Connecticut's Consumer Health Data Law

The threshold question comes first

This is where Connecticut genuinely differs. The CTDPA applies to businesses that conduct business in Connecticut or target Connecticut consumers and that meet volume-based thresholds — broadly, controlling or processing the personal data of a defined number of Connecticut consumers in a year, with a lower threshold where you derive a meaningful share of revenue from selling personal data. Certain entities and data types, including HIPAA-covered data and non-profits in some circumstances, are excluded.

The practical implication for a small business is significant: you can be comfortably below Connecticut's thresholds and still be fully in scope under Washington's law, which has no revenue or headcount exemption whatsoever. Don't let a "we're too small for Connecticut" conclusion carry over to your Washington analysis — see does WMHMDA apply to me.

Consumer health data as sensitive data

Once in scope, Connecticut classifies consumer health data as sensitive data. That designation carries most of the substantive protections:

• Consent before processing. You must obtain the consumer's consent before processing sensitive data, including consumer health data. Consent must be a clear affirmative act — not inferred from inactivity, pre-ticked boxes, or acceptance of general terms — and dark patterns invalidate it.
• No selling without consent. Selling sensitive data requires consent, and Connecticut's amendments specifically tightened the position on consumer health data.
• Data protection assessments. Processing sensitive data generally triggers an obligation to conduct and document a data protection assessment weighing the benefits against the risks to the consumer.
• Data minimisation and purpose limitation. Collection must be adequate, relevant and reasonably necessary for the disclosed purposes.
• Consumer rights. Access, correction, deletion, portability, and the right to opt out of targeted advertising, sale and certain profiling — with an appeal process where a request is refused.

The geofencing prohibition

Connecticut prohibits establishing a geofence within 1,750 feet of any mental health facility or reproductive or sexual health facility for the purpose of identifying, tracking, collecting data from, or sending advertisements to consumers about their health data or services. As in the other two states, this is an outright ban rather than a consent-based rule — you cannot ask permission to do it. Our geofencing explainer covers how these provisions tend to catch businesses out in practice, usually through an ad platform's location targeting rather than a deliberate decision.

Notice architecture: the quiet difference

Washington and Nevada expect a distinct, separately linked consumer health data privacy notice. Connecticut generally expects the disclosures to live inside your main CTDPA privacy notice. If you operate in all three states, the usual resolution is to maintain a dedicated consumer health data notice — because it satisfies the stricter requirements — and reference or incorporate it from your Connecticut-facing notice. Running the stricter architecture everywhere is normally simpler than maintaining divergent notices per state.

Enforcement and cure periods

The CTDPA is enforced by the Connecticut Attorney General; there is no private right of action, so class-action exposure of the kind Washington creates does not arise here. Connecticut has operated with a right-to-cure mechanism giving businesses an opportunity to fix violations after notice, though the availability and duration of cure periods has been subject to change over time — worth confirming the current position with counsel rather than assuming a grace period exists.

What this means if you're planning multi-state

Connecticut is generally the least demanding of the three for a small or mid-sized business, both because of the thresholds and because of the absence of private litigation risk. It is rarely the state that should drive your compliance timeline. The sensible sequence for most businesses is Washington first (no exemptions, private right of action, the largest downside), Nevada second, Connecticut third — and to check at each step whether the infrastructure you've already built satisfies the next state's specific wording.