Connecticut Children’s Privacy Laws (2026)

SB 5 (2026); Public Act No. 26-15

Enacted, not yet effective · Social media · effective 2028-01-01 · binds platforms, operators

Ages: under 18 (covered minor); the Sec. 39(c) warning label applies by default to every covered user the operator has not reasonably determined is not a minor

Requires: A covered operator of a 'covered platform' (one that, as a significant part of its service, recommends, selects or prioritizes text, images or video that users generate or share; platforms that primarily facilitate the sale of goods, or are used solely for educational purposes under a contract required by C.G.S. 10-234bb, are excluded) may not let a user reach any feed that recommends, selects or prioritizes user-generated media items based in whole or in part on information associated with the user or the user's device unless it has used commercially reasonable and technically feasible methods to determine that the user is not a covered minor (under 18) or, for a minor, has verifiable consent from a parent or legal guardian; narrow exceptions cover searches, subscriptions and other express requests, direct messages, user-chosen privacy or accessibility settings, device data, non-persistent signals and same-source sequences. An operator that tries but cannot determine age must presume the user is not a minor unless it gains actual knowledge otherwise, data collected for the age check or for consent may be used for nothing else and must be deleted immediately after the attempt unless other law requires keeping it, and the operator may not withhold, degrade or charge more for anything because of the feed restriction unless needed to comply. Every covered user the operator has not reasonably determined is not a minor must see the statute's black-bordered Surgeon General warning each day: on at least 75 percent of the screen for at least 30 seconds, with no way to dismiss it, at first access, then on at least 25 percent for at least 10 seconds (dismissible with an 'X') after three hours of use and after each further hour. A minor may not be sent feed notifications outside 8 a.m. to 9 p.m. Eastern without parental consent, and by default the operator must block those notifications, cap the personalized feed at one hour a day, limit viewing of, replies to and messaging with the minor to connected users, and block content that breaches its own community standards; a verified parent can reset the notification window, the daily cap and the connected-users mode. From 2028-03-01 operators must publish annual user, parental-consent, default-setting and daily-use statistics in a form the Attorney General prescribes, and violations of subsections (b) to (e) are CUTPA unfair or deceptive trade practices.

Litigation: No suit filed. NetChoice and CCIA testified against SB 5 during the legislative session; Connecticut is not listed on NetChoice's litigation center. Not enjoined.

Entry last reviewed 2026-10-01

SB 1295 (Public Act 25-113)

In force · Design code · effective 2026-07-01 · binds operators

Ages: Minors under 18 (consumers the controller has actual knowledge of, or wilfully disregards, are minors); under-13 parental consent satisfied via COPPA

Requires: A controller offering an online service, product or feature to consumers it knows (or wilfully disregards) are minors must use reasonable care to avoid any heightened risk of harm to minors, and may not use any system design feature to significantly increase, sustain or extend a minor's use of the service. It must provide default safeguards preventing adults from sending unsolicited communications to non-connected minors, may not deploy dark-pattern consent mechanisms, must limit precise geolocation collection to what is strictly necessary (with an on-signal), and must conduct data protection and profiling impact assessments addressing foreseeable harm to minors. It also may not process a known minor's personal data (i) for targeted advertising or any sale of personal data, (ii) unless the processing is reasonably necessary to provide the service, (iii) for a purpose other than the one disclosed at collection or beyond what is reasonably necessary for and compatible with it, or (iv) for longer than reasonably necessary; services used by and under the direction of an educational entity are exempt from these limits. Profiling a minor in furtherance of automated decisions with legal or similarly significant effects (such as lending, housing, insurance, education, employment or health care) is allowed only where reasonably necessary to provide the service and with the minor's consent, or a parent's or legal guardian's for a minor under 13, which COPPA-compliant verifiable parental consent satisfies.

