Attorney General Tong Releases Updated Report on Connecticut Data Privacy Act, Discloses Active Investigations Related to Safety of Children and Teens Online

Press Releases

02/05/2026

Attorney General Tong Releases Updated Report on Connecticut Data Privacy Act, Discloses Active Investigations Related to Safety of Children and Teens Online

(Hartford, CT) – Attorney General William Tong today released a new report on the Connecticut Data Privacy Act (CTDPA), detailing the Office’s actions in 2025 to enforce compliance with Connecticut’s data privacy law. The report discloses for the first time multiple active and ongoing investigations related to the safety of children and teens online across numerous platforms, including online messaging, gaming and chat bots.

The CTDPA, which took effect in July 2023, grants important data rights to Connecticut residents and solidifies critical privacy requirements for covered businesses. This is the Office’s third annual CTDPA report, and the first to reflect enforcement of the law’s expanded minors’ privacy protections that took effect October 1, 2024.

This report provides updates on (1) the Office’s broader privacy and data security efforts; (2) privacy-related consumer complaints received this year (3) our data breach notice review and enforcement efforts; and (4) our CTDPA enforcement efforts and priorities, including those related to minors’ privacy. The Report concludes with a summary of recent CTDPA amendments and key takeaways for businesses.

“Connecticut has one of the nation’s first and strongest data privacy laws, and the Office of the Attorney General is active and aggressive in protecting our rights to privacy, security and safety online,” said Attorney General William Tong. “In 2025, we held companies accountable for delayed and inadequate data breach notices and hidden consumer rights. We launched active and ongoing investigations into multiple platforms that may have exploited and exposed our kids and their sensitive data to unacceptable privacy and security risks online. Privacy and data security are not optional and companies that do business in our state must take these requirements seriously.”

"While we were one of the first states to grant our residents data privacy rights, this report makes it clear that we have more work to do. Too many of our residents' requests fall under one of the exemptions in the law, and the harms from companion chatbots were not anticipated 4 years ago when the original bill passed. It is clear that the move fast and break things mantra of big tech is causing real harm to our residents. I look forward to working together with the Attorney General, the governor and my colleagues to help rein in the harmful aspects of chatbots, so we can see the true benefits this technology promises," said State Senator James Maroney.

In 2025, the Office of the Attorney General opened and advanced investigations and inquiries, and undertook enforcement actions and outreach efforts to ensure awareness and compliance involving the collection, use, sale, and protection of consumer data, including matters involving:

• Connected vehicles and geolocation data;
• Social media platforms and messaging apps used by children and teens;
• Gaming platforms and app developers potentially using minors’ data for targeted advertising or sale;
• Chatbots and artificial intelligence products that pose risks to minors through their design features and unchecked content;
• Data brokers.

By the end of 2025, the Office had issued dozens of notices of violations and warning letters, finalized multiple data breach settlements, and resolved its first enforcement action under the CTDPA.

The report summarizes significant amendments to the CTDPA enacted for 2025. Key changes highlighted in the report include:

• Lowered thresholds for applicability, including that all sensitive data processing and all sales of personal data will be covered under the law.
• Stronger protections for minors’ data, including prohibitions on targeted advertising and sale of minors’ personal data;
• Broader definition of sensitive data, adding new categories such as disability or treatment information and non-binary or transgender status; and
• New disclosure requirement related to artificial intelligence, requiring companies to disclose whether personal data is used to train large language models.

The report also identifies areas where the state legislature could strengthen or clarify the CTDPA’s protections. Recommendations include:

• Narrowing the definition of “publicly available information” to ensure full coverage of data brokers and people search websites;
• Adopting a standalone genetic data privacy law;
• Enacting safeguards and legislation governing chatbot and AI products, particularly to protect children from manipulation and harm;
• Enhancing consumer rights, including by expanding the utility of the CTDPA’s universal opt-out provisions;

For more information about the CTDPA, visit the Attorney General’s FAQ Page.

This report was prepared by the entire Privacy Section. The Privacy Section includes assistant attorneys general Patrick Kania, Jordan Levin, Laura Martella, Kileigh Nassau, and John Neumon, legal investigator Carly Smedberg, paralegal specialist Casey Rybak, administrative assistant Diana Viera, and is led by Deputy Associate Attorney General and Section Chief Michele Lucan.

Twitter: @AGWilliamTong

Facebook: CT Attorney General

Media Contact:

Elizabeth Benton
elizabeth.benton@ct.gov

Consumer Inquiries:

860-808-5318
attorney.general@ct.gov