SB 4 — AN ACT CONCERNING CONSUMER PRIVACY AND PROTECTION.

(8) for a registration renewal application submitted on or after July 1, 2031, (A) whether the applicant has undergone an audit pursuant to subparagraph (A)(i) of subdivision (1) of subsection (d) of section 5 of this act, and (B) if the applicant has undergone an audit pursuant to subparagraph (A)(i) of subdivision (1) of subsection (d) of section 5 of this act, the most recent year for which the applicant submitted an audit report and the materials associated therewith to the department pursuant to subdivision (2) of subsection (d) of section 5 of this act;

LCO(d) 4The Department of 36Consumer SubstituteProtectionmay Billapprove No.and renew an application for registration as a data broker in accordance with the terms of an agreement between the department and the Nationwide Multistate Licensing System.

4 (d) The Department of Consumer Protectionmay approve and renew an application for registration as a data broker in accordance with the terms of an agreement between the department and the Nationwide Multistate Licensing System.

(NEW) (Effective October 1, 2026) No data broker shall sell or license any personal data in violation of the provisions of sections 1 to 9,10, inclusive, of this act or sections 42-515 to 42-526, inclusive, of the general statutes, as amended by this act.

Each registered data broker shallPublic establishAct aNo. privacy policy which, at a minimum, shall include measures to ensure that such registered data broker does not sell or license any personal data in violation of the provisions of sections 1 to 9, inclusive, of this act or sections 42-515 to 42-526, inclusive, of the general statutes, as amended by this act.

26-64 5 of 41 Substitute Senate Bill No.

4 shall establish a privacy policy which, at a minimum, shall include measures to ensure that such registered data broker does not sell or license any personal data in violation of the provisions of sections 1 to 10, inclusive, of this act or sections 42-515 to 42-526, inclusive, of the general statutes, as amended by this act.

(NEW) (Effective October 1, 2026) The Commissioner of Consumer Protection shall establish, and periodically update, an Internet web page on the Department of Consumer Protection's Internet web site disclosing:that:

(1) ForDiscloses, for each registered data broker, the information required under subsection (c) of section 2 of this act that was included in the application such registered data broker most recently submitted, and the department most recently approved for such registered data broker, under subsection (b) of section 2 of this act;

andand(2)providesaccess (2)to thetheaccessibledeletionmechanismestablished accessible deletion mechanism established by the commissioner pursuant to subsection (a) of section 5 of this act.

(NEW) (Effective October 1, 2026) (a) (1) Not later than JanuaryJuly 1, 2027,2028, the Commissioner of Consumer Protection shall establish an accessible deletion mechanism program.

(1)(A) Enables a consumer,consumer or the consumer's authorized agent, to (A)(i) submit a deletion request, in aaverifiable verifiable form and manner prescribed by the commissioner, without charge to the consumer or such authorized agent and in any language spoken by a consumer for whom LCOa 5registered ofdata 36broker Substitutehas Billcollected No.personal data, that all registered data brokers and data service providers delete the consumer's personal data, and (ii) specifically exclude one or more registered data brokers, andalldata service providersfor suchregistereddatabroker or brokers, from the consumer's deletion request;

4(B) Enables a registeredconsumer datato broker(i) hassecurely collectedsubmit, personalin data,a thatform alland registeredmanner dataprescribed brokersby andthe datacommissioner, service(I) providers delete the consumer's personalmotor data,vehicle andPublic (B)Act specificallyNo. exclude one or more registered data brokers, andalldata service providersfor suchregistereddatabroker or brokers, from the consumer's deletion request;

(2)26-64 Enables6 a consumer, or the consumer's authorized agent, to (A) securely submit additional personal data, in a form and manner prescribed by the commissioner, to aid in processing the consumer's deletion request, (B) determine the status of the41 consumer'sSubstitute deletionSenate request,Bill andNo. (C) not more frequently than once during any forty-five- day period, submit an update to the participating consumer's verified deletion request in a verifiable form and manner prescribed by the commissioner, without charge to such participating consumer or such participating consumer's authorized agent and in any language spoken by a consumer for whom a registered data broker has collected personal data;

(3)4 Enablesoperator's alicense registerednumber, dataand broker(II) additional personal data to determineaid whetherin aprocessing consumer,the orconsumer's theconsumer'sauthorizedagent,hasspecificallydeletion excludedrequest, (ii) determine the registeredstatus dataof broker,the consumer's deletion request, and all(iii) datanot servicemore providersfrequently forthan suchonce registeredduring dataany broker,forty-five-day fromperiod, submit an update to the participating consumer's verified deletion request orin a verifiable form and manner prescribed by the commissioner, without charge to such participating consumer and in any updatelanguage thereto;spoken by a consumer for whom a registered data broker has collected personal data;

(4)(C) DoesEnables not enable a registered data broker thatto accessesdetermine thewhether accessiblea deletionconsumer mechanismhas forspecifically excluded the purposesregistered setdata forthbroker, inand subdivisionall (3)data ofservice thisproviders subsectionfor tosuch accessregistered anydata additionalbroker, personalfrom datathe byconsumer's waydeletion ofrequest suchor accessibleany deletionupdate mechanism;thereto;

(5)(D) IsDoes readilynot enable a registered data broker that accesses the accessible anddeletion usablemechanism for the purposes set forth in subparagraph (C) of this subdivision to access any additional personal data by consumersway withof disabilities;such accessible deletion mechanism;

(6)(E) IncorporatesIs reasonablereadily securityaccessible safeguards, including, but not limited to, administrative, physical and technicalusable safeguards, to protect consumers' personal data from any unauthorized use, disclosure, access, destruction or modification by wayconsumers ofwith thedisabilities; accessible deletion mechanism;

(F) Incorporates reasonable security safeguards, including, but not limited to, administrative, physical and LCOtechnical 6safeguards, to protect consumers' personal data from any unauthorized use, disclosure, access, destruction or modification by way of 36the Substituteaccessible Billdeletion No.mechanism;

4and (7)(G) Provides, in a manner that is readily understandable by consumers, (A)(i) a description of what constitutes personal data and therefore may be subject to a deletion request, (B)(ii) an explanation of the processes for a consumer,consumer or the consumer's authorized agent, to submit and update a deletion request, and (C)(iii) a description of the actions required under subsections (b) and (c) of this section.

(b)(2)(A) OnIf anda afterconsumer Februarysubmitsthe 15,consumer's 2027,motorvehicle andoperator's exceptPublic asAct providedNo. in section 7 of this act, the Commissioner of Consumer Protection, or the commissioner's authorized agent, shall:

(1)26-64 Verify7 thatof the41 consumer,Substitute orSenate theBill consumer'sNo. authorized agent, who purportedly submitted a deletion request or update thereto actually submitted such deletion request or update;

and4 (2)license Ifnumber theto commissioner, or the commissioner'scommissioner authorizedfor agent, cannot verify that the consumer,purpose orof theverifying consumer's authorized agent, who purportedly submitted a deletion request or update thereto actually submitted such deletionconsumer's request or update, specify that all registered data brokers, and all data service providers for such registered data brokers, that are not specifically excluded from such unverified deletion request or suchany unverified update (A)thereto, maythe retaincommissioner anyshall personaluse data such registeredconsumer's datamotor brokersvehicle andoperator's datalicense servicenumber providersto maintainverify concerning such consumer, and (B) shall process such unverified deletion request or such unverified update asand anfor exerciseofsuchconsumer'srightundersubparagraph(B)ofsubdivisionno (5)other ofpurpose. subsection (a) of section 42-518 of the general statutes, as amended by this act.

(c)The (1)commissioner On and after February 15, 2027, and except as provided in section 7 of this act, each registered data broker shall accessnot theshare, accessiblestore deletionor mechanismretain atsuch leastconsumer's oncemotor everyvehicle forty-fiveoperator's dayslicense to:number.

(B) Each deletion request and update thereto is confidential and shall not be deemed a public record for the purposes of the Freedom of Information Act, as defined in section 1-200 of the general statutes.

(b) On and after August 15, 2028, and except as provided in section 7 of this act, the Commissioner of Consumer Protection, or the commissioner's authorized agent, shall:

(1) Verify that the consumer who purportedly submitted a deletion request or update thereto actually submitted such deletion request or update by using such consumer's motor vehicle operator's license number and, following such verification, update the accessible deletion mechanism to inform each registered data broker that accesses the accessible deletion mechanism that such deletion request or update has been verified;

and (2) If the commissioner, or the commissioner's authorized agent, cannot verify that the consumer who purportedly submitted a deletion request or update thereto actually submitted such deletion request or update, specify that all registered data brokers, and all data service providers for such registered data brokers, that are not specifically excluded from such unverified deletion request or such unverified update (A) may retain any personal data such registered data brokers and data service providers maintain concerning such consumer, and (B) shallprocess such unverifieddeletionrequestor suchunverifiedupdate as an exercise of such consumer's right under subparagraph (B) of subdivision (5) of subsection (a) of section 42-518 of the general statutes, Public Act No.

