policy](https://goadopt.io/en/blog/connecticut-ctdpa-privacy-policy/), which explains what you do with the data; the [privacy portal](https://goadopt.io/en/blog/connecticut-ctdpa-dsar-privacy-portal/), which is where the consumer exercises their rights and you keep the record of it.


Connecticut CTDPA: Cookies Policy

The Connecticut Data Privacy Act (CTDPA, Public Act No. 22-15) has a few DSAR process peculiarities that set it apart from other US state privacy laws.

This page covers one piece of the picture. For the full scope of the CTDPA — who must comply, the thresholds, the consumer rights and the penalties — start with our [complete guide to the CTDPA and cookies](https://goadopt.io/en/blog/connecticut-CTDPA-and-cookies-all-you-need-to-know/).

The most important: opt-out requests **do not require authentication**, but the controller may deny them if it has a documented belief of fraud. And the appeal response deadline is **60 days**, not 45 like the initial request deadline.

This article covers all of it: what a DSAR is under the CTDPA, the five guaranteed rights, the specific deadlines, the authentication rules, and how to build a Privacy Portal that works for Connecticut law.

## What is a DSAR under the CTDPA?

DSAR stands for Data Subject Access Request, or Data Rights request in the language of the CTDPA. It is any formal request from a Connecticut resident to exercise the rights the law grants over their own data.

Under Section 4(b), the consumer exercises their rights by a secure and reliable means established by the controller and described in the privacy notice.

If you are already familiar with the [GDPR](https://goadopt.io/en/blog/gdpr-cookies-explained/) data subject rights framework, the structure will feel familiar. The CTDPA adds specific rules on opt-out authentication and the role of authorized agents via technology.

## What are consumer rights under the CTDPA?

Under Section 4(a), Connecticut residents have five rights:

### 1. Right to confirm and access

The consumer may confirm whether the controller processes their data and access the personal data (Section 4(a)(1)).

A CTDPA-specific limitation: if confirmation or access would require the controller to **reveal a trade secret**, the controller is not obligated to do so. This differs from other state laws that do not mention trade secrets in the access right context.

### 2. Right to correction

The consumer may request correction of inaccuracies in personal data, taking into account the nature of the data and the purposes of processing (Section 4(a)(2)).

### 3. Right to deletion

The consumer may request deletion of personal data provided by or obtained about them (Section 4(a)(3)).

For data obtained from third parties (not from the consumer themselves), the controller may comply by retaining only the deletion request record and the minimum data necessary to ensure the data remains deleted (without using that data for any other purpose), or by opting the consumer out of processing that data (Section 4(c)(5)).

### 4. Right to portability

The consumer may obtain a copy of data in a portable and, where technically feasible, readily usable format that allows transmission to another controller without hindrance, where processing is by automated means (Section 4(a)(4)).

The controller is **not required to reveal trade secrets** to fulfill a portability request.

### 5. Right to opt-out

The consumer may refuse processing of personal data for three purposes (Section 4(a)(5)):

Targeted advertising.

Sale of personal data (except as provided in Section 6(b) on loyalty programs).

Profiling in furtherance of **solely automated** decisions that produce legal or similarly significant effects.

The third point is the most important CTDPA distinction: the profiling opt-out applies only to **solely** automated decisions. If there is any human review in the final decision, this opt-out may not apply.

## What are the response deadlines?

Under Section 4(c)(1):

**45 days** to respond from receipt of the request.

Extension of **+45 days** when reasonably necessary, considering complexity and number of requests, with notification within the initial period.

**Free** once per consumer during any 12-month period (Section 4(c)(3)).

For manifestly unfounded, excessive, or repetitive requests: may charge a reasonable fee or decline, with the burden of demonstrating the excessive nature on the controller.

## The appeal process: 60 days, not 45

The CTDPA has a distinctive feature: the appeal response deadline is **60 days**, not 45 like the initial request deadline (Section 4(d)).

The appeal process must be:

Conspicuously available and similar to the request submission process.

Actionable within a reasonable period after the consumer receives the decision.

The response must include any action taken or not taken, along with a written explanation of the reasons.

If the appeal is denied, the controller must provide the consumer with an online mechanism, if available, or other method through which the consumer may contact the **Attorney General** to submit a complaint.

## Authentication: the special rule for opt-outs

The CTDPA has a different authentication rule for opt-outs (Section 4(c)(4)):

For exercising access, correction, deletion, and portability rights: the controller may deny if it cannot authenticate using commercially reasonable efforts. Must notify the consumer that authentication failed and additional information is needed.

For **opt-out requests**: the controller is **not required to authenticate**, but **may deny** if it has a good faith, reasonable, and documented belief that the request is fraudulent. If denying, it must send a notice to the requestor disclosing that it believes the request is fraudulent, why it believes so, and that it will not comply.

