Connecticut Toughens Minor Data Privacy Rules
Regulators in Connecticut are signaling a move toward heightened enforcement of data privacy laws concerning minors. The state is expected to actively pursue actions against companies that misuse or fail to adequately protect children's data. This reflects a broader trend of increased regulatory scrutiny on how consumer products handle data from younger users.
- The Connecticut Data Privacy Act (CTDPA), which became effective in July 2023, had its expanded protections for minors under 18 take effect on October 1, 2024. - Attorney General William Tong's office is actively investigating multiple messaging apps, gaming platforms, and AI chatbot providers for how they collect and use data from children and teens. - Current rules require companies to get opt-in consent before processing data from consumers under 16 for targeted advertising or sale; for those under 13, consent must come from a parent or guardian. - A key provision of the law is a "duty of care," which requires online services to use reasonable care to avoid any heightened risk of harm to minors. - Violations of the CTDPA are considered an unfair trade practice and can lead to civil penalties of up to $5,000 per willful violation. - Further amendments set to take effect in July 2026 will completely ban targeted advertising and the sale of minors' data, removing consent as a workaround. - The upcoming 2026 changes will also prohibit the use of "addictive design features," such as autoplay and infinite scroll, intended to significantly prolong a minor's use of an online service. - The Attorney General's office has specifically signaled that AI is not a regulatory blind spot and is investigating a chatbot platform for design features that may have caused harm to minors.
