On February 2, 2024, the Attorney General (AG) of Connecticut released a report detailing the actions of the AG to educate consumers and businesses and enforce compliance with the Connecticut Act Concerning Personal Data Privacy and Online Monitoring (CTDPA) since the new law took effect on July 1, 2023. In particular, the report provides:

• an overview of the CTDPA
• background on the Office of AG's privacy section and the efforts to prepare for implementation of the CTDPA, including a strong focus on outreach;
• a summary of the consumer complaints received under the CTDPA; and
• a discussion of early enforcement efforts.

The report concludes with recommendations for strengthening or clarifying the CTDPA's protections.

Moreover, the report highlights that since the CTDPA took effect it has issued many notices of violation (cure notices), as well as other broader information requests focused on privacy policies, sensitive data, teenagers' data, as well as other areas. The AG noted that while many companies took prompt steps to address concerns and have cooperated with information requests, many of these inquiries remain active and ongoing.

Notice recipients span various industries, including retail, fitness, event services, career services, parenting technologies, and home improvement. Deficiencies identified in the notices included:

• lacking disclosures (e.g., failure to incorporate notice of consumer rights under the CTDPA at all);
• inadequate disclosures (e.g., failure to sufficiently inform Connecticut residents about their rights under the law and/or how Connecticut residents may appeal denials);
• confusing disclosures (e.g., statements creating an impression that consumers may be charged for rights requests as a default, as opposed to only for manifestly unfounded, excessive, or repetitive requests);
• lacking rights mechanisms (e.g., failure to include a clear and conspicuous link to a webpage enabling consumers to opt out of the targeted advertising or sale of their data);
• burdensome rights mechanisms (e.g., rights mechanisms that did not take into account the ways consumers normally interact with the company); and
• broken/inactive rights mechanisms (e.g., non-working links or dead-end mechanisms).

You can read the press release here and the report here.