Connecticut Public Act 26-64 says data brokers may not sell or license brokered personal data in the state after January 1, 2027 unless registered with the Department of Consumer Protection and disclosing how they handle deletion requests — with a 45-day deletion-platform check cycle following once the state's platform goes live on October 1, 2028, and geolocation-sale and surveillance-pricing rules landing even sooner, on October 1, 2026. RegisterCT is the prep pack that walks you through a broker's registration prep, ready for when you file, for a fraction of an hour of billed privacy-counsel time.
Two deadlines, one statute. The brokers who wait for January will discover October already applied to them.
The Situation
After January 1, 2027, a data broker may not sell or license brokered personal data in Connecticut unless registered with the Department of Consumer Protection. Connecticut becomes the fifth state with a broker registry — after California, Vermont, Oregon, and Texas — and those existing registries are public, so a company already listed on them has already identified itself, on the public record, as an in-scope data broker.
Registered brokers must disclose how they handle deletion requests starting January 1, 2027. The 45-day duty itself — checking the state-run deletion platform at least every 45 days — doesn't start until October 1, 2028, once Connecticut's platform is required to be established (by July 1, 2028). Connecticut is only the second state — after California's Delete Act — with a centralized deletion mechanism. A registration certificate doesn't satisfy either duty; a documented, repeating workflow does.
The sale of precise geolocation data (defined by a 1,750-foot radius) is banned in Connecticut starting October 1, 2026 — the fourth state to do so, after Maryland, Oregon, and Virginia. The same date brings surveillance-pricing restrictions enforced under CUTPA and new ALPR limits. If geolocation is anywhere in your data catalog, your first deadline is this fall, not next year.
Enforcement sits with the Connecticut Attorney General, the Department of Consumer Protection, and state agencies; there is no private right of action. The statute does carry a real number: under Section 10 — as amended by HB 5222 (Public Act 26-100, §43), effective October 1, 2026 — the Commissioner of Consumer Protection may impose a civil penalty of up to $200 per day, per consumer, for each violation of the registration provisions (Sections 2–8), after notice and a hearing. That per-consumer basis matters: the exposure scales with the number of consumers involved, not a single flat daily figure. Beyond the fine, the registry itself is public — Connecticut's, like the existing California, Vermont, Oregon, and Texas lists — so whether a given broker has registered is a matter of public record either way.
The Clock
Inside the Pack
Gathers the information a data broker commonly needs on hand before filing with the Department of Consumer Protection — a general-practice prep list based on existing state registries (not DCP's official form, which isn't published yet), so assembling your facts takes an afternoon instead of a discovery project.
An operational runbook for the state deletion-platform check cycle that begins October 1, 2028: who checks, on what calendar, how requests get processed and logged — the standing duty most brokers will miss.
Walk your data catalog against the 1,750-foot precise-geolocation definition before the October 1, 2026 ban — with a documented conclusion either way.
Map any pricing that varies on collected consumer data against the new CUTPA-enforced restrictions, with sign-off lines for the file.
Ready-to-adapt signage drafted to the statute's facial-recognition notice requirement, which takes effect October 1, 2026 under the amended Connecticut Data Privacy Act. Confirm exact required content and format with your counsel before posting.
The plain-language disclosure of how your company handles deletion requests, drafted to what the registration regime requires you to state.
Parts of Public Act 26-64 have already been touched by later amendments (HB 5222 and HB 5563), and more adjustment before the deadlines is entirely possible. When the operative requirements change, every buyer gets the revised pack free, with a redline of what changed and why. You're not buying a PDF frozen in May 2026 — you're buying a file that tracks the statute through both deadlines.
Pricing
Honest scope note: RegisterCT is a document pack and educational resource, not legal advice, and we are not your attorneys. It exists because most data brokers need their registration prep done and the compliance file built — including the 45-day workflow ready for when that duty starts in 2028 — not a five-figure engagement. When your situation needs a lawyer, Tier III says so out loud.
Objections, Handled
No — each state registry is its own filing, and Connecticut's arrives with something the other registries (except California's Delete Act) don't have: a state-run deletion platform you'll eventually have to check at least every 45 days (the platform must exist by July 1, 2028, and the 45-day checks start October 1, 2028). Your existing registrations actually cut the other way: they're public lists, so a company on them is on the public record as a data broker — visible to Connecticut's regulators as readily as to anyone else, and Connecticut's own registry will likewise be public once it opens. The pack maps what you've already disclosed elsewhere onto Connecticut's requirements so you're not starting from zero.
Because the deadlines aren't moving while you wait — October 1, 2026 and January 1, 2027 are in the statute, and amendments so far (HB 5222, HB 5563) have adjusted provisions, not erased the regime. Every buyer gets a free, redlined update when the operative requirements change. Buying now means your catalog audit, disclosure drafts, and deletion workflow are built months early; waiting means doing all of it in December alongside everyone else.
Straight answer: enforcement sits with the Connecticut Attorney General, the Department of Consumer Protection, and state agencies, and there is no private right of action — no lawsuit bounty-hunting. We won't inflate the exposure, but we will state the figure the statute actually sets: under Section 10 — as amended by HB 5222 (Public Act 26-100, §43), effective October 1, 2026 — the Commissioner of Consumer Protection may impose a civil penalty of up to $200 per day, per consumer, for each violation of the registration provisions (Sections 2–8), after notice and a hearing. The per-consumer wording is the part most early summaries miss: the amendment moved the penalty off a flat daily figure, so real exposure scales with the number of consumers affected. On top of the fine, selling brokered data in Connecticut without registration becomes prohibited conduct on a brand-new, public registry. RegisterCT's prep pack costs $199-299 and gets your registration prep and 45-day workflow ready ahead of its October 1, 2028 start — separate from the state's own $2,500 registration fee (Sec. 2(b)), which you pay directly to DCP regardless of how you prepare.
Check before you conclude that — the ban covers precise geolocation defined by a 1,750-foot radius, and location-adjacent fields (movement patterns, visit history, home/work inference) sit closer to that line than most catalogs assume. The Geolocation-Sale Audit Checklist exists to answer this with a documented conclusion instead of a hunch. If you genuinely carry nothing in scope, the audit is quick to complete and the dated sign-off still belongs in your file. The same date also brings surveillance-pricing restrictions under CUTPA, which reach pricing practices, not data types.
No. RegisterCT provides template documents and educational material about Connecticut Public Act 26-64. It is not legal advice and does not create an attorney-client relationship. For advice on your specific situation, consult a licensed attorney — and if you need one, ask us for the referral list.
The statute restricts selling or licensing brokered personal data in Connecticut — it's about where the data is sold, not where your office sits. If Connecticut consumers are in your datasets or Connecticut buyers are on your customer list, you're in the conversation, the same way out-of-state brokers register in California and Texas today. Multi-state brokers are exactly who a per-state filing layer is built for.