26-64 8 of 41 Substitute Senate Bill No.

4 as amended by this act.

(c) (1) On and after October 1, 2028, and except as provided in section of this act, each registered data broker shall access the accessible deletion mechanism at least once every forty-five days to:

and LCO(B) 7(i) For each verified deletion request or verified update thereto that does not specifically exclude such registered data broker, and all data service providers for such registered data broker, and subject to the exceptions set forth in subdivision (5) of 36this Substitutesubsection, Billdelete No.any personal data such registered data broker maintains concerning the participating consumer and direct all data service providers that maintain any personal data concerning the participating consumer on behalf of such registered data broker to delete such personal data;

4 (B) (i) For each verified deletion request or verified update thereto that does not specifically exclude such registered data broker, and all data service providers for such registered data broker, and subject to the exceptions set forth in subdivision (5) of this subsection, delete any personal data such registered data broker maintains concerning the participating consumer and direct all data service providers that maintain any personal data concerning the participating consumer on behalf of such registered data broker to delete such personal data;

(2) At least once every forty-five days after a registered data broker first deletes a participating consumer's personal data pursuant to subparagraph (B)(i) of subdivision (1) of this subsection, repeat the actionsPublic requiredAct underNo. subparagraph (B)(i) of subdivision (1) of this subsection unless:

(A)26-64 Such9 registeredof data41 brokerSubstitute verifiesSenate thatBill theNo. participating consumer, or the participating consumer's authorized agent, has submitted a verified update to a verified deletion request such participating consumer or authorized agent previously submitted to the accessible deletion mechanism;

4 actions required under subparagraph (B)(i) of subdivision (1) of this subsection unless:

(A) Such registered data broker verifies that the participating consumer has submitted a verified update to a verified deletion request such participating consumer previously submitted to the accessible deletion mechanism;

(3) The Commissioner of Consumer Protection may impose a fee on LCOeach 8registered ofdata 36broker Substitutethat Billaccesses No.the accessible deletion mechanismfor thepurposesofperforming suchregistereddatabroker's duties under subdivisions (1) and (2) of this subsection.

4 each registered data broker that accesses the accessible deletion mechanismfor thepurposesofperforming suchregistereddatabroker's duties under subdivisions (1) and (2) of this subsection.

All fees collected under this subdivision shall be deposited in the Generaldata Fund.broker registration account established in section 8 of this act.

(4) On and after FebruaryOctober 15,1, 2027,2028, and except as provided in subdivision (5) of this subsection, no registered data broker, and no data service provider for such registered data broker, that deletes a participating consumer's personal data pursuant to subparagraph (B)(i) of subdivision (1) of this subsection or subdivision (2) of this subsection shall maintain, use or disclose any personal data such registered data broker or data service provider subsequently acquires concerning the participating consumer.

(5) (A) No registered data broker who maintains a participating consumer's personal data, and no data service provider for such registered data broker, shall be required to delete the participating consumer's personal data, and may maintain, use or disclose such consumer'sPublic personalAct data, to the extent that maintaining, using or disclosing such participating consumer's personal data is reasonably necessary to (i) comply with any federal, state or municipal law, ordinance or regulation, (ii) comply with any civil, criminal or regulatory inquiry, investigation, subpoena or summons by any federal, state, municipal or other governmental authority, (iii) cooperate with any law enforcement agency concerning any conduct or activity that such registered data broker or data service provider reasonably and in good faith believes may violate any federal, state or municipal law, ordinance or regulation, (iv) investigate, establish, exercise, prepare for or defendany legalclaim,(v)provideany product or service specifically requested by such participating consumer, (vi) perform pursuant to any contract to which such participating consumer is a party, including, but not limited to, by fulfilling thetermsofawrittenwarranty,(vii)takeany step at the request of such participating consumer prior to entering into a contract, (viii) take any immediate step to protect any interest that is LCO 9 of 36 Substitute Bill No.

426-64 essential10 for the life or physical safety of such41 participatingSubstitute consumerSenate orBill anotherNo. individual, (ix) prevent, detect, protect against or respond to any security incident, identity theft, fraud, harassment, malicious or deceptive activity or any illegal activity, preserve the integrity or security of any system or investigate, report or prosecute those responsible for any such action, (x) engage in any public or peer- reviewed scientific or statistical research in the public interest that adheres to all other applicable ethics and privacy laws and is approved, monitored and governed by an institutional review board, or a similar independent oversight entity, that determines that (I) maintaining such participating consumer's personal data is likely to provide substantial benefits that do not exclusively accrue to such registered data broker or data service provider, (II) the expected benefits of such research outweigh the privacy risks, and (III) such registered data broker or data service provider has implemented reasonable safeguards to mitigate any privacy risk associated with such research, (xi) assist any other person in performing any obligation imposed under sections 1 to 9, inclusive, of this act, (xii) conduct internal research to develop, improve or repair any product, service or technology, (xiii) effectuate a product recall, (xiv) identify and repair any technical error that impairs existing or intended functionality, or (xv) perform internal operations that are reasonably aligned with the expectations such participating consumer had, or reasonably anticipated, based on such participating consumer's existing relationship with such registered data broker.

4 consumer's personal data, to the extent that maintaining, using or disclosing such participating consumer's personal data is reasonably necessary to (i) comply with any federal, state or municipal law, ordinance or regulation, (ii) comply with any civil, criminal or regulatory inquiry, investigation, subpoena or summons by any federal, state, municipal or other governmental authority, (iii) cooperate with any law enforcement agency concerning any conduct or activity that such registered data broker or data service provider reasonably and in good faith believes may violate any federal, state or municipal law, ordinance or regulation, (iv) investigate, establish, exercise, prepare for or defendany legalclaim, (v)provideany product or service specifically requested by such participating consumer, (vi) perform pursuant to any contract to which such participating consumer is a party, including, but not limited to, by fulfilling thetermsofawrittenwarranty,(vii)takeany step at the request of such participating consumer prior to entering into a contract, (viii) take any immediate step to protect any interest that is essential for the life or physical safety of such participating consumer or another individual, (ix) prevent, detect, protect against or respond to any security incident, identity theft, fraud, harassment, malicious or deceptive activity or any illegal activity, preserve the integrity or security of any system or investigate, report or prosecute those responsible for any such action, (x) engage in any public or peer- reviewed scientific or statistical research in the public interest that adheres to all other applicable ethics and privacy laws and is approved, monitored and governed by an institutional review board, or a similar independent oversight entity, that determines that (I) maintaining such participating consumer's personal data is likely to provide substantial benefits that do not exclusively accrue to such registered data broker or data service provider, (II) the expected benefits of such research outweigh the privacy risks, and (III) such registered data broker or data service provider has implemented reasonable safeguards to mitigate any privacy risk associated with such research, (xi) assist any other person in performing any obligation imposed under sections 1 to 10, Public Act No.

26-64 11 of 41 Substitute Senate Bill No.

4 inclusive, of this act, (xii) conduct internal research to develop, improve or repair any product, service or technology, (xiii) effectuate a product recall, (xiv) identify and repair any technical error that impairs existing or intended functionality, or (xv) perform internal operations that are reasonably aligned with the expectations such participating consumer had, or reasonably anticipated, based on such participating consumer's existing relationship with such registered data broker.

(d) (1) Except as provided in section 7 of this act, not later than July 1, 2030,2031, and triennially thereafter, each registered data broker shall, at the expense of such registered data broker, (A) retain an independent auditor to (i)audit thebooksofsuchregistereddatabrokerthebooksofsuch registereddatabroker to determine LCOwhether 10such registered data broker is in compliance with the provisions of 36subsection Substitute(c) Billof No.this section, (ii) prepare an audit report disclosing the results of such audit, and (iii) submit such audit report, and any materials associated therewith, to such registered data broker, and (B) maintain each audit report, and any materials associated therewith, that are submitted to such registered data broker pursuant to subparagraph (A)(iii) of this subdivision for a period of at least six years beginning on the date on which such audit report and materials are submitted to such registered data broker.

