Connecticut consumer health data rules for advertisers: the CTDPA, the 2025 and 2026 amendments, and geofencing

The first layer is section 42-526. It applies to "persons that conduct business in this state" or target residents, regardless of the act's usual thresholds (42-526(a)(2)). The second layer is the general CTDPA, which treats consumer health data as sensitive data (42-515, sensitive data).

Exemptions. Section 42-526 does not apply to HIPAA covered entities and business associates, financial institutions or data subject to GLBA, colleges, state bodies and some others (42-526(b)). Unlike the general act, the list in 42-526(b) does not name nonprofit organizations. Hospitals and plans therefore fall under HIPAA rather than this section; the HIPAA marketing rule covers their communications.

What the statute says. Before 1 July 2026, a controller could not process sensitive data "without obtaining the consumer's consent" (42-520(a)(4)). Public Act 25-113 rewrote the duty. A controller may not process sensitive data "unless such processing is reasonably necessary in relation to the purposes for which such sensitive data are processed and without obtaining the consumer's consent" (42-520(a)(1)(D), as amended). We read that as requiring both conditions; the point is listed for counsel.

Consent must be a "clear affirmative act". Accepting broad terms, hovering over or closing content, and agreement obtained through dark patterns do not count (42-515(7)). Consumers must be able to revoke it as easily as they gave it.

Targeted advertising has a defined scope. It means ads chosen from data about a person's activity across nonaffiliated sites or apps. Ads based on activity on the controller's own sites, on the current page or search, and processing solely to measure frequency, performance or reach are excluded (42-515, targeted advertising). Consumers may opt out of targeted advertising and sales, including through an opt-out preference signal (Public Act 25-113, section 9).

An example. A fertility app user in Hartford logs cycle data. The app wants to show that user ads on other sites for its premium tier. The cycle data is consumer health data and so sensitive data. Using it to pick ads on other sites is targeted advertising, which needs consent and, since July 2026, reasonable necessity for a disclosed purpose (42-520, as amended). Showing the same upgrade offer inside the app is excluded from "targeted advertising".

What practitioners do (practice, not law). Many Connecticut flows pass consent and opt-out status in the Global Privacy Platform (GPP) string so that a supply-side platform (SSP) and its buyers can read it. The GPP and TCF implementation guide shows the fields.

What the statute says. No person may "use a geofence to establish a virtual boundary that is within one thousand seven hundred fifty feet of any mental health facility or reproductive or sexual health facility". The ban applies to identifying, tracking, collecting data from or notifying a consumer about the consumer's health data (42-526(a)(1)(C)). A covered facility is one where at least 70% of services are mental health, or reproductive or sexual health, care (42-515(23) and (36)). General hospitals and pharmacies are not named.

From 1 October 2026 a second rule applies. "No controller shall sell any consumer's precise geolocation data", and the same words bind third parties (Public Act 26-64, sections 14 and 15). Precise means within a radius of 1,750 feet. The ban has no consent exception in its text and is not limited to health locations.

Data brokers. Public Act 26-64 also bars data brokers from selling or licensing brokered personal data on or after 1 January 2027 unless registered with the Department of Consumer Protection (section 2).

Before. The general act applied to businesses that handled data of at least 100,000 consumers, or 25,000 with more than a quarter of revenue from data sales (42-516).

After. From 1 July 2026 it applies to businesses that handled data of at least 35,000 consumers, that "control or process consumers' sensitive data", or that offer personal data for sale (Public Act 25-113, section 6). A small telehealth start-up or a niche health publisher with a few hundred Connecticut users can now be a controller under the full act. Section 42-526 already reached them.

The statute. The Attorney General has "exclusive authority" to enforce. From October 2023 to the end of 2024, the AG had to offer health data controllers a 60-day cure where a cure was possible. Since 1 January 2025 a cure is discretionary, and "the sensitivity of the data" is one factor (42-525(b)-(c)). Nothing in these sections creates a private right of action, and the private CUTPA action in 42-110g does not apply (42-525(d)-(e)). Under CUTPA, the AG may recover up to $5,000 per wilful violation and up to $25,000 per violation of an injunction (42-110o).

The AG's reports. The third annual CTDPA enforcement report, covering 2025, was released in February 2026 (Troutman Pepper Locke, 10 February 2026). It describes an investigation of a hormonal fertility tracking app whose privacy notice did not account for the health data rules. It also takes the position that processing sensitive data without telling consumers about heightened risks is unlawful, even when they volunteer it.

The report urges the legislature to remove entity-level exemptions, including the one for HIPAA covered entities. Kelley Drye's summary adds an investigation of a data broker offering advertising SDKs, cookie-banner sweeps and testing of opt-out signals (Kelley Drye, 2 March 2026).

We found no published settlement under 42-526 as of 9 November 2026.

Maryland takes the stricter route of banning sensitive data sales outright; see Maryland's MODPA sensitive data rules. New York's pending bill would add a separate authorization regime; see New York's Health Information Privacy Act. The planned US state privacy laws tracker and the ad tech compliance hub cover the rest.

1. Connecticut General Assembly, General Statutes chapter 743jj, Data Privacy and Security, sections 42-515 to 42-526 with history notes (2025 revision), checked 9 November 2026. https://www.cga.ct.gov/current/pub/chap_743jj.htm
2. Connecticut General Assembly, 2026 Supplement to the General Statutes, chapter 743jj (amendments from the 2025 session). https://www.cga.ct.gov/2026/sup/chap_743jj.htm
3. Connecticut General Assembly, Public Act 25-113 (SB 1295, 2025, approved 24 June 2025), sections 5 to 18 effective 1 July 2026. https://www.cga.ct.gov/2025/ACT/PA/PDF/2025PA-00113-R00SB-01295-PA.PDF
4. Connecticut General Assembly, Public Act 26-64 (SB 4, 2026), "An Act Concerning Consumer Privacy and Protection" (approved 27 May 2026). https://www.cga.ct.gov/2026/ACT/PA/PDF/2026PA-00064-R00SB-00004-PA.PDF
5. Connecticut General Assembly, Public Act 23-56 (SB 3, 2023), "An Act Concerning Online Privacy, Data and Safety Protections" (approved 26 June 2023). https://www.cga.ct.gov/2023/ACT/PA/PDF/2023PA-00056-R00SB-00003-PA.PDF
6. Connecticut General Assembly, General Statutes chapter 735a, Unfair Trade Practices, section 42-110o. https://www.cga.ct.gov/current/pub/chap_735a.htm
7. Troutman Pepper Locke, "2025 CTDPA Enforcement Report Issued" (10 February 2026). https://www.troutmanprivacy.com/2026/02/2025-ctdpa-enforcement-report-issued/
8. Kelley Drye, "Connecticut's Privacy Report Highlights Rising Expectations for Businesses" (2 March 2026). https://www.kelleydrye.com/viewpoints/blogs/ad-law-access/connecticuts-privacy-report-highlights-rising-expectations-for-businesses