Connecticut Attorney General William Tong announced that expanded protections under the Connecticut Data Privacy Act (CTDPA) took effect July 1, adding new safeguards aimed at protecting children online while strengthening privacy rights for all Connecticut residents.
Under the updated law, companies are now prohibited from selling or using minors’ personal data for targeted advertising. Businesses are also barred from using addictive design features intended to keep children on their platforms longer, collecting a minor’s precise location unless it is necessary to provide the service, or profiling minors without consent. Direct messaging platforms must also include default settings that prevent adults from sending unsolicited messages to minors.
“For too long, Big Tech has treated our children like social media cash cows,” Attorney General Tong said. “Connecticut is now taking matters into our own hands with protections that limit harmful data collection, curb addictive features, and give families the control they need to keep children safe online.”
Tong said additional protections approved this year will take effect in 2028. Those measures include requiring parental consent before social media platforms can use algorithms for minors, default privacy and screen-time settings, restrictions on notifications between 9:00 p.m. and 8:00 a.m., and warning labels alerting young users to the potential mental health risks associated with social media.
The law also requires social media companies to annually report to the state the number of minors using their platforms, how many have parental consent to use recommendation algorithms, and the average amount of time minors spend on the platform each day.
Tong highlighted his office’s ongoing efforts to hold technology companies accountable, including an active investigation into Roblox over reports of child exploitation, a lawsuit against Meta alleging it knowingly designed addictive features targeting young users, and an ongoing investigation into TikTok.
The updated law also expands privacy protections for all Connecticut residents. Beginning July 1, the law applies to more businesses, broadens the definition of sensitive personal data, and gives consumers new rights, including the ability to obtain a list of companies that purchased their personal data, access inferences drawn from their information, and learn whether automated profiling is being used to make significant decisions about them.
Consumers may also challenge certain automated decisions, request explanations, review the personal information used to make those decisions, and, in housing-related cases, correct inaccurate information and request that decisions be reevaluated.
More information about the Connecticut Data Privacy Act, including frequently asked questions and the Attorney General’s 2025 enforcement report, is available on the Connecticut Attorney General’s website.