Memorandum
Connecticut Passes Comprehensive New Privacy Law
May 19, 2022
On May 10, 2022, Connecticut’s Senate Bill 6 titled “An Act Concerning Personal Data Privacy and Online
Monitoring” (CTDPA) was signed by Governor Ned Lamont, making Connecticut the fifth state to enact its own
comprehensive consumer privacy law, after California, Colorado, Utah and Virginia. 1

Does CTDPA Cover My Organization?
CTDPA, which takes effect on July 1, 2023, applies to individuals and entities that conduct business in the state ofConnecticut or produce products or services targeted to Connecticut residents, if they control or process personal
data of at least (i) 100,000 Connecticut consumers or (ii) 25,000 Connecticut consumers, if they derive more than
25% of their gross revenue from the sale of personal data. Unlike in California, CTDPA does not automaticallycover businesses with revenues above a certain threshold.
Exempt entities include (i) state and local governments; (ii) nonprofits; (iii) higher education institutions;(iv) registered national securities associations; (v) financial institutions and data subject to the Gramm-LeachBliley Act; and (vi) Health Insurance Portability and Accountability Act (HIPAA) covered entities and businessassociates. Exemptions also exist for 16 data categories, including protected health information under HIPAA,
information subject to the Fair Credit Reporting Act, de-identified data and employee and job applicant data.
Further, CTDPA excludes payment transaction data, publicly available data and data from individuals “acting in acommercial or employment context.”

Does My Organization Already Comply?
If your organization complies with the California Consumer Privacy Act (CCPA) and the EU or UK General Data
Protection Regulation (GDPR) and is prepared for compliance with the California Privacy Rights Act (CPRA) andthe Virginia and Colorado privacy statutes, it already substantially complies with CTDPA, because yourorganization should already:• Make multiple disclosures about how and why it processes and discloses personal data;• Have a process set up to allow consumers to exercise their “opt out” rights in certain circumstances

1 This memorandum is a high-level summary of the new law. For detailed questions, please consult one of the authors.

Simpson Thacher & Bartlett LLP

Memorandum – May 19, 20222(including personal data “sales” and targeted advertising) and display contact information for submitting
consumer requests in its privacy policy;• Use reasonable data security practices;• Not collect or process personal data unnecessarily, discriminate against consumers for exercising their legal
data rights, or process “sensitive data” 2 without opt-in consent;• Conduct data protection assessments when processing sensitive data, selling data, or conducting targeted
advertising or profiling in certain circumstances;• Include necessary data privacy terms in all relevant vendor contracts; and• Have contracts with all of its processors that lay out the parties’ obligations with respect to personal data. 3

What Else Is To Be Done?
CTDPA requires opt-in consent to sell or process for targeted advertising the personal data of individuals who are
13-16 years old, which is similar to the CPRA, which requires similar consents for consumers under 16. (Forpersons under 13, CTDPA requires personal data to be processed in compliance with the Children’s Online Privacy
Protection Act (COPPA)). For CTPDA-covered organizations, your website privacy policy must also alert
Connecticut residents as to their CTDPA rights.

Remedies
Violating CTDPA is considered an unfair trade practice under the Connecticut Unfair Trade Practices Act(CUTPA), but there is no private right of action. The Connecticut Attorney General (AG) may seek equitable
remedies under CUTPA and/or damages up to $5,000 per willful violation. Until December 31, 2024, there is amandatory 60-day cure period before the AG can take action, and after such date, the cure period is at theAG’s discretion.

2 E.g., data relating to race, ethnic origin, religion, health, sexual orientation, citizenship or immigration status, genetic or biometric data,geolocation data or data relating to children.

3 These required provisions are substantially similar to those cited in Virginia and Colorado’s forthcoming consumer privacy laws.

Simpson Thacher & Bartlett LLP

Memorandum – May 19, 2022

3

For further information regarding this memorandum, please contact one of the following authors:
NEW YORK CITY
Lori E. Lesser+1-212-455-3393
llesser@stblaw.com

Jessica N. Cohen+1-212-455-7736
jessica.cohen@stblaw.com

Nicholas S. Goldin+1-212-455-3685
ngoldin@stblaw.com

Bobbie Burrows+1-212-455-2333
bobbie.burrows@stblaw.com

Melanie D. Jolson+1-212-455-3346
melanie.jolson@stblaw.com

Jonathan S. Kaplan+1-212-455-3028
jonathan.kaplan@stblaw.com

Jacob Lundqvist+1-212-455-3348
jacob.lundqvist@stblaw.com

Kate E. Mirino+1-212-455-2055
kate.mirino@stblaw.com

Alysha J. Sekhon+1-212-455-3762
alysha.sekhon@stblaw.com

PALO ALTO
Harrison J. (Buzz) Frahn+1-650-251-5065
hfrahn@stblaw.com

Corina McIntyre+1-650-251-5073
corina.mcintyre@stblaw.com

WASHINGTON, D.C.
Vanessa K. Burrows+1-202-636-5891
vanessa.burrows@stblaw.com

The contents of this publication are for informational purposes only. Neither this publication nor the lawyers who authored it are
rendering legal or other professional advice or opinions on specific facts or matters, nor does the distribution of this publication to
any person constitute the establishment of an attorney-client relationship. Simpson Thacher & Bartlett LLP assumes no liability inconnection with the use of this publication. Please contact your relationship partner if we can be of assistance regarding theseimportant developments. The names and office locations of all of our partners, as well as our recent memoranda, can be obtained
from our website, www.simpsonthacher.com.

Simpson Thacher & Bartlett LLP