4(2) whetherExcept suchas registeredprovided data broker is in compliancesection with7 the provisions of subsection (c) of this section,act, (ii)a prepare an audit report disclosing the results of such audit, and (iii) submit such audit report, and any materials associated therewith, to such registered data broker,broker andshall (B)submit maintainan each audit report,report and anythe materials associateddescribed therewith,in thatsubparagraph are(A)(iii) submittedof tosubdivision such(1) registeredof datathis brokersubsection pursuant to subparagraphthe (A)(iii)Department of thisConsumer subdivisionProtection, forin a periodform ofand atmanner leastprescribed sixby years beginning on the dateCommissioner onof whichConsumer suchProtection, auditnot reportlater andthan materialsfive arePublic submittedAct toNo. such registered data broker.

(2)26-64 Except12 as provided in section 7 of this41 act,Substitute aSenate registeredBill dataNo. broker shall submit an audit report and the materials described in subparagraph (A)(iii) of subdivision (1) of this subsection to the Department of Consumer Protection, in a form and manner prescribed by the Commissioner of Consumer Protection, not later than five business days after the department sends notice to the registered data broker disclosing that the department requires such registered data broker to submit such audit report and materials to the department.

(e)4 Thebusiness Commissionerdays ofafter Consumerthe Protectiondepartment maysends enternotice intoto athe contractregistered withdata onebroker ordisclosing morethat publicthe ordepartment privaterequires entitiessuch forregistered anydata servicesbroker necessary to implementsubmit thesuch provisionsaudit ofreport subsectionsand (a)materials to (d), inclusive, of this section or to administer the accessibledepartment. deletion mechanism program established pursuant to subsection (a) of this section.

(e) The Commissioner of Consumer Protection may enter into a contract with one or more public or private entities (1) for any services necessary to implement the provisions of subsections (a) to (d), inclusive, of this section, (2) to administer the accessible deletion mechanism program established pursuant to subsection (a) of this section, or (3) to administer a multistate accessible deletion mechanism program.

(NEW) (Effective October 1, 2026) Except as provided in section 7 of this act, not later than July 1, 2028,2029, and annually thereafter, each business that was a registered data broker during the preceding calendar year shall post, in a form and manner prescribed by the Commissioner of Consumer Protection and on a publicly accessible Internet web page on such business's primary Internet web site, a statement disclosing the following information:

(1) The total number of deletion requests, inclusive of any updates thereto, that such business accessed during the preceding calendar year LCOand 11that ofdid 36not Substitutespecifically Billexclude No.such business and all data service providers for such business;

4 and that did not specifically exclude such business and all data service providers for such business;

and (3) If such business responded to one or more deletion requests describedPublic inAct subdivisionNo. (1) of this section by retaining personal data, the total number of such deletion requests for which such business retained personal data:

26-64 13 of 41 Substitute Senate Bill No.

4 described in subdivision (1) of this section by retaining personal data, the total number of such deletion requests for which such business retained personal data:

(NEW) (Effective October 1, 2026) (a) The provisions of sections 1 to 9,10, inclusive, of this act shall not apply to:

(2) a financial institution, an affiliate or a nonaffiliated third party, assuchtermsare definedin15USCdefined in15USC 6809,asamendedfromtime to time, to the extent that the financial institution, affiliate or nonaffiliated third party engages in activities that are subject to regulation under Title V of the Gramm-Leach-Bliley Act, 15 USC 6801 et seq., and the regulations adopted thereunder, as said act and such regulations may be amended from time to time;

(3) a business that collects information concerning a LCOconsumer 12if ofthe 36consumer Substituteis Billor No.was (A) in a contractual relationship with the business, (B) an investor in the business, (C) a donor to the business, or (D) in any relationship with the business that is similar to therelationshipsdescribedinsubparagraphs(A)to(C),inclusive,ofthis subdivision;

4(4) consumera ifbusiness thethat consumerperforms isservices for, or wasis (A)acting inas a contractual relationship with the business, (B) an investoragent inor theotherwise business,on (C)behalf of, a donorbusiness todescribed the business, or (D) in anysubdivision relationship(3) withof thethis businesssubsection thator isa similargovernmentalentity; to therelationshipsdescribedinsubparagraphs(A)to(C),inclusive,ofthis subdivision;

(4)(5)a a business thatcollecting performsdata servicesused for,for orpurposes isof actingthe asregulation anof agentlisted orchemicals otherwiseas onset behalfforth of,in a21 businessUSC described830, inas subdivisionamended (3)from oftime thisto subsection;time;

or(6) (5) a businesscandidate collectingcommittee, dataPublic usedAct forNo. purposes of the regulation of listed chemicals as set forth in 21 USC 830, as amended from time to time.

(b)26-64 No14 provision of sections41 1Substitute toSenate 9,Bill inclusive,No. of this act shall be construed to prohibit an unregistered data broker from engaging in any sale or licensing of brokered personal data if such sale or licensing exclusively involves:

4 national committee, party committee or political committee, as such terms are defined in section 9-601 of the general statutes;

and (7) a covered entity or business associate, as defined in 45 CFR 160.103.

(b) No provision of sections 1 to 10, inclusive, of this act shall be construed to prohibit an unregistered data broker from engaging in any sale or licensing of brokered personal data if such sale or licensing exclusively involves:

(NEW) (Effective October 1, 2026) TheThere Commissioneris ofestablished Consumeran Protectionaccount mayto adoptbe regulations,known inas accordance with the provisions"data ofbroker chapterregistration 54account", ofwhich theshall generalbe statutes,a toseparate, implementnonlapsing theaccount. provisions of sections 2 to 7, inclusive, of this act.

LCOThe 13account ofshall 36contain Substituteany Billmoneys No.required by law to be deposited in the account.

4Moneys Sec.in the account shall be expended by the Commissioner of Consumer Protection for the purposes of the accessible deletion mechanism program established pursuant to subsection (a) of section 5 of this act.

Sec.

(NEW) (Effective October 1, 2026) The Commissioner of ConsumerPublic Protection,Act afterNo. providing notice and conducting a hearing in accordance with the provisions of chapter 54 of the general statutes, may impose a civil penalty of not more than five thousand dollars per day for each violation of any provision of sections 2 to 7, inclusive, of this act.

Any26-64 civil15 penaltiesof collected41 underSubstitute thisSenate sectionBill shallNo. be deposited in the General Fund.

4 Consumer Protection may adopt regulations, in accordance with the provisions of chapter 54 of the general statutes, to implement the provisions of sections 2 to 8, inclusive, of this act.

(NEW) (Effective October 1, 2026) (a)The AsCommissioner usedof Consumer Protection, after providing notice and conducting a hearing in accordance with the provisions of chapter 54 of the general statutes, may impose a civil penalty of not more than two hundred dollars per day for each violation of any provision of sections 2 to 8, inclusive, of this section:act.

(1)Any "Disclosurecivil label"penalties meanscollected theunder labelthis thatsection ashall manufacturerbe isdeposited requiredin to affix to a new automobile manufactured or imported by the manufacturerdata pursuantbroker toregistration 15account USCestablished 1232,in assection amendedof fromthis timeact. to time;

(2)"Manufacturer"hasthesamemeaningasprovidedin15USC1231, as amended from time to time;

(3) "New automobile" has the same meaning as provided in 15 USC 1231, as amended from time to time;

(4) "New motor vehicle dealer" means a new motor vehicle dealer licensed in accordance with section 14-52 of the general statutes;

and (5) "Tariff cost estimate" means an estimate of any increase in the price or prices listed on the disclosure label caused, directly or indirectly, by any tariff imposed by the federal government, including, but not limited to, any such tariff imposed on steel, aluminum or any other item used to manufacture, assemble or distribute a new automobile.

(b) (1) A manufacturer that ships a new automobile to a new motor vehicle dealer in the state on or after October 1, 2026, shall affix to the windshield or side window of the new automobile a label disclosing, in a clear, conspicuous and readily understandable manner, the tariff cost estimate for such new automobile.

(2) A manufacturer may satisfy the requirements established in subdivision (1) of this subsection by including the tariff cost estimate for LCO 14 of 36 Substitute Bill No.

4 the new automobile as part of the disclosure label affixed to the new automobile.

(c) A manufacturer that violates any provision of subsection (b) of this section shall be fined not more than one thousand dollars.

