Connecticut bans sale of precise geolocation data under new law

Connecticut began prohibiting the sale of its residents’ precise geolocation data on October 1. The rule is part of an expansion of the state’s privacy framework that also restricts the use of personal data to set prices, requires transparency for facial recognition and prepares a registry for data brokers.

The changes were approved in May through Public Act 26-64, known during the legislative process as SB 4, and supplemented by later amendments. They do not amount to a general ban on collecting location data or using facial recognition. The scope depends on the practice: selling precise geolocation is prohibited, while other uses are subject to consent, notice and accessible policy requirements.

What changes for location data and pricing

The most direct provision prevents companies from selling the precise location of any Connecticut resident. Previous law required consent when data was processed for a materially different purpose from the one disclosed to the consumer. The new language broadens that obligation: consent is required before any new purpose that is not reasonably necessary or compatible with the originally disclosed use.

The state also places limits on “surveillance pricing.” The term describes situations in which personal data is used to individually set or alter the price offered to a person. The law does not eliminate every form of personalized pricing, but it imposes restrictions and disclosure duties. It would therefore be inaccurate to say Connecticut banned all variable pricing.

Facial recognition and genetic data

Businesses that use facial recognition on their premises for security, fraud prevention or investigations must clearly notify consumers that the technology is operating. The notice must direct people, through a conspicuous link or QR code, to a policy explaining the practice.

Direct-to-consumer genetic testing companies also face new consent, retention and sharing obligations. According to Attorney General William Tong, consumers receive a property right and exclusive control over the collection, use, maintenance, disclosure and destruction of their samples and results.

Data broker registration starts in 2027

The law also creates a system for businesses that sell or license information about people with whom they have no direct relationship. Those data brokers must register with the Connecticut Department of Consumer Protection beginning January 1, 2027. The framework calls for a single mechanism that lets residents request deletion of their information across registered brokers, with additional requirements phased in over time.

The timeline matters because not every rule associated with Connecticut’s privacy and artificial intelligence package took effect at once. Provisions for chatbots offered to minors begin in January 2027, while other obligations have later dates. The October 1 milestone covers the core privacy expansion described above and certain provisions of the CART Act.

A test for state-level regulation

Without a comprehensive federal privacy law in the United States, states have been creating their own obligations. Connecticut now combines an objective prohibition — selling precise geolocation — with transparency and consent duties for other data practices.

One likely consequence is that companies serving Connecticut residents will have to separate data uses that were previously handled together. That is a regulatory inference, not a statement from the state government. The practical effect will depend on enforcement and on whether consumers can meaningfully use the new mechanisms.

The attorney general remains the primary enforcement authority, but the law includes exceptions and coverage limits. Not every Connecticut business is subject to the complete set of requirements, particularly when another sector-specific privacy framework already governs the data involved.