SB 4 is a broad consumer privacy and protection bill that expands Connecticut’s data privacy framework and adds new rules for data brokers, surveillance pricing, direct-to-consumer genetic testing companies, and streaming video advertising. The bill requires data brokers that sell or license brokered personal data in Connecticut to register with the Department of Consumer Protection, pay registration fees, disclose certain business and data practices, maintain privacy policies, and comply with a state-run accessible deletion mechanism that lets consumers request deletion of their personal data from registered brokers and their data service providers. It also requires public reporting by registered data brokers and authorizes the department to impose civil penalties for violations.
The bill also amends Connecticut’s existing consumer privacy law to strengthen consumer rights and controller obligations. It updates definitions of personal data, sensitive data, precise geolocation data, biometric data, consumer health data, and related terms; expands consumer rights to access, correct, delete, and opt out of certain processing; limits the sale of precise geolocation data; restricts the processing and sale of sensitive data, including data about minors; and requires processors and third parties to assist controllers in meeting privacy obligations. In addition, it creates new protections for genetic data and biological samples, including express-consent requirements, deletion and destruction rights, and restrictions on disclosure to employers, insurers, and marketers.
The bill’s impact on state law is substantial. It creates new statutory duties for data brokers and other businesses operating in Connecticut, establishes a dedicated data broker registration account, and gives the Commissioner of Consumer Protection rulemaking and enforcement authority. It also adds a separate consumer protection rule aimed at surveillance pricing, requiring disclosures when price-setting devices use personal data and prohibiting retail sellers and third-party delivery services from engaging in surveillance pricing, with enforcement treated as an unfair trade practice by the Attorney General. Finally, it adds a rule barring streaming video services from transmitting commercials louder than accompanying content, again enforced as an unfair trade practice.
Overall sentiment appears strongly supportive, as reflected in the large bipartisan vote margins at each stage, including 31-4 in the Senate and 139-6 in the House. The bill advanced through committee and floor votes with broad approval, suggesting general agreement with its privacy and consumer-protection goals. The absence of committee transcript material limits direct insight into debate, but the vote history indicates the measure was not especially controversial at the final stages.
The main points of contention likely center on compliance burdens, enforcement scope, and carve-outs. Data brokers and businesses subject to the new registration, deletion, audit, and disclosure requirements may view the bill as costly and operationally complex, while consumer advocates are likely to support the stronger deletion and transparency rights. Exemptions for financial institutions, HIPAA-covered entities, consumer reporting agencies, political committees, and certain business relationships, along with exceptions for loyalty programs, research, and legal compliance, indicate balancing efforts that may have been negotiated to address industry concerns.
The bill significantly revises Connecticut’s consumer privacy statutes by expanding definitions, strengthening consumer rights, and imposing new obligations on controllers, processors, third parties, and data brokers. It creates a new data broker registration regime under the Department of Consumer Protection, establishes a state-managed deletion mechanism, authorizes civil penalties, and adds a separate account to fund implementation. It also adds new restrictions on surveillance pricing, genetic data handling, precise geolocation data sales, and loud commercial advertising in streaming video services, while making violations enforceable as unfair trade practices in several sections.
The overall sentiment appears favorable and bipartisan. The bill passed key votes with comfortable margins, including strong support in both chambers, which suggests broad agreement with the consumer privacy and protection goals. The final vote history indicates the measure was generally well received despite its significant regulatory scope.
Likely areas of contention involve the bill’s compliance costs and regulatory reach, especially for data brokers, retailers, third-party delivery services, and genetic testing companies. Industry stakeholders may object to registration fees, deletion obligations, audits, and public disclosures, while privacy advocates likely support those provisions. Additional debate may have focused on the breadth of exemptions for financial services, health care, political committees, and certain business relationships, as well as the new surveillance pricing and streaming ad provisions.