(1) "Algorithm""Consumer" meanshas anythe computationalsame automatedmeaning processas thatprovided usesin asection set42-515 of rulesthe togeneral definestatutes, aas sequenceamended ofby operations;this act;

(2) "Consumer""Consumer good" means any individualarticle whothat is physicallypurchased, presentleased, inexchanged theor state;received primarily for personal, family or household purposes;

(3) "Consumer good"service" means any articleservice that is purchased, leased, exchanged or received primarily for personal, family or household purposes;

(4) "Consumer"Discounted service"price" means any price for a consumer good or consumer service that is purchased,(A) leased,established exchangedfor, or receivedoffered primarilyto, a consumer or group of consumers, and (B) verifiably lower than the generally available, publicly disclosed and bona fide market price established for personal,the familyconsumer good or householdconsumer purposes;service;

(5) "Controller""Person" hasmeans theany sameindividual, meaningassociation, ascorporation, providedlimited inliability sectioncompany, 42-515partnership, oftrust theor generalother statutes,legal asentity; amended by this act;

(6)Public "ElectronicAct pricingNo. label" means any electronic display that (A) is located within a retail establishment, (B) is part of a digital network,and (C) is used to automatically display and update pricing information for a consumer good offered for sale within the retail establishment;

(7)26-64 "Person"16 meansof any41 individual,Substitute association,Senate corporation,Bill limitedNo. liability company, partnership, trust or other legal entity;

(8)4 "Personalized(6) algorithmic"Personal pricing"data" meanshas any process that uses an algorithm to establish the pricesame formeaning aas consumerprovided goodin orsection consumer42- serviceof basedthe ingeneral wholestatutes, oras inamended partby onthis personalact; data;

and(7) (9)"Price "Personalsetting data"device" (A) means any informationautomated or programmed process that isuses linkeda orconsumer's reasonablypersonal linkabledata to anestablish identifieda orprice identifiablefor a consumer good or aconsumer deviceservice LCOto 15be ofsold, 36leased, Substituteexchanged Billor No.provided to the consumer;

4(8) linked"Retail toseller" such(A) consumer,means anda (B)retailer, doesas notdefined includein (i)section data12-407 thatof cannotthe reasonablygeneral bestatutes, used to infer information about or otherwise be linked to an identified or identifiable consumer or a device linked to such consumer if the controllerextent that possesses such dataretailer (I)is takesengaged reasonable measures to ensure that such data cannot be associated with a consumer, (II) publicly commits to process such data only in amaking de-sales, identifiedat fashionretail, and not attempt to re-identify such data, and (III) contractually obligates any recipients of suchtangible datapersonal toproperty, satisfy the criteria set forth in subparagraphs (B)(i)(I) and (B)(i)(II)(B) ofincludes, thisbut subdivision, or (ii) any information that (I) is lawfullynot madelimited availableto, througha federal,retail stateormunicipalgovernmentrecordsorwidelydistributedmedia,andfood (II)aestablishment; controllerhasareasonablebasisto believe aconsumer haslawfully made available to the general public.

(b)(9) (1)"Surveillance Exceptpricing" asmeans providedthe inpractice subsection (d) of thisestablishing section,a anycustomized personprice doingfor businessa inconsumer thegood stateor whoconsumer usesservice personalizedthat algorithmicis pricingspecific to increasea theconsumer pricebased, forin awhole specificor consumerin goodpart, oron consumerthe serviceconsumer's topersonal bedata sold,collected leased,(A) exchangedthrough any technology or providedtechnological asmethod, partsystem ofor antool, onlineincluding, transaction,but andnot wholimited directlyto, orany indirectlybiometric advertisesmonitoring, camera, device tracking or promotessensor, suchthat priceis online,capable labelsof agathering consumerpersonal gooddata withconcerning sucha priceconsumer's onlinebehavior, orcharacteristics, publisheslocation anor onlineother statement,personal display,attributes image,in offera physical or announcementdigital disclosingenvironment, suchand price,(B) shallby includethe inperson suchestablishing onlinethe advertisement,customized promotion,price label,either statement,directly display,or image,indirectly offerby gathering, purchasing or announcementotherwise theacquiring followingsuch disclosure:personal data from a third party;

"THISand PRICE(10) WAS"Third-party INCREASEDdelivery BYservice" ANmeans ALGORITHMa USINGcompany, YOURorganization PERSONALor DATA".entity, outside of the operation of a retail food establishment's business, that facilitates delivery or online ordering services to customers of a retail food establishment.

(b) (1) Except as provided in subsection (d) of this section, any person doingbusinessinthestatewhousesapricesettingdeviceforanyreason other than to establish a discounted price for a consumer good or consumer service to be sold, leased, exchanged or provided as part of Public Act No.

26-64 17 of 41 Substitute Senate Bill No.

4 an online transaction, and who directly or indirectly advertises or promotes online a price established for a consumer good or consumer servicebyusingaprice settingdevice,labelsaconsumergoodwithsuch price online or publishes an online statement, display, image, offer or announcement disclosing such price, shall include in such online advertisement, promotion, label, statement, display, image, offer or announcement the following disclosure, or a substantially similar disclosure:

"THIS PRICE WAS INCREASED BY A PRICE SETTING DEVICE USING YOUR PERSONAL DATA".

(c) (1) Except as provided in subsection (d) of this section, no personretail seller or third-party delivery service doing business in the state shall useengage anin electronicsurveillance pricingpricing. label that uses personalized algorithmic pricing to increase the price for a specific consumer good to be sold as part of an in-person transaction.

(d)(2) TheNotwithstanding the provisions of subsectionssubdivision (b)(1) and (c) of this sectionsubsection, the following shall not applybe to:deemed to constitute surveillance pricing:

LCO(A) 16Establishing for, or offering to, a consumer a discounted price for a consumer service for the purpose of 36retaining Substitutethe Billconsumer No.as a customer;

4(B) (1)Establishing Anyfor, personor licensed,offering authorizedto, todifferent operateconsumers ordifferent registered,prices for the same consumer good or requiredconsumer service due to be(i) licensed,justifiable authorizeddifferences in the costs incurred in providing such consumer good or consumer service to operatesuch consumers, including, but not limited to, justifiable differences in consumer selections, delivery distances or registered,delivery pursuanttimes, or (ii) justifiable temporal differences, including, but not limited to, justifiable temporal differences due to theprice insurancefluctuations lawsbased ofon thissupply state;and demand;

or (C)Establishing for, oroffering to,aconsumer or groupofconsumers Public Act No.

26-64 18 of 41 Substitute Senate Bill No.

4 a discounted price for a consumer good or consumer service (i) based on publicly disclosed uniform terms and conditions that may be satisfied by any consumer, including, but not limited to, by signing up for a mailing list, disclosing personal data, registering for promotional communications or participating in a promotional event, (ii) that is available to allconsumerswho are membersofabroadly definedgroup, including, but not limited to, veterans or members of the armed forces, senior citizens, students, teachers or residents of a specific area, or (iii) through a loyalty, membership or rewards program in which consumers must affirmatively enroll.

The retail seller or third-party delivery service shall (I) prominently post the discounted price, and the uniform terms and conditions for such discounted price, on such retail seller's or third-party delivery service's Internet web site in language that is readily understandable by the average consumer, and (II) offer such discounted price to all consumers pursuant to the uniform terms and conditions posted on such retail seller's or third-party delivery service's Internet web site.

(d) The provisions of subsections (b) and (c) of this section shall not be construed to apply to:

(1) Any person licensed, authorized to operate or registered, or required to be licensed, authorized to operate or registered, pursuant to the insurance laws of this state;

or (3) Any bank, holding company or out-of-state bank, as such terms are defined in section 36a-2 of the general statutes, or out-of-state holding company, as defined in section 36a-410 of the general statutes, that directly or indirectly establishes an office in the state and is subject toPublic theAct supervisionNo. of, or regulation by, the Banking Commissioner pursuant to title 36a of the general statutes.

(e)26-64 Any19 violation of the41 provisionsSubstitute ofSenate subsectionBill (b)No. or (c) of this section shall constitute an unfair or deceptive trade practice for the purposes of subsection (a) of section 42-110b of the general statutes.

4 to the supervision of, or regulation by, the Banking Commissioner pursuant to title 36a of the general statutes.

(e) Any violation of the provisions of subsections (b) to (d), inclusive, of this section shall constitute an unfair or deceptive trade practice for the purposes of subsection (a) of section 42-110b of the general statutes and shall be enforced solely by the Attorney General.

Nothing in this section shall be construed to create a private right of actionor to provide grounds for an action under section 42-110g of the general statutes.

For the purposes of this subdivision, "control" and "controlled" mean (A) ownership of, or the power to vote, more than fifty per cent of the outstanding shares of any class of voting security of a company, (B) control in any manner over the election of a majority of the directors or of individuals exercising similar functions, LCOor 17(C) ofthe 36power Substituteto Billexercise No.controlling influence over the management of a company.

4 or (C) the power to exercise controlling influence over the management of a company.

(4)Public "BiometricAct data"No. means data generated by automatic measurements of an individual's biological characteristics, such as a fingerprint, a voiceprint, eye retinas, irises or other unique biological patterns or characteristics that are used to identify a specific individual.

26-64 20 of 41 Substitute Senate Bill No.

4 (4) "Biometric data" means data generated by automatic measurements of an individual's biological characteristics, such as a fingerprint, a voiceprint, eye retinas, irises or other unique biological patterns or characteristics that are used to identify a specific individual.

