Connecticut’s New Privacy Law Targets Data Brokers and Surveillance Pricing

Connecticut’s privacy debate moved beyond opt-out buttons in 2026. On May 27, the governor signed Public Act No. 26-64, a broad consumer-protection law that adds data-broker registration, expands consumer rights, restricts certain uses of precise location data, and addresses surveillance pricing. The law does not take effect all at once. That matters because the headline is immediate, while many operational obligations arrive later. A registration system for data brokers The act requires businesses that sell or license covered “brokered personal data” in Connecticut to register with the Department of Consumer Protection. The registration requirement begins January 1, 2027, and includes a $2,500 annual fee along with disclosure obligations. The definition is important. It is not limited to companies that call themselves data brokers. A business involved in lead generation, people-search services, marketing-data licensing, or another operation that sells identifying information may need to assess whether it falls within the law’s definition. Registration does not make a data practice safe or lawful. It creates a clearer regulatory handle: the state can identify who is operating in this market, what they say they collect, and how consumers can exercise their rights. One deletion request, many brokers The law directs Connecticut to establish a centralized deletion mechanism by July 1, 2028. The goal is familiar to anyone who has tried to remove themselves from people-search sites: one verified request should be able to reach multiple registered data brokers instead of forcing a person to repeat the same process across dozens of websites. Registered brokers will be required to check the mechanism at least every 45 days and comply with verified requests. The delay between enactment and launch gives the state time to build the system, but it also means the right is not an instant universal-delete button. The details of identity matching, verification, exceptions, and reporting will determine how useful it becomes. The law takes aim at surveillance pricing The act also addresses a practice often described as surveillance pricing: using personal data collected through tracking technologies to set a customized price for a consumer. Under the law, covered businesses using a “price setting device” online must provide a conspicuous disclosure stating: “THIS PRICE WAS INCREASED BY A PRICE SETTING DEVICE USING YOUR PERSONAL DATA.” The statute includes exceptions and other rules, so this is not a blanket ban on every loyalty discount or every form of dynamic pricing. It is a demand for disclosure and a limit on pricing that uses personal data in ways consumers may not see. That distinction is central. A price can be technically different because of inventory, time, or demand without being personalized surveillance pricing. The privacy concern arises when a business uses an individual’s behavior, inferred characteristics, or tracking history to decide what that specific person should pay. Precise location is not just another data field The act expands sensitive-data protections and prohibits controllers and third parties from selling consumers’ precise geolocation data. Location can reveal a person’s home, workplace, clinic visits, religious practice, political activity, or relationships without anyone publishing an explicit profile. Location is especially difficult for consumers to manage because it is collected indirectly: through apps, advertising identifiers, SDKs, Wi-Fi data, and apparently unrelated services. A person may never interact with a broker while a location trail is assembled about them. What businesses and residents should watch Businesses operating in Connecticut should map whether they sell or license brokered personal data, review pricing systems that rely on tracking, and document how precise location is handled. The act’s staged dates make a compliance calendar as important as a policy rewrite. Residents should watch for the deletion mechanism’s launch and keep records of their opt-out requests. They should also pay attention to price disclosures and challenge unclear explanations when a personalized price appears to be based on their behavior. Connecticut is adding another state-specific layer to an already fragmented privacy landscape. But it is also testing a broader idea: data brokers should be identifiable, deletion should be centralized, and a company should not be able to quietly turn surveillance into a price tag.