Timing: in force since 2026-07-01 (PA 25-113 Secs. 14 to 16); separately, PA 25-113 Sec. 11 provides in 42-522(g)(2) that the CTDPA's 'Impact assessment requirements' apply to processing activities created or generated on or after 2026-08-01, while the minors' impact assessment in 42-529b(b) states no start date of its own

Litigation: No lawsuit or injunction against PA 25-113 identified. Not listed on NetChoice's litigation center. Not enjoined.

Entry last reviewed 2026-10-01

SB 6 (2022, Public Act 22-15); amended by SB 3 (2023, Public Act 23-56), SB 1295 (2025, Public Act 25-113) and SB 4 (2026, Public Act 26-64)

In force · Privacy law (minors) · effective 2023-07-01 · binds operators

Ages: Consumers known to be 13-17 (under 18); children under 13 handled per COPPA

Requires: Public Act 25-113 Sec. 9 repealed and replaced Conn. Gen. Stat. 42-520 effective 2026-07-01, so the operative rule is no longer an opt-in consent model. A controller may not process the personal data of a consumer for targeted advertising, and may not sell it, where the controller has actual knowledge of, or wilfully disregards, that the consumer is at least 13 and younger than 18. The consent exception that previously cured this was struck, so from 2026-07-01 it is a flat prohibition for known minors 13 to 17 rather than something a controller can obtain permission for. Personal data of a consumer known to be a child under 13 must still be processed in accordance with COPPA, and consent mechanisms may not use dark patterns to subvert user choice. Public Act 26-64 (SB 4, signed 2026-05-27) re-enacts Section 42-520(a) effective 2026-10-01 and carries the teen rule and the COPPA rule forward unchanged.

Entry last reviewed 2026-10-01

SB 5 (2026); Public Act No. 26-15, Secs. 4-6

Enacted, not yet effective · AI companion · effective 2027-01-01 · binds operators

Ages: All users (Sec. 5); the Sec. 5(b) hourly AI-disclosure notice applies to users under 18 with no knowledge qualifier, and the Sec. 6 duties apply where the operator knows or has reason to believe the user is under 18

AI chatbot access for minors: Safeguards only (enacted, applies from 2027-01-01).

Requires: Operators of an 'artificial intelligence companion' (a natural-language AI that gives adaptive, human-like responses and can sustain a relationship across multiple interactions) must meet safety and disclosure duties; carve-outs cover business chatbots used only for purposes such as customer service and not marketed as companions, game-limited chatbots, stand-alone voice assistants that do not sustain a relationship, curriculum-only school tools, non-anthropomorphic health-support tools, narrow task tools, and model providers that do not set the deployment. For every user, the operator must run, and post on its website, an evidence-based protocol that detects expressions of suicide, self-harm or imminent violence risk, blocks outputs encouraging them and refers the user to mental-health resources including 9-8-8, must take reasonable measures to stop the companion claiming to be human, and, where a reasonable person could think they were talking to a human, must give a clear AI notice that is either visible throughout or shown at the first interaction in each 24-hour period and then at least hourly for users under 18 or every three hours for adults (Sec. 5). Where the operator knows or has reason to believe a user is under 18, it must have industry-standard measures preventing the companion from encouraging self-harm, suicidal ideation, violence, disordered eating or unlawful alcohol or drug use, offering mental-health services unless four clinical and disclosure conditions are met, discouraging the user from seeking a licensed professional or an appropriate adult, encouraging harm to others, romantic or sexual interaction, eight listed manipulative engagement techniques (among them simulating distress when the user wants to leave and urging secrecy from parents) and engagement optimization that disregards those limits, and it must give minors and their parents tools to manage screen time and account settings; an operator that knew or had reason to believe, before providing the companion, that the user was 18 or older is not liable under the content duties (Sec. 6). Violations are CUTPA unfair or deceptive trade practices enforced solely by the Attorney General, and Sec. 5 expressly rules out a private right of action. These are Secs. 4 to 6 of the same act whose Sec. 39 social-media minors protections are tracked separately.

Litigation: None (effective 2027-01-01). NetChoice testified against SB 5 during the session.

Entry last reviewed 2026-10-01