Privacy Law Expansion Has Major Business Implications » CBIA

Source Domain: www.cbia.com

State lawmakers passed an expansive consumer privacy and consumer protection measure that reshapes how businesses handle personal data, pricing practices, and emerging technologies.

While the final version of SB 4 reflects meaningful improvements made in response to business community concerns—including clarity, exemptions, and enforcement limitations—the legislation still imposes new compliance obligations that companies will need to carefully assess.

The bill significantly expands state oversight of data brokers and allows data delete mechanisms for consumers, places new restrictions on surveillance pricing and automated price‑setting, creates rules for facial recognition surveillance technologies, and updates several portions of Connecticut’s existing consumer data privacy law.

“CBIA worked closely with legislators throughout the process to ensure the final bill avoids many unintended consequences, limits duplicative regulation, and provides guardrails for businesses operating in a competitive digital economy,” said CBIA’s vice president of public policy Chris Davis.

“Although all of our member’s concerns were not addressed in full, the final bill allows for more effective compliance and less punitive penalties for companies that inadvertently lapse in compliance.”

New Regulatory Framework

A central feature of SB 4 is the creation of a comprehensive regulatory regime governing data brokers—businesses that sell or license personal data about consumers.

Beginning Jan. 1, 2027, data brokers must register annually with the Department of Consumer Protection before selling or licensing brokered personal data in Connecticut.

Registration requires disclosure of business practices, privacy controls, and whether sensitive categories of data—such as minors’ data or precise geolocation information—are collected.

Each registration comes with a $2,500 annual fee.

Each registration…

Source