"Consumer" does not include an individual acting in a commercial [oror employment]employment context,context under the direction of an employer or as an employee, owner, director, officer or contractor of a company, LCOpartnership, 18sole proprietorship, nonprofit organization or government agency whose communications or transactions with the controller occur solely within the context of 36that Substituteindividual's Billrole No.with the company, partnership, sole proprietorship, nonprofit organization or government agency.

4(9) partnership,"Consumer solehealth proprietorship,data" nonprofitmeans organizationany orpersonal governmentdata agencythat whosea communications or transactions with the controller occurPublic solelyAct withinNo. the context of that individual's role with the company, partnership, sole proprietorship, nonprofit organization or government agency.

(9)26-64 "Consumer21 healthof data"41 meansSubstitute anySenate personalBill dataNo. that a controller uses to identify a consumer's physical or mental health condition, diagnosis or status, and includes, but is not limited to, gender-affirming health data and reproductive or sexual health data.

4 uses to identify a consumer's physical or mental health condition, diagnosis or status, and includes, but is not limited to, gender-affirming health data and reproductive or sexual health data.

LCO(16) 19"De-identified ofdata" 36means Substitutedata Billthat cannot reasonably be used to infer information about, or otherwise be linked to, an identified or identifiable individual, or a device linked to such individual, if the controller that possesses such data (A) takes reasonable measures to Public Act No.

426-64 (16)22 "De-identified data" means data that cannot reasonably be used to infer information about, or otherwise be linked to, an identified or identifiable individual, or a device linked to such individual, if the controller that possesses such data (A) takes reasonable measures to ensure that such data cannot be associated with an individual, (B) publicly commits to process such data only in a de-identified fashion and not attempt to re-identify such data, and (C) contractually obligates any recipients of such41 dataSubstitute toSenate satisfyBill theNo. criteria set forth in subparagraphs (A) and (B) of this subdivision.

(17)4 "Facialensure recognitionthat technology"such meansdata anycannot technologybe thatassociated (A)with analyzesan facialindividual, features(B) inpublicly stillcommits imagesto orprocess video,such anddata (B)only isin useda (i)de-identified fashion and not attempt to assignre-identify asuch uniquedata, persistentand identifier,(C) orcontractually (ii)obligates any recipients of such data to uniquelysatisfy andthe personallycriteria identifyset aforth specificin individual.subparagraphs (A) and (B) of this subdivision.

(17) "Facial recognition technology" means any technology that analyzes facial features in still images or video to uniquely and personally identify a specific individual.

[(22)] (23) "Institution of higher education" means any individual LCOwho, 20or school, board, association, limited liability company or corporation that, is licensed or accredited to offer one or more programs of 36higher Substitutelearning Billleading No.to one or more degrees.

4Public who,Act orNo. school, board, association, limited liability company or corporation that, is licensed or accredited to offer one or more programs of higher learning leading to one or more degrees.

[(23)]26-64 (24)23 "Mental health facility" means any health care facility in which at least seventy per cent of the41 healthSubstitute careSenate servicesBill providedNo. in such facility are mental health services.

4 [(23)] (24) "Mental health facility" means any health care facility in which at least seventy per cent of the health care services provided in such facility are mental health services.

[(29)] (30) "Process" and "processing" mean any operation or set of operations performed, whether by manual or automated means, on LCOpersonal 21data or on sets of 36personal Substitutedata, Billsuch No.as the collection, use, storage, disclosure, analysis, deletion or modification of personal data.

4Public personalAct dataNo. or on sets of personal data, such as the collection, use, storage, disclosure, analysis, deletion or modification of personal data.

[(30)]26-64 (31)24 "Processor"of means41 aSubstitute personSenate whoBill processesNo. personal data on behalf of a controller.

4 [(30)] (31) "Processor" means a person who processes personal data on behalf of a controller.

[(34)] (35) "Publicly available information" (A) means information that (i) is [lawfully] made available [from] through federal, state or [municipal] local government records or to the general public from widely distributed media, or (ii) a controller or processor, or an affiliate of a controller or processor, has a reasonable basis to believe [(I) a] that the consumer has lawfully made available to the general public, [or (II) has been lawfully made available to the general public from widely distributed media,] and (B) does not include any (i) biometric data [that can be associated with a specific] about a consumer [and were] collected by a business without the consumer's [consent] knowledge, (ii) informationobscene thatvisual isdepiction, collatedas andsuch combinedterm to create a consumer profile that is madeused availablein to18 aUSC user1460, ofas aamended publiclyfrom accessibletime Internetto webtime, site(iii) forpersonal compensationdata orthat freeare ofcreated charge,by (iii)combining any information thatdescribed isin madesubdivision available(28) forof sale,this (iv)section inferencewith generatedany from the information described in subparagraph (B)(ii)(A) or (B)(iii) of this subdivision, (v)(iv) LCOgenetic 22data, ofunless 36such Substitutegenetic Billdata are made publicly available by the Public Act No.

426-64 obscene25 visual depiction, as such term is used in 18 USC 1460, as amended from time to time, (vi) personal data that is created by combining any information described in subdivision (28) of this41 sectionSubstitute withanySenate informationdescribedinsubparagraph(A)ofthisBill subdivision,No. (vii) genetic data, unless such genetic data is made publicly available by the consumer, (viii) information provided by a consumer on a publicly accessible Internet web site or online service (I) which Internet web site or online service is made available to the general public for compensation or free of charge, and (II) where the consumer has maintained a reasonable expectation of privacy in such information, including,but notlimitedto,byrestrictingsuchinformationtoaspecific audience, (ix) intimate image, as such term is used in section 53a-189c, known to be nonconsensual, or (x) intimate synthetically created image, as such term is used in section 53a-189d, known to be nonconsensual.

4 consumer, (v) information provided by a consumer on a publicly accessible Internet web site or online service (I) which Internet web site or online service is made available to the general public for compensation or free of charge, and (II) where the consumer has maintained a reasonable expectation of privacy in such information, including,but notlimitedto,byrestrictingsuchinformationtoaspecific audience, (vi) intimate image, as such term is used in section 53a-189c, known to be nonconsensual, or (vii) intimate synthetically created image, as such term is used in section 53a-189d, known to be nonconsensual.

[(37)] (38) "Reproductive or sexual health facility" means any health care facility in which at least seventy per cent of the health care-related services or products rendered or provided in such facility are LCOreproductive 23or ofsexual 36health Substitutecare. Bill No.

4Public reproductiveAct orNo. sexual health care.

[(38)](39)"Saleofpersonaldata"meanstheexchangeofpersonaldata26-64 for26 monetaryof or41 otherSubstitute valuableSenate considerationBill byNo. the controller to a third party.

4 [(38)](39)"Saleofpersonaldata"meanstheexchangeofpersonaldata for monetary or other valuable consideration by the controller to a third party.

[(39)] (40) "Sensitive data" means personal data that includes (A) data revealing (i) racial or ethnic origin, (ii) religious beliefs, (iii) a mental or physical health condition, diagnosis, disability or treatment, (iv) sex life, sexual orientation or status as nonbinary or transgender, or (v) citizenship or immigration status, (B) consumer health data, (C) genetic or biometric data or information derived therefrom, (D) personal data collected from an individual the controller has actual knowledge, or wilfully disregards, is a child, (E) data concerning an individual's status as a victim of crime, as defined in section 1-1k, (F) [preciseprecise geolocation data, (G)](G) neural data, [(H)](H) (G) a consumer's financial account number, financial account log-in information or credit card or debit card number that, in combination with any required access or security code, password or credential, would allow access to a consumer's financial account, or [(I)](I) (H) government-issued identification number, including, but not limited to, Social Security number, passport number, state identificationPublic cardAct number or driver's license number, that LCO 24 of 36 Substitute Bill No.

426-64 applicable27 lawof does41 notSubstitute requireSenate toBill beNo. publicly displayed.

4 identification card number or driver's license number, that applicable law does not require to be publicly displayed.

Subsection (a) of section 42-517 of the 2026 supplement to the general statutes, as amended by section 7 of public act 25-113, is repealed andthefollowing issubstituted inlieuthereof(EffectiveOctober 1, 2026):

(a) (1) The provisions of sections 42-515 to 42-525, inclusive, as amended by this act, do not apply to any:

[(1)] (A) Body, authority, board, bureau, commission, district or agency of this state or of any political subdivision of this state;

[(2)] (B) person who has entered into a contract with any body, authority, board, bureau, commission, district or agency described in subparagraph (A) of this subdivision [(1) of this subsection] while such person is processing consumer health data on behalf of such body, authority, board, bureau, commission, district or agency pursuant to such contract;

[(3)] (C) nonprofit organization;

[(4)] (D) candidate committee, national committee, party committee or LCO 25 of 36 Substitute Bill No.