This distinction matters for Portal design: the opt-out channel must function without requiring verification, but the controller may have a fraud monitoring process.

## Authorized agents and opt-out signals

Section 5 allows the consumer to designate another person as an authorized agent to exercise opt-out rights on their behalf. This includes via technology such as an Internet link, browser setting, browser extension, or global device setting.

The controller must comply with an opt-out from an authorized agent if it can verify, with commercially reasonable effort, the consumer's identity and the agent's authority.

From **January 1, 2025**, controllers processing for targeted advertising or selling data must accept opt-outs via signal sent with consumer consent (Section 6(e)(1)(A)(ii)). This includes the GPC.

## What should the request submission channel look like?

Section 6(e)(1) requires the controller to establish and describe in the privacy notice one or more secure and reliable means for submitting requests. The means must take into account:

The ways consumers normally interact with the controller.

The need for secure and reliable communication.

The controller's ability to verify the consumer's identity.

The controller cannot require creation of a new account. May require use of an existing account.

Additionally, Section 6(e)(1)(A)(i) specifically requires a clear and conspicuous link on the site to an opt-out page.

## How to process each type of DSAR in practice

### Access request

Receive and authenticate with commercially reasonable efforts.

Locate all personal data about this consumer in systems.

Check whether confirmation or access would reveal trade secrets: if so, may deny that specific part.

Prepare response in accessible format within 45 days.

### Correction request

Receive and authenticate.

Identify the inaccurate data.

Correct in primary systems.

Confirm to the consumer within 45 days.

### Deletion request

Receive and authenticate.

Check whether a legal exception allows retaining the data.

For data obtained from third parties: choose between deleting outright or opting the consumer out of all processing.

Confirm to the consumer what was done.

### Portability request

Receive and authenticate.

Generate a portable data file without revealing trade secrets.

Deliver securely within 45 days.

### Opt-out of targeted advertising and data sale

Receive the request (via Portal, site link, or opt-out signal like GPC).

No authentication required; however, monitor for fraud signals.

If there is reasonable, documented suspicion of fraud: notify the requestor.

Otherwise: cease processing for the indicated purposes.

If the opt-out signal conflicts with an existing controller-specific setting or loyalty program, comply with the opt-out but may notify the consumer of the conflict.

### Opt-out of solely automated profiling

Receive via Portal.

Assess whether the profiling in question is **solely automated** (no human review). If there is significant human review, the opt-out may not apply.

If solely automated: cease using the data for those decisions.

Inform the consumer of the outcome.

## What happens when the controller denies a request?

Under Section 4(c)(2), the controller must inform the consumer without undue delay, but not later than 45 days, with:

The justification for not taking action.

Instructions on how to appeal the decision.

## Consent revocation: 15 days

If the consumer had consented to processing of sensitive data or other consent-based processing and then revokes, Section 6(a)(6) requires:

A revocation mechanism at least as easy as the consent mechanism.

Cessation of processing not later than **15 days** after receiving the revocation.

This 15-day deadline must be factored into consent management systems and Privacy Portal operational processes.

## Special protection for children and teens

For known children (under 13 under COPPA): parents or legal guardians may exercise rights on the child's behalf (Section 4(b)).

For consumers under guardianship or conservatorship: the guardian or conservator may exercise rights on the consumer's behalf (Section 4(b)).

For teens aged 13 to 15: the controller cannot process data for targeted advertising or sale without their consent (Section 6(a)(7)).

## Protection against discrimination

Section 6(a) expressly prohibits discrimination against consumers who exercise their rights, including denying goods or services, charging different prices, or offering different quality.

The exception is voluntary loyalty programs, rewards, premium features, discounts, or club card programs.

## Enforcement: AG exclusively

Section 11(a) grants the Connecticut Attorney General **exclusive authority** to enforce the CTDPA. No District Attorneys are involved (unlike Colorado) and there is no private right of action.

From January 2025, the cure period is discretionary. The AG may consider multiple factors before acting or not.

## How AdOpt helps with the Privacy Portal

AdOpt logs every consent, opt-out, and revocation interaction with a timestamp and unique identifier. When the consumer exercises opt-out via Portal or via signal like the GPC, the system automatically updates the corresponding trackers.

The system processes consent revocations and ensures cessation within 15 days. AdOpt's auditable log serves as evidence of compliance for the Attorney General.

Over 60,000 websites already run with AdOpt.

Privacy is not a banner. It is a position.

