EveryAILaw.comDoes Connecticut CTDPA Amendments (SB 1295 / Public Act 25-113) require Transparency & Disclosure?
Connecticut • enforcing
Yes — 2 provisions
Requirements at a glance
This regulation imposes 9 specific requirements for Transparency & Disclosure across 2 provisions:
- Expanded opt-out — Consumers may opt out of profiling in furtherance of automated decisions with legal/significant effects — "solely automated" qualifier removed; now covers human-in-the-loop profiling
- Right to confirm — Consumers may confirm whether their data is being processed for profiling
- Right to explanation — Consumers may request explanation of profiling outcomes affecting them
- Data review and correction — Consumers may review data used in profiling decisions and correct inaccurate data
- Re-evaluation — Consumers may request re-evaluation after correcting data (especially in housing contexts)
- LLM training statement — The privacy notice must include a statement disclosing whether the controller collects, uses or sells personal data for the purpose of training large language models (§ 42-520(b)(1)(H))
- Notice currency — The same notice must state the most recent month and year during which the controller updated it (§ 42-520(b)(1)(I)), so a stale LLM training statement is visible on its face
- Publication — The notice must be published through a conspicuous hyperlink containing the word "privacy" on the web site home page, on the app store or download page and in the app settings menu where applicable, in every language in which the controller offers the covered product or service, and in a manner reasonably accessible to and usable by individuals with disabilities (§ 42-520(b)(2))
- Material change notice — Where a controller makes a retroactive material change to its privacy notice or practices, it must comply with the change-notification duties in § 42-520(b)(3)
Expanded Consumer Opt-Out #
Requirements
| Requirement | Details |
|---|---|
| Expanded opt-out | Consumers may opt out of profiling in furtherance of automated decisions with legal/significant effects — "solely automated" qualifier removed; now covers human-in-the-loop profiling |
| Right to confirm | Consumers may confirm whether their data is being processed for profiling |
| Right to explanation | Consumers may request explanation of profiling outcomes affecting them |
| Data review and correction | Consumers may review data used in profiling decisions and correct inaccurate data |
| Re-evaluation | Consumers may request re-evaluation after correcting data (especially in housing contexts) |
Penalties
| Violation | Fine |
|---|---|
| Non-compliance | The act sets no penalty amount. A violation of §§ 42-515 to 42-524 is an unfair trade practice under Conn. Gen. Stat. § 42-110b, enforced **solely** by the Attorney General under § 42-525(a) and (e); § 42-110g, the CUTPA private action, is expressly inapplicable and § 42-525(d) bars any private right of action |
| Cure period | **No longer guaranteed.** The mandatory 60-day cure in § 42-525(b) ran 2023-07-01 to 2024-12-31 and has sunset. Since 2025-01-01, § 42-525(c) makes cure discretionary: the Attorney General may weigh the number of violations, the size and complexity of the controller, the nature and extent of its processing, substantial likelihood of public injury, safety of persons or property, whether the violation was likely human or technical error, and the sensitivity of the data. P.A. 25-113 does not amend § 42-525 |
Sources: CT SB 1295
Large Language Model Training Disclosure #
Tagged `sleeper` because the duty is AI-specific but lives inside a general consumer privacy act, so it binds by controller status rather than by anything the controller does with models. Every organization over the § 42-516 threshold — retailers, insurers, hospitals, employers — must now take a position in its published privacy notice on whether it collects, uses or sells personal data to train large language models, including the position that it does not. That makes it the first US statutory disclosure aimed squarely at training-data provenance and the cheapest available discovery tool: the notice is a dated public statement the Attorney General can hold a controller to. Note the statute says "large language models" specifically, not "artificial intelligence" or "automated decision systems", so a controller training a non-language model is outside the literal text.
Requirements
| Requirement | Details |
|---|---|
| LLM training statement | The privacy notice must include a statement disclosing whether the controller collects, uses or sells personal data for the purpose of training large language models (§ 42-520(b)(1)(H)) |
| Notice currency | The same notice must state the most recent month and year during which the controller updated it (§ 42-520(b)(1)(I)), so a stale LLM training statement is visible on its face |
| Publication | The notice must be published through a conspicuous hyperlink containing the word "privacy" on the web site home page, on the app store or download page and in the app settings menu where applicable, in every language in which the controller offers the covered product or service, and in a manner reasonably accessible to and usable by individuals with disabilities (§ 42-520(b)(2)) |
| Material change notice | Where a controller makes a retroactive material change to its privacy notice or practices, it must comply with the change-notification duties in § 42-520(b)(3) |
Penalties
| Violation | Fine |
|---|---|
| Non-compliance | The act sets no penalty amount. A violation of §§ 42-515 to 42-524 is an unfair trade practice under Conn. Gen. Stat. § 42-110b, enforced **solely** by the Attorney General under § 42-525(a) and (e); § 42-110g, the CUTPA private action, is expressly inapplicable and § 42-525(d) bars any private right of action |
| Cure period | **No longer guaranteed.** The mandatory 60-day cure in § 42-525(b) ran 2023-07-01 to 2024-12-31 and has sunset. Since 2025-01-01, § 42-525(c) makes cure discretionary: the Attorney General may weigh the number of violations, the size and complexity of the controller, the nature and extent of its processing, substantial likelihood of public injury, safety of persons or property, whether the violation was likely human or technical error, and the sensitivity of the data. P.A. 25-113 does not amend § 42-525 |
Sources: Public Act 25-113 (enacted text)