4 political committee, as such terms are defined in section 9-601;

[(5)] (E) institution of higher education;

[(6)] (F) national securities association that is registered under 15 USC 78o-3 of the Securities Exchange Act of 1934, as amended from time to time;

[(7)] (G) covered entity or business associate, as defined in 45 CFR 160.103;

[(8)] (H) tribal nation governmentorganization;[(9)](I)air carrier,asdefinedin49USC40102, as amended from time to time, and regulated under the Federal Aviation Act of 1958, 49 USC 40101 et seq., and the Airline Deregulation Act of 1978, 49 USC 41713, as said acts may be amended from time to time;[(10)](J)insurer,asdefinedinsection38a-1,oritsaffiliate,fraternal benefit society, within the meaning of section 38a-595, health carrier, as defined in section 38a-591a, insurance-support organization, as defined in section 38a-976, or insurance agent or insurance producer, as such terms are defined in section 38a-702a;

[(11)] (K) bank, Connecticut credit union, federal credit union, out-of-state bank or out-of-state credit union, or any affiliate or subsidiary thereof, as such terms are defined in section 36a-2, that [(A)] (i) is only and directly engaged in financial activities as described in 12 USC 1843(k), [(B)] (ii) is regulated and examined by the Department of Banking or an applicable federal bank regulatory agency, and [(C)] (iii) has established a program to comply with all applicable requirements established by the Banking Commissioner or the applicable federal bank regulatory agency concerning personal data;

or [(12)] (L) agent, broker-dealer, investment adviser orinvestmentadviser agent,assuchtermsare definedinsection 36b-3, who is regulated by the Department of Banking or the Securities and Exchange Commission.

(2) The provisions of subdivision (1) of this subsection shall not be construed to excuse a controller from performing the controller's duties in response to the exercise of a consumer's rights afforded under subdivision (6) of subsection (a) of section 42-518, as amended by this act, insofar as such controller is processing theconsumer's personal data by automated means for purposes of profiling in furtherance of a solely automated decision that results in the provision or denial by the controller to the consumer of any employment opportunity.

LCO 26 of 36 Substitute Bill No.

4 Sec.

14.

(1) Confirm whether or not a controller is processing the consumer's personal data and access such personal data, including, but not limited to, any inferences about the consumer derived from such personal data and whether a controller or processor is processing a consumer's personal data for the purposes of profiling to make a decision that produces any legal or similarly significantPublic effectAct concerningNo. a consumer, unless such confirmation or access would require the controller to reveal a trade secret or the controller is prohibited from disclosing such personal data under subsection (e) of this section;

26-64 28 of 41 Substitute Senate Bill No.

4 significant effect concerning a consumer, unless such confirmation or access would require the controller to reveal a trade secret or the controller is prohibited from disclosing such personal data under subsection (e) of this section;

(3) delete (A) personal data provided by, or obtained about, the consumer;consumer, (B) publicly available information that is (i) collated and combined to create a consumer profile that is made available to a user of a publicly accessible Internet web site for compensation or free of charge, or (ii) made available for sale, or (C) any inference generated from the information described in subparagraph (B) of this subdivision;

(6) if the consumer's personal data were processed for the purposes of profiling in furtherance of any automated decision that produced any legal or similarly significant effect concerning the consumer, and if feasible, (A) question the result of such profiling, (B) be informed of the reason that such profiling resulted in such decision, (C) review the consumer's personal data that were processed for the purposes of such profiling, [and]and (D) if the profiling LCOdecision 27concerned housing, taking into account the nature of 36the Substitutepersonal Billdata and the purposes for which such personal data were processed, [allow the consumer to] correct any incorrect personal data that were processed for the purposes of such profiling and have the Public Act No.

426-64 decision29 concerned housing, taking into account the nature of the41 personalSubstitute dataSenate andBill theNo. purposes for which such personal data were processed, [allow the consumer to] correct any incorrect personal data that were processed for the purposes of such profiling and have the profiling decisionreevaluatedbasedonthe correctedpersonaldata,and (E) if the profiling decision concerned denial of an employment opportunity, taking into account the nature of the personal data and the purposes for which such personal data were processed, be informed whether any personal data processed for the purposes of such profiling were submitted by a third party, correct any incorrect personal data submitted by a third party that were processed for purposes of such profiling and have the profiling decision reevaluated based on the corrected personal data;

and4 profiling decisionreevaluatedbasedonthe correctedpersonaldata;and (7) obtain from the controller a list of the third parties to which such controller has sold the consumer's personal data or, if such controller does not maintain a list of the third parties to which such controller has soldsoldtheconsumer'spersonaldata,alist theofallthirdpartiesto consumer'swhichsuch personal data, a list of all third parties to which such controller has sold personal data, provided the controller shall not be required to reveal any trade secret.

15.14.

(B) unless the controller obtains the consumer's consent, not process the consumer's personal data for any [material] new purpose that is neither reasonably necessary to, nor compatible with, the purposes that were disclosed to the consumer, pursuant to subparagraph (A) of this subdivision, taking into account (i) the consumer's reasonable expectation regarding such personal data at the time such personal data were collected based on the purposes that were disclosed to the consumer pursuant to subparagraph (A) of this subdivision, (ii) the relationship that such new purpose bears to the LCOpurposes 28that were disclosed to the consumer pursuant to subparagraph (A) of 36this Substitutesubdivision, Bill(iii) No.the impact that processing such personal data for such new purpose might have on the consumer, (iv) the relationship between the consumer and the controller and the context in which the personal data were collected, and (v) the existence of additional safeguards, including, but not limited to, encryption or pseudonymization, in processing such personal data for such new purpose;

4(C) purposesestablish, thatimplement were disclosed to the consumer pursuant to subparagraph (A) of this subdivision, (iii) the impact that processing such personal data for such new purpose might have on the consumer, (iv) the relationship between the consumer and themaintain controllerreasonable andPublic theAct contextNo. in which the personal data were collected, and (v) the existence of additional safeguards, including, but not limited to, encryption or pseudonymization, in processing such personal data for such new purpose;

(C)26-64 establish,30 implement and maintain reasonable administrative, technical and physical data security practices to protect the confidentiality, integrity and accessibility of personal41 dataSubstitute appropriateSenate toBill theNo. volume and nature of the personal data at issue;

4 administrative, technical and physical data security practices to protect the confidentiality, integrity and accessibility of personal data appropriate to the volume and nature of the personal data at issue;

and (I) not process the personal data of a consumer for purposes of targeted advertising, or sell LCOthe 29consumer's personal data, under circumstances where a controller has actual knowledge, or wilfully disregards, that the consumer is at least thirteen years of 36age Substitutebut Billyounger No.than eighteen years of age.

4A thecontroller consumer'sshall personalnot data,discriminate underagainst circumstancesa whereconsumer afor controllerexercising hasany actualof knowledge,the orconsumer wilfullyrights disregards,contained thatin thesections consumer42-515 isto at42-525, leastinclusive, thirteenas yearsamended ofby agethis butact, youngerincluding thandenying eighteengoods yearsor ofservices, age.charging Public Act No.

A26-64 controller31 shall not discriminate against a consumer for exercising any of the41 consumerSubstitute rightsSenate containedBill inNo. sections 42-515 to 42-525, inclusive, as amended by this act, including denying goods or services, charging different prices or rates for goods or services or providing a different level of quality of goods or services to the consumer.

4 different prices or rates for goods or services or providing a different level of quality of goods or services to the consumer.

(3) (A) No controller shall sell,sell share or transfer, or allow any otherconsumer's person to access, precise geolocation data.

(B) The provisions of subparagraph (A) of this subdivision shall not be construed to apply to the content of communications or any data generated by or connected to advanced utility metering infrastructure systems or equipment for use by a utility.

16.15.

[(2)] (B) taking into account the nature of processing and the information available to the processor, by assisting the controller in meeting the controller's obligations in relation toPublic theAct security of processing the personal data and in relation to the LCO 30 of 36 Substitute Bill No.

426-64 notification32 of a41 breachSubstitute ofSenate security,Bill asNo. defined in section 36a-701b, of the systemoftheprocessor,inordertomeetthecontroller'sobligations;and [(3)] (C) providing necessary information to enable the controller to conduct and document data protection assessments and impact assessments.

(2)Noprocessorshallsell,shareortransfer,orallowanyotherperson4 to access,the precisesecurity geolocationof data.processing the personal data and in relation to the notification of a breach of security, as defined in section 36a-701b, of the systemoftheprocessor,inordertomeetthecontroller'sobligations;and [(3)] (C) providing necessary information to enable the controller to conduct and document data protection assessments and impact assessments.

