Connecticut Data Privacy Act (CTDPA): deleting people-search profiles and your other rights

What changed on October 1, 2026

Before this change, the CTDPA excluded publicly available information, so a profile built from public records was hard to reach with a deletion request. You could delete what you'd given a site, but not necessarily what it had compiled about you.

Public Act 26-64 narrows that gap. Since October 1, 2026, your right to delete covers publicly available information a company has collated into a profile about you, whether it shows that profile on a website (paid or free) or offers it for sale. It also covers the inferences the company drew from that information.

Two limits. The right binds companies covered by the CTDPA, so check the thresholds below. And the law changed other definitions on the same date, including the exclusion for publicly available information, so expect some companies to test where the new line sits.

The data broker registry and one-stop deletion (coming, not live)

The same act sets up a registry. From January 1, 2027, a data broker can't sell or license brokered personal data in Connecticut unless it has registered with the Department of Consumer Protection, at $2,500 a year. The department has to publish the list of registered brokers.

By July 1, 2028, the department must run a deletion mechanism that lets you ask every registered data broker to delete your data in one request. Brokers will then have to process deletions at least every 45 days. Until that tool exists, you contact each broker yourself.

Who has to follow the CTDPA

The thresholds dropped on July 1, 2026. The law now covers companies that do business in Connecticut or target its residents and handled data on at least 35,000 Connecticut consumers in the previous year. Any company that processes sensitive data or offers personal data for sale is covered regardless of size. Before July 2026 the bar was 100,000 consumers, or 25,000 plus more than 25% of revenue from selling data.

Global Privacy Control

Since January 1, 2025, covered companies must honor an opt-out preference signal such as Global Privacy Control, sent with your consent from a platform that lets the company tell you're a Connecticut resident. If it conflicts with a loyalty-program setting, the signal wins.

Why a company can say no

Some companies are exempt, including government bodies, nonprofits, colleges, insurers, banks and credit unions. Since July 1, 2026 a financial company is no longer exempt just because the Gramm-Leach-Bliley Act applies to it, but data covered by the Gramm-Leach-Bliley Act (GLBA) still is, along with HIPAA health data, Fair Credit Reporting Act credit data and FERPA school records.

If a company cites one of these, that's likely why it's declining. Appeal, and complain to the Attorney General if the answer still looks wrong. Our guide on what to do when a company won't delete your data covers the next steps.

Where Serus fits

Until the state's one-request tool arrives in 2028, Connecticut's new deletion right still works one company at a time. Serus finds the data brokers and people-search sites that list you where you live, sends the deletion requests for you and checks whether your profile comes back. You can also do it yourself for free with the steps above.