CT SB00004: An Act Concerning Consumer Privacy And Protection.

In one paragraph

Connecticut's Public Act 26-64 (SB 4) targets data-driven pricing and surveillance. Businesses that use an automated price setting device fed by personal data (other than to set a discount) and advertise the price online must show "THIS PRICE WAS INCREASED BY A PRICE SETTING DEVICE USING YOUR PERSONAL DATA" or similar. Retailers and delivery apps may not use surveillance pricing. Data privacy act controllers using facial recognition on premises for security must match only against their own database and post entrance signs. It also requires data brokers to register, bans selling precise geolocation data, and adds genetic-testing consent rules. Signed May 27, 2026; effective October 1, 2026.

Plain-English summary, written with AI assistance. The official text controls.

What it means for business

From Oct. 1, 2026: label online prices set with a personal-data pricing tool (unless only for a discount); retailers and delivery apps may not use surveillance pricing; facial recognition for security needs your own database and signs; data brokers register by 2027.

Key provisions

1. 1Price setting device: any automated or programmed process that uses a consumer's personal data to set a price. A business using one (other than to set a discounted price) that advertises or promotes the price online must show, readily visible: "THIS PRICE WAS INCREASED BY A PRICE SETTING DEVICE USING YOUR PERSONAL DATA" or a substantially similar disclosure
2. 2Retail sellers and third-party delivery services may not engage in surveillance pricing: consumer-specific prices based on personal data collected through technology such as biometric monitoring, cameras, device tracking or sensors, gathered directly or bought from third parties
3. 3Not surveillance pricing: discounts on a consumer service to retain a customer; price differences justified by costs (such as selections, delivery distance or time) or timing (such as supply and demand); and discounts on publicly disclosed uniform terms, for broadly defined groups, or through loyalty programs consumers affirmatively join, if the seller prominently posts the discount and its terms online and offers it to all consumers on those terms
4. 4Insurers, GLBA-covered financial institutions and state-supervised banks are exempt; pricing violations are CUTPA violations enforced only by the Attorney General, with no private right of action
5. 5Data privacy act changes: a controller or consumer health data controller using facial recognition on its premises for security, fraud or illegal-activity purposes must match only against a database it exclusively maintains and post entrance signs with a link or QR code to its policy, which must give the Attorney General's contact information
6. 6Consumers may delete publicly available information collated into consumer profiles offered on public websites, or made available for sale, and inferences generated from it; controllers and third parties may not sell precise geolocation data
7. 7Data brokers must register with the Department of Consumer Protection ($2,500 a year) to sell or license brokered personal data from January 1, 2027; a statewide deletion mechanism follows by July 1, 2028; civil penalties up to $200 a day per violation
8. 8Signed May 27, 2026; all sections effective October 1, 2026. The tariff-label, license-plate-reader and employment-profiling provisions of earlier drafts were removed before passage

Latest legislative action

May 27, 2026. Signed by the Governor (Public Act 26-64)

Sponsors (showing 5 of 61)

Roll call votes (showing 3 of 5)

Amendments (3)

• Senate LCO Amendment #4076 (D) Not adopted 2026-04-14
• Senate LCO Amendment #4531 (D) Not adopted 2026-04-22
• Senate Schedule A LCO# 4531 (D) Not adopted 2026-04-22