(2) (A) No third party shall sell any consumer's precise geolocation data.

(B) The provisions of subparagraph (A) of this subdivision shall not be construed to apply to the content of communications or any data generated by or connected to advanced utility metering infrastructure systems or equipment for use by a utility.

17.16.

[(7)]Public (G)Act takeNo. steps at the request of a consumer prior to entering into a contract;

26-64 33 of 41 Substitute Senate Bill No.

4 [(7)] (G) take steps at the request of a consumer prior to entering into a contract;

[(9)] (I) prevent, detect, protect against or respond to security incidents, identity theft, fraud, harassment, malicious or deceptive activities or any illegal activity, preserve the integrity or security of systems or investigate, report or prosecute those responsible LCOfor 31any ofsuchaction; 36 Substitute Bill No.

4 for any suchaction;

(2) (A) NotwithstandingA thecontroller provisions of subparagraph (I) of subdivision (1) of this subsection, no controller, processor or consumer health data controller shallthat useuses any facial recognition technology on its premises to prevent, detect, protect against or respond to security incidents, identity theft, fraud, harassment,Public maliciousAct orNo. deceptive activities or any illegal activity, preserve the integrity or security of systems or investigate, report or prosecute those responsible for any such action, unless:

(i)26-64 Such34 facialof recognition41 technologySubstitute isSenate usedBill exclusivelyNo. by such controller, processor or consumer health data controller to match still imagesorvideo to a database maintainedexclusively by suchcontroller, processor or consumer health data controller;

and4 (ii)harassment, clearlymalicious legibleor signagedeceptive isactivities postedor atany eachillegal entranceactivity, topreserve the premisesintegrity whereor thesecurity facialof recognitionsystems technologyor describedinvestigate, inreport subparagraphor (A)(i)prosecute ofthose thisresponsible LCOfor 32any ofsuch 36action Substituteshall: Bill No.

4(i) subdivisionExclusively isuse in use, other than an entrance to an area where access is restricted to authorized employees, (I) alerting consumers entering such premises that facial recognition technology isto inmatch usestill atimages such premises, and (II) that includes a conspicuous hyperlink or quickvideo response code that directs consumers to thea privacydatabase policy maintained exclusively by such controller,controller processor or consumer health data controller.controller;

(B)and Each(ii) privacypost policyclearly maintainedlegible pursuantsignage at each entrance to the premises where the facial recognition technology described in subparagraph (A)(ii)(II)(A)(i) of this subdivision shallis requirein use, other than an entrance to anarea where access isrestrictedto authorizedemployees,(I)alerting consumers entering such premises that facial recognition technology is in use at such premises, and (II) that includes a conspicuous hyperlink or quick response code that directs consumers to the controller,facial processorrecognition technology policy maintained by such controller or consumer health data controllercontroller. to:

(i)(B) EnableEach afacial consumerrecognition totechnology (I)policy readilymaintained determinepursuant whetherto the consumer is included in the database described in subparagraph (A)(i)(A)(ii)(II) of this subdivision,subdivision: and (II) if the consumer is included in such database, submit to such controller, processor or consumer health data controller a written request that such consumer be removed from such database;

and(i) (ii)Shall notinclude later than fifteen days after such controller, processor or consumer health data controller receives a written request submitted under subparagraph (B)(i)(II) of this subdivision, (I) either grant or deny such request, and (II) send a written notice to the consumer who submitted such request disclosing such controller's, processor's or consumer health data controller's decision, the reasons therefor and, if such controller, processor or consumer health controller denied such request, contact information for the office of the Attorney General.General;

and (ii) may disclose the controller's or consumer health data controller's policies concerning interactions between such controller's or consumer health data controller's loss prevention officers and consumers.

17.

(NEW) (Effective October 1, 2026) As used in this section and sections 18 and 19 of this act:

(1) "Biological sample" (A) means any material that is derived from the human body and known to contain DNA, and (B) includes, but is not limited to, any human tissue, blood, urine or saliva;

(2) "Consumer" means any individual who is physically present in this state and a recipient, or a prospective recipient, of genetic testing;

(3) "De-identified data" means any data that cannot reasonably be used to infer information about, or otherwise be linked to, an identified Public Act No.

26-64 35 of 41 Substitute Senate Bill No.

4 or identifiable individual if the direct-to-consumer genetic testing company that possesses such data (A) takes administrative and technical measures to ensure that such data cannot be associated with an individual, (B) publicly commits to possess and use such data exclusively in de-identified form and not to attempt to reidentify such data, and (C) contractually obligates any recipient of such data to satisfy the criteria set forth in subparagraphs (A) and (B) of this subdivision;

(4) "Direct-to-consumer genetic testing company" or "company" (A) means any person doing business in this state who, in the ordinary course of such business, (i) offers genetic testing directly to a consumer, or (ii) collects, uses or analyzes genetic data that a consumer has provided to such person, and (B) does not include any individual who (i) is licensed by this state to provide health care services, and (ii) while acting within the scope of such individual's practice, orders genetic testing for a medical purpose;

(5) "DNA" means deoxyribonucleic acid;

(6) "Express consent" means an affirmative response by a consumer to a clear, meaningful and prominent notice regarding the collection, use, retention or disclosure of the consumer's genetic data for a specific purpose;

(7) "Genetic data" (A) means any data, regardless of format, concerning an individual's genetic characteristics, (B) includes, but is not limited to, (i) any raw sequence data that result from sequencing all, or any portion of, an individual's DNA, (ii) any genotypic or phenotypic information that is obtained by analyzing an individual's raw sequence data, and (iii) any information that (I) concerns a condition affecting an individual's health, (II) the individual reports to a direct-to-consumer genetic testing company, and (III)the direct-to-consumer genetic testing company analyzes in connection with the individual's raw sequence data and uses for scientific research or product development, and (C) Public Act No.

26-64 36 of 41 Substitute Senate Bill No.

4 does not include de-identified data;

(8) "Genetic testing" means (A) any laboratory test performed on an individual's complete DNA sequence, or one or more of an individual's DNA regions, chromosomes, genes or gene products, for purposes of determining the presence or absence of any genetic characteristic, and (B) any interpretation of an individual's genetic data;

and (9) "Person" means any individual, association, corporation, limited liability company, partnership, trust or other legal entity.

Sec.

(NEW) (Effective October 1, 2026) A consumer shall have a property right in, and shall retain the right to exercise exclusive control over, any biological sample that is derived from the consumer's body and provided to, or used by, a direct-to-consumer genetic testing company, as well as the results of any genetic testing conducted on the consumer's DNA by a direct-to-consumer genetic testing company.

Such right to exercise exclusive control includes, but is not limited to, the right to exercise exclusive control over the collection, use, retention, maintenance, disclosure or destruction of such biological sample and results.

Sec.

19.

(NEW) (Effective October 1, 2026) (a) A direct-to-consumer genetic testing company shall:

(1) At all times transact its business and conduct its affairs in a manner that is consistent with a consumer's rights under section 18 of this act;

(2) Prior to accepting any biological sample, genetic data or payment from a consumer, disclose to the consumer the company's policies and proceduresconcerning thecollection,use and disclosure ofgeneticdata;

(3) Display, in a prominent and publicly accessible location on the company'sInternet website, a privacy notice disclosing such company's Public Act No.

26-64 37 of 41 Substitute Senate Bill No.

4 policies and procedures concerning the collection, use, access, disclosure, transfer, security, retention and deletion of a consumer's data and the consumer's consent thereto;

(4) Prior to collecting, using or disclosing a consumer's genetic data, obtain the consumer's express consent for such collection, use or disclosure after disclosing to such consumer (A) the company's policies and procedures concerning use of the genetic data such company collects from consumers, (B) the identity of each person who may access the results of genetic testing performed by the company, including, but not limited to, any vendor or service provider for such company who may access such results, and (C) the manner in which the company may disclose such consumer's genetic data;

(5) In addition to the express consent required under subdivision (4) of this subsection, separately obtain a consumer's express consent to (A) disclose or transfer theconsumer's genetic data to any person other than a vendor or service provider for the company, prior to disclosing or transferring such genetic data to such person, (B) use the consumer's genetic data for any purpose other than the primary purpose for which the company offered genetic testing directly to such consumer, prior to using such genetic data for such other purpose, or (C) retain the consumer's biological sample for any period following completion of the genetic testing for which such consumer provided such biological sample, prior to retaining such biological sample for such period;

(6) Obtain informed consent from a consumer in accordance with the federal policy for the protection of human subjects under 45 CFR 46, as amended from time to time, for any disclosure or transfer of the consumer's genetic data to a third party for research purposes or research conducted under the control of the company for purposes of publication or generalizable knowledge;

(7) Not disclose the results of any genetic testing performed on a Public Act No.

