Connecticut expands privacy law with geolocation ban and data broker registry

The ban on selling precise geolocation data directly impacts ad-tech firms and streaming services using location-based targeting for high-value localized inventory. By adopting a California-style centralized deletion mechanism, Connecticut signals that 'opt-out of sale' is evolving into 'bulk deletion,' creating a higher operational burden for data aggregators. This shift forces a move away from third-party facial recognition datasets toward first-party, on-premises solutions for security. Organizations should watch for the state's rollout of the online deletion portal by 2028, which will likely serve as a blueprint for other East Coast regulators.

Connecticut’s legislative surge follows a broader trend of states sharpening existing privacy frameworks to match or exceed California’s standards. Per the International Association of Privacy Professionals (IAPP) in October 2025, eight states—including Colorado, Texas, and Virginia—have already amended their initial comprehensive privacy laws to add stricter secondary-use requirements and minor-specific protections. This 'versioning' of state laws reflects growing regulatory impatience with the lack of a cohesive federal standard, such as the stalled American Privacy Rights Act (APRA) proposed in April 2024.

The specific focus on 'surveillance pricing' in HB 5563 aligns with recent scrutiny from the Federal Trade Commission (FTC), which launched an inquiry into 'surveillance pricing' practices among massive retailers and software providers in mid-2024. Per a March 2025 report from the California Privacy Protection Agency (CPPA), California has already collected $3.3 million in registration fees from nearly 500 data brokers, demonstrating the revenue-generating potential of these registries. Connecticut’s $2,500 annual fee and 45-day deletion audit cycle mirror California's DROP platform, suggesting a move toward standardized multi-state compliance interfaces for data brokers by late 2026.