← ALL REGULATIONS
Connecticut Data Privacy Act cookie rules, and the GPC signal.
Connecticut lets sites set advertising cookies without opt-in consent, but consumers must be able to opt out of targeted advertising and the sale of their data. Since 1 January 2025, an opt-out preference signal such as Global Privacy Control (GPC) has to be honoured as that opt-out.
CTDPA at a glanceOpt-out, opt-in for some data
- Applies to
- Controllers above the Act’s thresholds for how many Connecticut residents’ data they process; the Attorney General’s page has the current figures
- In force
- July 2023, with opt-out signals required since January 2025
- Enforced by
- Connecticut Attorney General
- Penalties
- Up to $5,000 per wilful violation, under the Connecticut Unfair Trade Practices Act
WHAT CTDPA REQUIRES
What Connecticut asks of a site that uses advertising cookies.
THE RULEHonour opt-out preference signalsSince 1 January 2025, controllers must treat a signal such as Global Privacy Control as a valid request to opt out of targeted advertising and sale.
WITH KATLAKatla honours Global Privacy Control: a visitor whose browser sends it is recorded as opted out, unless they have already made a choice.
THE RULEA clear opt-out of targeted advertisingConsumers need a clear and conspicuous way to opt out of targeted advertising and the sale of their personal data.
WITH KATLAIn US State Laws (CCPA) mode, the banner’s main button is "Do Not Sell or Share My Personal Information", and the marketing category is labelled as the sale or sharing of personal information. The wording follows California’s law; there is no Connecticut-specific label.
THE RULEConsent for sensitive dataProcessing sensitive data, such as health information or precise location, needs opt-in consent.
WITH KATLAKatla’s categories describe what cookies are for, not which data types they carry. A site that processes sensitive data can run Katla in GDPR mode, so nothing non-essential is set before an opt-in.
THE RULENo dark patternsConsent obtained through a dark pattern is not valid consent under the Act.
WITH KATLAIn CCPA mode the opt-out is the banner’s main button, on its first layer.
CTDPA questions, answered
A summary for website owners, not legal advice. Reviewed against the sources below.
- Is Global Privacy Control mandatory in Connecticut?
- Yes. Since 1 January 2025, controllers must honour opt-out preference signals such as Global Privacy Control as a request to opt out of targeted advertising and sale.
- Does Connecticut require a cookie banner?
- Not an opt-in one. It requires a clear way to opt out of targeted advertising and sale, and honouring opt-out signals.
- Is there still a cure period?
- Not automatically. The mandatory 60-day cure period ended on 31 December 2024; the Attorney General may still offer one.
- How does Katla treat Connecticut visitors?
- Auto mode reads the visitor’s timezone, and US timezones get the CCPA banner with its opt-out and GPC handling. You can also set the site to US State Laws (CCPA) mode for everyone.
See what your site sets before anyone asks.
The free plan scans your site, classifies every cookie and generates the policy, without a card. The cookie checker needs no account at all.