26-64 38 of 41 Substitute Senate Bill No.

4 consumer's DNA to any person other than the consumer, unless (A) the company has obtained such consumer's express consent to such disclosure, or (B) such disclosure is made to a person acting pursuant to a court order, warrant or subpoena;

(8) Not disclose a consumer's genetic data to (A) the consumer's employer, (B) any person who, in the ordinary course of business, (i) offers health insurance, life insurance or long-term care insurance coverage in this state or any other state, or (ii) provides information or data to any insurer, as defined in section 38a-1 of the general statutes, health care center, as defined in section 38a-175 of the general statutes, or fraternal benefit society, as described in section 38a-595 of the general statutes, for purposes of underwriting or rating of risks, or (C) any third party which the company knows, or reasonably should know, intends to use such genetic data for purposes of marketing, including, but not limited to, targeted advertising;

(9) Implement reasonable security measures to protect a consumer's biological sample or genetic data from any unauthorized access, destruction, use, modification or disclosure;

and (10) Implement a process for a consumer to (A) access the consumer's genetic data from the company, (B) require the company to delete the consumer's genetic data, (C) require the company to destroy, and confirm that such company has destroyed, the consumer's biological sample, and (D) revoke the consumer's consent for (i) the company to use such consumer's genetic data for research purposes, or (ii) any third party to which the company has provided such consumer's genetic data to use such genetic data for research purposes.

(b) Any violation of subsection (a) of this section shall be deemed an unfairordeceptivetradepracticeundersubsection(a)ofsection42-110b of the general statutes and shall be enforced solely by the Attorney General.

Nothing in this section shall be construed to create a private Public Act No.

26-64 39 of 41 Substitute Senate Bill No.

4 right of action or to provide grounds for an action under section 42-110g of the general statutes.

Sec.

20.

(1)(1)"Cable "Automatedoperator"hasthesame licensemeaning plateasprovidedin47USC reader"522, meansas aamended mobilefrom ortime fixedto electronictime; device that is capable of recording data on, or taking a photograph or video of, a vehicle or a vehicle's license plate;

(2) "Automated"Commercial licenseadvertisement" platehas readerthe information"same meansmeaning informationas thatsuch term is (A)used gatheredin by an automated license plate reader, or (B) created through an analysis of the informationCommercial gatheredAdvertisement byLoudness anMitigation automatedAct, licenseP.L. plate reader;

(3)111-311, "Automatedas licenseamended platefrom readertime user" means a person who (A) owns or operates an automated license plate reader, or (B) has access to LCOtime; 33 of 36 Substitute Bill No.

4(3) the"Consumer" automatedmeans licenseany plateperson readerwho informationis gatheredphysically bypresent thein automatedthis licensestate plateand reader;is a recipient, or a prospective recipient, of a streaming video service;

(4) "Exigent"Multichannel circumstances"video (A)programming meansdistributor" circumstanceshas thatthe weresame unforeseeablemeaning andas poseprovided anin imminent47 threatUSC to522, publicas healthamended orfrom safety,time (B) includes, but is not limited to, circumstances that would cause a reasonable person to believetime; that access to automated license plate reader information is necessary to prevent physical harm to an individual, the destruction of evidence or the escape of a suspect, and (C) does not include investigating any suspected immigration violation or otherwise assisting in any immigration enforcement activity;

(5) "Gender-affirming"Person" healthmeans careany services"individual, hasassociation, thecorporation, samelimited meaningliability ascompany, providedpartnership, intrust sectionor 52-571mother oflegal theentity; general statutes;

(6) "Law"Streaming enforcementvideo agency"service" hasmeans theany sameservice meaningthrough aswhich providedany invideo sectioncontent, 54-240including, ofbut not limited to, any video programming, is made available directly to consumers through a distribution method that uses the generalInternet statutes;protocol;

(7) "Person""Television meansbroadcast anstation" individual,has association,the corporation,same limitedmeaning liabilityas company,provided partnership,in trust47 orUSC other325, legalas entity;amended from time to time;

(8) "Protected health care activity" means (A) seeking, providing or receiving reproductive health care services or gender-affirming health care services, and (B)(8) assisting"Video anyprogramming" otherhas individualthe whosame ismeaning seeking,as providingprovided orin receiving47 reproductiveUSC health613, careas servicesamended orfrom gender-time affirming health care services, including, but not limited to, by providing information, transportation, lodging or material support to suchtime. other individual;

(b) On and (9)after "ReproductiveJuly health1, care2027, services"a hasstreaming video service shall not transmit to a consumer the sameaudio meaningof asa providedcommercial inadvertisement sectionat 52-571ma volume that is louder than the volume of the generalvideo statutes.content that Public Act No.

(b)26-64 On40 and after October 1, 2026, the Department of Transportation,41 theDepartmentofMotor Vehiclesoralawenforcement agency shallnot enter into or renew any contract with an automated license plate reader user, unless such contract provides that the automated license plate reader user shall not engage in any of the following activities with LCO 34 of 36 Substitute Senate Bill No.

4 respectaccompanies tothe anycommercial automatedadvertisement, licenseconsistent platewith readerthe informationregulations gatheredadopted inby thisthe state:Federal Communications Commission pursuant to the Commercial Advertisement Loudness Mitigation Act, P.L.

(1)111-311, Sellfor suchtelevision automatedbroadcast licensestations, platecable readeroperators information;and other multichannel video programming distributors.

(2)(c) ShareAny orviolation transferof suchthe automatedprovisions licenseof platesubsection reader(b) informationof tothis anysection personshall otherconstitute thanan unfair trade practice for the Departmentpurposes of Transportation,subsection the(a) Departmentof section 42-110b of Motorthe Vehiclesgeneral orstatutes aand lawshall enforcementbe agency;enforced solely by the Attorney General.

(3)The Allowprovisions anyof personsection other42-110g than the Department of Transportation, theDepartmentofMotorVehiclesoralawenforcementagencytoaccess such automated license plate reader information, unless the automatedgeneral licensestatutes plateshall readernot userapply is required to allowany such personviolation. to access such automated license plate reader information (A) pursuant to a signed judicial warrant or valid court order issued by a court of competent jurisdiction, or (B) due to the existence of exigent circumstances;

orNothing (4) Share or transfer such automated license plate reader information, or allow access to such automated license plate reader information, if the automated license plate reader user reasonably believes that such automated license plate reader information may be used for purposes of (A) investigating any suspected immigration violation or otherwise assisting in any immigration enforcement activity, (B) investigating any suspected, or prosecuting any alleged, activity, including, but not limited to, any protected health care activity, that is legal in this state,section orshall (C)be anyconstrued effortas toproviding identify, or impose any civil or criminal liability on, any person based solely on such person's participation in any activity that is protected by the Unitedbasis Statesfor Constitutiona orprivate theright Constitution of theaction statefor of Connecticut, including, but not limited to, any exerciseviolation of suchsubsection person's(b) right to freedom of speech,this tosection. peaceably assemble or to petition the government for a redress of grievances, except as otherwise provided by applicable state or federal law.

(c)Governor's AutomatedAction: license plate reader information is confidential and shall not be deemed a public record for the purposes of the Freedom of Information Act, as defined in section 1-200 of the general statutes.

LCOApproved 35May of27, 362026 SubstitutePublic BillAct No.

426-64 (d)41 The Attorney General may institute proceedings to enforce the provisions of subsections41 (b) and (c) of this section.

In any proceedings instituted under this subsection, the court may grant appropriate relief, including, but not limited to, preliminary, temporary or permanent injunctive relief.

This act shall take effect as follows and shall amend the following sections:

Section 1 October 1, 2026 New section Sec.

2 October 1, 2026 New section Sec.

3 October 1, 2026 New section Sec.

4 October 1, 2026 New section Sec.

5 October 1, 2026 New section Sec.

6 October 1, 2026 New section Sec.

7 October 1, 2026 New section Sec.

8 October 1, 2026 New section Sec.

9 October 1, 2026 New section Sec.

10 October 1, 2026 New section Sec.

11 October 1, 2026 New section Sec.

12 October 1, 2026 42-515 Sec.

13 October 1, 2026 42-517(a) Sec.

14 October 1, 2026 42-518(a) Sec.

15 October 1, 2026 42-520(a) Sec.

16 October 1, 2026 42-521(a) Sec.

17 October 1, 2026 42-524(a) Sec.

18 October 1, 2026 New section GL Joint Favorable Subst.

JUD Joint Favorable APP Joint Favorable LCO 36 of 36