SB 1295 — AN ACT CONCERNING BROADBAND INTERNET, GAMING, SOCIAL MEDIA, ONLINE SERVICES AND CONSUMER CONTRACTS.

(i)Beginning on January 31,2027,any state agency proposing to enter into a contract for the purchase of broadband Internet access service shall, all other factors being equal, give preference to a qualified broadband Internet access service provider that offers affordable broadband Internet access service to eligible households pursuant to this section.

Public Act No.

25-113 5 of 80 Substitute Senate Bill No.

1295 (j) The provisions of subsections (a) to (i), inclusive, of this section shall not be construed to impair any contract that is in existence on October 1, 2026.

(k) Notwithstanding any provision of the general statutes, no violation of this section shall be deemed an unfair method of competition or an unfair or deceptive act or practice in the conduct of any trade or commerce pursuant to subsection (a) of section 42-110b of the general statutes.

Sec.

2.

Section 12-815a of the general statutes is repealed and the following is substituted in lieu thereof (Effective October 1, 2025):

(a) The Commissioner of Consumer Protection shall issue vendor, affiliate, lottery sales agent and occupational licenses in a form and manner prescribed by the commissioner and in accordance with the provisions of this section.

(b) No person or business organization awarded a primary contract by the Connecticut Lottery Corporation to provide facilities, components,goodsorservicesthatarenecessaryforanddirectlyrelated to the secure operation of the activities of said corporation shall do so unless such person or business organization is issued a vendor license by the Commissioner of Consumer Protection.

For the purposes of this subsection, "primary contract" means a contract to provide facilities, components, goods or services to said corporation by a person or business organization (1) that provides any lottery game or any online wagering system related facilities, components, goods or services and that receives or, in the exercise of reasonable business judgment, can be expected to receive more than seventy-five thousand dollars or twenty- five per cent of its gross annual sales from said corporation, or (2) that has access to the facilities of said corporation and provides services in such facilities without supervision by said corporation.

Each applicant for a vendor license shall pay a nonrefundable application fee of two Public Act No.

25-113 6 of 80 Substitute Senate Bill No.

1295 hundred fifty dollars.

(c) (1) The Connecticut Lottery Corporation may employ the delivery services of a business organization that does not hold a vendor license for the purpose of transporting and delivering lottery tickets to lottery sales agents, provided:

(A) All lottery tickets are securely packaged in tamper-evident packaging by employees of the corporation on the premises of the corporation while under video surveillance, the exterior of such packaging does not contain any word, graphic or symbol indicating that such packaging contains lottery tickets and the corporation does not include the word "lottery" anywhere on such packaging, including in the return address;

(B) All packages are tracked and require a signature upon delivery;

(C) The corporation creates and retains documentation for each package, which documentation includes, at a minimum, the following information:

(i) The lottery game number;

(ii) the pack number or numbers;

(iii)thelottery game name;

(iv)thenumber ofpackscontained in such package;

(v) the name and address of the lottery sales agent who is the intended recipient of the lottery tickets;

(vi) the package shipment date;

and (vii) the name of the business organization delivering the tickets from the corporation to the lottery sales agent.

(2) Prior to utilizing a business organization described in subdivision (1) of this subsection for the purpose set forth in said subdivision, the corporation shall provide a detailed plan to the department, in a form and manner prescribed by the commissioner, which plan shall be reviewed and approved or denied by the commissioner not later than thirty days after the department receives such plan.

Such plan shall include, at a minimum, the following information:

(A) The name and contact information for the business organization;

Public Act No.

25-113 7 of 80 Substitute Senate Bill No.

1295 (B) The proposed date to commence shipment through such business organization;

(C) A detailed description of the specific tamper-evident packaging to be used, which description shall include the security features for such packaging;

(D) The additional security measures to be provided by the business organization during transport and at the point of delivery;

and (E) A description of the processes to be employed by the business organization in transporting the lottery tickets in the event a delivery is unsuccessful.

(3) The corporation shall retain a copy of all documentation created pursuant to subdivision (2) of this subsection for not less than three years.

In theevent thecorporationisnotifiedby alottery salesagentthat a package oflotteryticketsappearsto bedamaged,missing or otherwise compromised at the time of delivery, the corporation shall immediately notify the department and shall provide instructions to the lottery sales agent to embargo the package until such time that the contents can be verified against the documentation retained by the corporation.

[(c)] (d) No person or business organization, other than a shareholder in a publicly traded corporation, may be a contractor or a subcontractor for the provision of facilities, components, goods or services that are necessary for anddirectly relatedto thesecure operationoftheactivities of the Connecticut Lottery Corporation, or may exercise control in or over a vendor licensee unless such person or business organization is licensed as an affiliate licensee by the commissioner.

Each applicant for an affiliate license shall pay a nonrefundable application fee of two hundred fifty dollars.

[(d)] (e) (1) Each employee of a vendor or affiliate licensee who has access to the facilities of the Connecticut Lottery Corporation and Public Act No.

