The Connecticut Office of the Attorney General (“OAG”) issued an updated Enforcement Report (“Enforcement Report”) under the Connecticut Data Privacy Act (“CTDPA”). The Enforcement Report discusses the OAG’s enforcement actions in 2025 and suggests some areas of focus from the regulator, summarized below.
- Data Breach Notices: The Enforcement Report states that the Attorney General’s office received 1,830 breach notifications in 2025 and issued 63 warning letters regarding companies’ alleged delays in providing notice after discovery of a data breach. The Enforcement Report states that the “statutory notice period [] run[s] from the date the company becomes aware of suspicious activity, not the date it determines full impact to personal information.” However, the Enforcement Report does not discuss how to apply this principle in the context of specific factual circumstances, such as where there is suspicious activity of some sort of security event without reasonable belief that Connecticut resident personal information was affected. The examples of enforcement discussed in the Enforcement Report include three examples where businesses provided notice between fourteen months and four years after a breach occurred.
- Opt-Out Rights: The Attorney General’s office notes that it was focused on cookie banners that “undermine or override consumers’ ability to make important privacy choices.” For example, the Enforcement Report notes that it should not be more difficult or time-consuming to “opt out” of targeted advertising or sale than to “opt in.” Although the underlying CTDPA does not require that controllers invite consumers to “opt in” to the use of such technologies, the Enforcement Report also suggests that companies may want to do more than the “bare minimum” in terms of complying with the CTDPA. Notably, the Connecticut law does not require the use of a cookie banner to comply with the targeted advertising opt-out requirements.
- Universal Opt-Out Preference Signals: The Enforcement Report highlights that universal opt-out provisions are an enforcement priority, specifically referencing the joint enforcement and resources developed with regulators in Colorado and California.
- Chatbots: The Enforcement Report states the Attorney General’s focus is on chatbots. The Enforcement Report specifically reflects that AI “has progressed to the point where interaction with a chatbot can be indistinguishable from interaction with a human” and emphasizes that the state’s privacy, data breach, and unfair and deceptive practices statute apply to the use of chatbots.