Climate
Privacy
Bob Dylan
Drones
Data Centers
AI Governance
2026 Maine Senate Race
Last Update: 08/01/2026 at 1:00 PM EST
State Attorneys General Tighten Privacy Rules
Coverage from Kelley Drye & Warren LLP, Future of Privacy Forum, and others
Articles
31
Active Days
165
The Topic
U.S. state regulators and lawmakers are tightening privacy rules around consumer rights, sensitive data, children’s services, data brokers, consent interfaces, and breach notifications. Connecticut’s 2025 enforcement report provides the clearest current view of this shift, while New Jersey’s data broker registration law and related actions in other states show broader movement toward more detailed oversight and stronger penalties. The practical effect is greater pressure on businesses to align privacy disclosures, rights-request processes, tracking technologies, vendor relationships, and incident response with actual data practices.
First Article: 01/01/00
Latest Article: 07/13/26
Summary
- Connecticut’s attorney general is focusing on incomplete privacy notices, delayed data-rights responses, deceptive cookie banners, and failures to honor universal opt-out signals.
- Connecticut reported 1,830 breach notifications and issued 63 warning letters over alleged delays, including cases involving lengthy gaps between suspicious activity and notice.
- Children’s privacy investigations increasingly cover messaging apps, gaming platforms, tracking SDKs, precise geolocation, and AI chatbots.
- New Jersey enacted annual registration requirements for data brokers and certain direct-to-consumer data collectors, with disclosures covering opt-outs, purchasers, breaches, minors’ data, and processors.
- New Jersey separately prohibits the sale or licensing of sensitive data and provides substantial civil penalties for registration failures and sensitive-data violations.
- State activity remains fragmented, with different approaches emerging across Connecticut, New Jersey, Minnesota, Florida, South Carolina, and Massachusetts.
History
The story now broadens beyond Connecticut and New Jersey to show a wider multi-state privacy enforcement push, with the emphasis shifting toward fragmented but converging rules across several states. Connecticut’s enforcement focus is also more specific on deceptive cookie banners and universal opt-out failures, while New Jersey’s framework is framed more clearly as an operational registration-and-penalty regime.
The update is more concrete: Connecticut’s story now centers on documented enforcement activity, while New Jersey’s framework has moved from prospective legislation to enacted registration and sensitive-data restrictions. The framing also broadens from general privacy-law adoption to more active oversight of ads, opt-out mechanics, minors, and data-broker conduct.
Featured
03-02-2026
Connecticut Attorney General in 2025 enforces CTDPA focusing on data rights requests, breach notices, and opt-out signals in Connecticut.
03-08-2026
Connecticut Attorney General William Tong released the 2025 Connecticut Data Privacy Act enforcement report, outlining privacy enforcement activity and business compliance expectations in Connecticut.
07-10-2026
New Jersey enacted A5328 on June 30, requiring annual registration for data brokers and data collectors and banning sensitive data sales with uncapped penalties.
Timeline: 165 Days
Hover over any logo to see coverage summary, click for full article.
Additional Articles
⭐⭐⭐⭐⭐
Connecticut Attorney General William Tong announces 1800 breach notifications in 2025 and seeks tighter privacy laws in Connecticut.
Connecticut lawmakers discuss dna privacy protections after the 23andMe breach.
Massachusetts House passes the Consumer Data Privacy Act, banning cellphone location data sales and adding a private right of action for privacy violations.
Massachusetts House passed consumer privacy legislation granting residents access, deletion, opt-out, and portability rights while restricting sensitive data sales and precise geolocation sales.
Massachusetts House passed consumer data privacy legislation in 2024, expanding rights and banning sale of precise geolocation data while creating AG rulemaking and private lawsuits.
New Jersey Division of Consumer Affairs will launch a 2027 public registry for data brokers and data collectors and restrict sensitive data sales under P.L.2026, c.25.
Connecticut passed SB 4 on precise geolocation, surveillance pricing, facial recognition, and one-click data broker deletion, pending Governor Ned Lamont action.
Connecticut passed a data broker registry requiring public listing of phone, address, and shopping data sellers, with implementation planned for 2027 amid federal proposals.
Delaware passed HB 380 on June 16, 2026 to amend the DPDPA, expanding sensitive data and increasing controller and third-party duties effective January 1, 2027.
New Jersey enacted A5328 on June 30, 2026, banning sensitive data sales and requiring data broker and data collector registry registration with disclosures and penalties.
Connecticut Governor Ned Lamont signed May 27, 2026 Senate Bill 4 to expand the Connecticut Data Privacy Act with a data broker registry, deletion mechanism, and new limits on precise geolocation, surveillance pricing, facial recognition, profiling, and genetic testing.
Privacy notice supplement for Colorado, Connecticut, Maryland, Nebraska, New Jersey, Nevada, Texas, and Washington describes rights to access, delete, and opt out of sale and targeted advertising, with state-specific health-data authorization rules.
Connecticut expanded the CTDPA through Public Act 25-113, adding profiling impact assessments and broader sensitive data and sale triggers effective in July and August 2026.
Connecticut privacy law amendments under Public Act 25-113 signed June 24, 2025 require affirmative opt-in consent for sensitive data sales and LLM training disclosures starting July 1, 2026.
Connecticut adopted Public Act No. 26-64 on May 27, 2026, expanding data broker duties and restricting precise geolocation sales and surveillance pricing for covered organizations.
Connecticut signed SB 4 on May 27, 2026, creating data broker registration and deletion mechanisms while restricting precise geolocation resale and surveillance pricing.
Connecticut signed SB 4 on May 27, expanding CTDPA deletion rights, creating a data broker registry, restricting surveillance pricing, and adding direct-to-consumer genetic testing protections.
New Jersey AB 5328 took effect June 30, 2026, requiring registration and sensitive data sales prohibitions for data brokers and data collectors.
⭐⭐⭐
Connecticut, Florida, South Carolina and Minnesota advanced enforcement and new privacy rules in 2025, focusing on deletion rights, children's privacy, foreign-adversary risks, and AI retention.
Connecticut Attorney General reports 2025 CTDPA enforcement actions on breach notices, opt-out rights, and chatbots.
US states and attorney generals tighten privacy rules in 2024 across the United States including Massachusetts.
Connecticut Senate passed S.B. 4 in 2024 to regulate data brokers, add a deletion system, and provide protections for genetic and biological data.
Connecticut House passed Senate Bill 4 in 2020s, regulating data brokers and adding consumer data deletion and restrictions on geolocation and facial recognition for Gov. Ned Lamont review.
CBIA opposed several Connecticut committee bills in 2026 that would expand employer privacy and cybersecurity duties, including data broker controls, geolocation limits, and massive-breach forensic reporting.
Connecticut lawmakers passed a data broker registry law in May, while Washington considers federal rules requiring similar registration and public directories.
Massachusetts lawmakers advance H.5472 establishing consumer data privacy rights, including consent limits for sensitive data and a precise geolocation sale ban.
Connecticut and New Jersey required data brokers to register and pay fees before selling personal data to third parties in 2026.
In the United States, data broker practices that collect and resell personal dossiers are linked to opt-out difficulties and large consumer harms from exposure and misuse.