[Want to build a Privacy Portal for your site that complies with the CTDPA? Talk to our team.](https://meetings.hubspot.com/vrumor/adopt-meeting-valquiria)

## Checklist: what the Privacy Portal needs for the CTDPA

**One or more secure and reliable channels** described in the privacy notice (Section 6(e)(1)).

**Clear and conspicuous link** on the site for opt-out of targeted advertising/sale (Section 6(e)(1)(A)(i)).

**Opt-out preference signal** honored from January 2025 (Section 6(e)(1)(A)(ii)).

**Coverage of 5 rights**: access/confirmation, correction, deletion, portability, opt-out.

**Profiling: only solely automated decisions** covered by the opt-out (Section 4(a)(5)(C)).

**Opt-out without mandatory authentication**: process accepting opt-outs without requiring verification (Section 4(c)(4)).

**Documented fraud denial process** if opt-outs are denied based on fraud suspicion, including mandatory notification.

**Authorized agents** accepted for opt-out via technology (Section 5).

**Deadlines**: 45 days for initial response (+45 ext.); **60 days** for appeals (not 45).

**Conspicuously available appeal process** similar to the original submission process.

**Reference to AG** provided when appeal is denied (Section 4(d)).

**Free** first request per 12-month period (Section 4(c)(3)).

**Consent revocation honored within 15 days** (Section 6(a)(6)).

**Parents/guardians** may exercise rights for children (Section 4(b)).

**Guardians/conservators** may exercise rights for consumers under protection (Section 4(b)).

**Teen 13-15 protection**: process for obtaining consent before targeted advertising/data sale.

## Comparison: Privacy Portal deadlines under the CTDPA

| Request type | Response deadline | Extension possible |
|---|---|---|
| Access, correction, deletion, portability | 45 days | +45 days with notification |
| Opt-out (no authentication required) | No specific deadline | Immediate recommended |
| Appeal of a decision | **60 days** | Not specified |
| Consent revocation | **Max. 15 days** | No extension |
| Cure period (general violations) | Discretionary (2025) | No guarantee |

## FAQ: CTDPA and Privacy Portal

**1. Why do opt-outs not require authentication under the CTDPA?**
Section 4(c)(4) establishes that the controller is not required to authenticate opt-out requests. The rationale is that opt-out is a basic right that should not have unnecessary barriers. The controller may, however, deny if it has a documented good-faith belief of fraud and must notify the requestor with the justification. This balances ease of exercising the right with protection against abuse.

**2. Why does the appeal have a 60-day deadline instead of 45 like initial requests?**
Section 4(d) explicitly establishes 60 days for appeal responses, while initial requests have a 45-day deadline (Section 4(c)(1)). The longer deadline for appeals likely reflects the need for more careful review of an already-made decision. There is no mentioned extension for appeal deadlines.

**3. Is the CTDPA profiling opt-out more restrictive than in other laws?**
Yes. Section 4(a)(5)(C) limits the profiling opt-out to **solely automated** decisions with legal or significant effects. Virginia's [VCDPA](https://goadopt.io/en/blog/virginia-vcdpa-and-cookies-all-you-need-to-know/) and Colorado's CPA cover such decisions without the sole-automation requirement. In practice, if the controller uses automated profiling but a human reviews and makes the final decision, the CTDPA profiling opt-out may not apply.

**4. Who can exercise rights on behalf of other consumers under the CTDPA?**
Section 4(b) allows parents or legal guardians to exercise rights on behalf of known children, and guardians or conservators to exercise rights on behalf of consumers under protective arrangements. Additionally, Section 5 allows any consumer to designate an authorized agent to exercise the opt-out, including via technology such as a browser extension or device setting.

**5. What happens if the controller denies an opt-out for fraud suspicion?**
Section 4(c)(4) allows denial if there is a good faith, reasonable, and documented belief that the opt-out is fraudulent. But it requires notification to the requestor with three elements: that the controller believes the request is fraudulent, why it believes so, and that it will not comply. Without this notification, the denial may itself constitute a violation of the law.

[Ready to build a Privacy Portal for your site that complies with the CTDPA? Talk to our team.](https://meetings.hubspot.com/vrumor/adopt-meeting-valquiria)

## Continue learning about Connecticut CTDPA compliance

Connecticut CTDPA compliance rests on documents that need to agree with each other: the [cookies policy](https://goadopt.io/en/blog/connecticut-ctdpa-cookies-policy/), which declares every tracker and its purpose; the [privacy policy](https://goadopt.io/en/blog/connecticut-ctdpa-privacy-policy/), which explains what you do with the data.


All posts

Connecticut CTDPA and Cookies: All You Need to Know

Connecticut CTDPA: Privacy Policy

Connecticut CTDPA: Cookies Policy

Connecticut CTDPA: DSAR Privacy Portal