CTDPA and browser fingerprinting

What CTDPA says about fingerprinting

The Connecticut Data Privacy Act took effect on 1 July 2023 and is codified at Conn. Gen. Stat. §42-515 through §42-525. Connecticut imported almost all of VCDPA's statutory text verbatim, with three substantive changes that matter for fingerprinting: the penalty route is CUTPA rather than a stand-alone CTDPA enforcement mechanism, the 2023 amendment added consumer-health-data protections, and the Universal Opt-Out Mechanism requirement is binding.

Section 42-515(18) defines personal data as 'any information that is linked or reasonably linkable to an identified or identifiable individual', identical to the Virginia, Colorado, and now-template language. A device fingerprint hash used to recognise a returning Connecticut consumer falls inside that definition without further analysis.

What product teams underestimate about CTDPA is the CUTPA enforcement route. Connecticut's privacy statute does not have its own civil penalty schedule. The AG enforces through CUTPA, which makes any CTDPA violation a deceptive or unfair trade practice. CUTPA carries $5,000 per wilful violation in civil penalties under Conn. Gen. Stat. §42-110b, plus restitution, attorney's fees, and a three-year statute of limitations that is materially longer than most state-privacy enforcement windows.

When CTDPA applies to you

Section 42-516 applies the statute to controllers that conduct business in Connecticut or produce products or services targeted to Connecticut residents, and either (a) control or process the personal data of at least 100,000 Connecticut consumers in a calendar year, or (b) control or process the personal data of at least 25,000 Connecticut consumers AND derive more than 25% of gross revenue from the sale of personal data.

The 25% second-leg threshold sits between Colorado's 'any revenue' and Virginia's 50%. A controller that earns 30% of its revenue from selling fingerprint-derived audiences and processes 30,000 Connecticut consumers is inside CTDPA but might be outside CPA and VCDPA depending on the specific revenue mix.

Consumer is defined at §42-515(8) as a Connecticut resident acting in an individual or household context. Employees and B2B contacts are excluded, matching the cluster.

The opt-out triggers and how they apply to fingerprinting

Section 42-518 grants Connecticut consumers seven rights, including the right to opt out of targeted advertising, sale of personal data, and profiling that produces legal or similarly significant effects. The mechanical operation of each opt-out tracks VCDPA closely, with two Connecticut-specific notes.

First, the sale definition at §42-515(25) requires 'monetary or other valuable consideration', matching Colorado's broader formulation. Sharing fingerprint hashes with an ad-tech partner for mutual lift is more likely to count as sale in Connecticut than in Virginia.

Second, Connecticut treats profiling for 'access to or denial of financial services, housing, insurance, education enrolment, criminal-justice decisions, employment opportunities, healthcare services, or essential goods or services' as the qualifying decision categories. The list matches Colorado's regulations, not Virginia's narrower statutory phrasing.

The 2023 consumer-health-data amendment

Public Act 23-56, passed mid-2023 and effective for the consumer-health portion on 1 October 2023, added a new subchapter to CTDPA codified at Conn. Gen. Stat. §42-525(a) through §42-525(g). It defines 'consumer health data' as personal data that a controller uses to identify a consumer's physical or mental health condition or diagnosis. The amendment treats this category more strictly than CTDPA's general 'sensitive data' tier.

For fingerprinting, the consequence is that a fingerprint used as a join key in any inference about a consumer's health (purchase history that implies a medication, location patterns that imply a clinic visit, an ad-targeting segment labelled 'diabetics') is consumer health data under §42-525. Controllers must obtain explicit consent before processing it, may not sell it under any circumstances, and must conclude separate contracts with processors that touch the data. This is the strictest health-data rule of any state-privacy law outside Washington's My Health My Data Act.

Most general-purpose fingerprint deployments will never touch the consumer-health-data line. The risk surfaces in adjacencies: retail analytics pipelines that segment by purchase category, insurance-quote pages that fingerprint visitors, healthcare-adjacent SaaS products. Audit downstream uses, not just the fingerprint script itself.

Universal Opt-Out Mechanism handling

Section 42-518(c)(2) made Universal Opt-Out Mechanism support mandatory from 1 January 2025. The Connecticut AG's office has aligned with Colorado in recognising Global Privacy Control as the only valid UOOM. A fingerprinting script that fires before checking for the GPC header on a Connecticut browser is in violation of §42-518(c)(2), independent of any on-site opt-out the consumer may not have used.

The operational mechanic is the same as Colorado's: the GPC header check belongs upstream of the Benny call for any targeted-advertising or sale-flagged purpose. Benny is invoked once the controller's preference layer has cleared both the on-site CMP and the UOOM signal.

Territorial reach

CTDPA reaches any controller that conducts business in Connecticut or that produces products or services 'targeted to' Connecticut residents and meets one of the two thresholds. There is no physical-presence requirement. A SaaS in Bangalore or a fintech in São Paulo that meets the 100,000-consumer threshold for Connecticut residents owes CTDPA obligations on that subset of its user base.

CTDPA does not include a small-business carve-out by company size or revenue. The thresholds apply equally to a 12-person startup and a Fortune-500 enterprise.

How Benny the Doorman fits into a CTDPA-aware deployment

Three steps for a CTDPA-aware deployment. First, install a GPC header check upstream of every Benny call used for targeted advertising or sale-flagged purposes, the same upstream pattern Colorado requires, on the same CMP-resolves-then-Benny-fires sequence.

Second, complete and document a Data Protection Assessment under §42-522 before going live on any regulated purpose. The Connecticut DPA requirements are less prescriptive than Colorado's Rule 8 but materially more so than Virginia's statutory language, capture the processing activity, the categories of data, the recipients, the risks, and the mitigations.

Third, audit the downstream uses of the fingerprint to confirm they never cross into consumer health data. If your product is healthcare-adjacent, health insurance quoting, fitness segmentation, pharmacy delivery, assume §42-525 applies until counsel confirms otherwise, and architect the fingerprint flow to support opt-in consent and the no-sale prohibition.