25-113 8 of 80 Substitute Senate Bill No.

1295 provides services in such facilities without supervision by said corporation or performs duties directly related to the activities of said corporation shall obtain an occupational license.

(2) Each officer, director, partner, trustee or owner of a business organization licensed as a vendor or affiliate licensee and any shareholder, executive, agent or other person connected with any vendor or affiliate licensee who, in the judgment of the commissioner, will exercise control in or over any such licensee shall obtain an occupational license.

(3) Each employee of the Connecticut Lottery Corporation shall obtain an occupational license.

[(e)] (f) The commissioner shall issue occupational licenses in the following classes:

(1) Class I for persons specified in subdivision (1) of subsection [(d)] (e) of this section;

(2) Class II for persons specified in subdivision (2) of subsection [(d)] (e) of this section;

(3) Class III for persons specified in subdivision (3) of subsection [(d)] (e) of this section who, in the judgment of the commissioner, will not exercise authority over or direct the management and policies of the Connecticut Lottery Corporation;

and (4) Class IV for persons specified in subdivision (3) of subsection [(d)] (e) of this section who, in the judgment of the commissioner, will exercise authority over or direct the management and policies of the Connecticut Lottery Corporation.

Each applicant for a Class I or III occupational license shall pay a nonrefundable application fee of twenty dollars.

Each applicant for a Class II or IV occupational license shall pay a nonrefundable application fee of one hundred dollars.

The nonrefundable application fee shall accompany the application for each such occupational license.

Applicants for such licenses shall apply in a form and manner prescribed by the commissioner.

(g) Each applicant for a Class III or Class IV occupational license, and Public Act No.

25-113 9 of 80 Substitute Senate Bill No.

1295 each employee of the corporation holding such a license on January 1, 2026, shall disclose, in a form and manner prescribed by the commissioner, the forms of gaming under this chapter and chapter 229b on which such applicant or such licensed employee will work as an employee of the corporation.

For an applicant approved for a Class III or Class IV occupational license, or for an employee of the corporation who currently holds such a license, the commissioner may issue a separate endorsement authorizing such licensee to engage in the corporation's operation, under chapter 229b, of Internet games or retail sports wagering, as such terms are defined in section 12-850, and such employee shall not be required to apply for a license pursuant to section 12-858 or section 12-859 in order to engage in such operation.

All Class III or Class IV occupational licensees shall report to the department any criminal conviction not later than two business days after the order or judgment of such conviction is rendered.

The corporation and all Class III or Class IV occupational licensees shall immediately report to the department any change in the scope of employment of such licensee employed by the corporation that would require the employee to obtain an additional endorsement pursuant to this subsection.

[(f)] (h) No person or business organization may be a lottery sales agent unless such person or organization is licensed as a lottery sales agent by the commissioner.

[(g)] (i) In determining whether to grant a vendor, affiliate, lottery sales agent or occupational license to any such person or business organization, the commissioner may require an applicant to provide information as to such applicant and person in charge related to:

(1) Financial standing and credit;

(2) moral character;

(3) criminal record, if any;

(4) previous employment;

(5) corporate, partnership or association affiliations;

(6) ownership of personal assets;

and (7) such other information as the commissioner deems pertinent to the issuance of such license, provided the submission of such other information will Public Act No.

25-113 10 of 80 Substitute Senate Bill No.

1295 assure the integrity of the state lottery.

The commissioner shall require each applicant for a vendor, affiliate, lottery sales agent or occupational license, provided if an applicant for a lottery sales agent is a business organization the commissioner shall require such entity's person in charge to submit to state and national criminal history records checks and may require each such applicant, or person in charge, to submit to an international criminal history records check before such license is issued.

The state and national criminal history records checks required pursuant to this subsection shall be conducted in accordance with section 29-17a.

The commissioner shall issue a vendor, affiliate, lottery sales agent or occupational license, as the case may be, to each applicant who satisfies the requirements of this subsection and who is deemed qualified by the commissioner.

[The commissioner may reject for good cause an application for a vendor, affiliate, lottery sales agent or occupational license.] [(h)] (j) Each vendor, affiliate or Class I or II occupational license shall be effective for not more than one year from the date of issuance.

Each Class III or IV occupational license shall remain in effect throughout the term of employment of any such employee holding such a license.

The commissioner may require each employee issued a Class IV occupational license to submit information as to such employee's financial standing and credit annually.

Initial application for and renewal of any such license shall be in such form and manner as the commissioner shall prescribe.

[(i)] (k) (1) Upon petition of the corporation, a vendor licensee or an affiliate licensee, the department may authorize an applicant for an occupational license to provisionally performthe work permitted under the license applied for, if:

(A) The applicant has filed a completed occupationallicense application intheformandmanner requiredby the commissioner, and (B) the corporation, vendor licensee or affiliate licensee attests that the provisional authorization is necessary to Public Act No.

25-113 11 of 80 Substitute Senate Bill No.

1295 continue the efficient operation of the lottery, and is based on circumstances that are extraordinary and not designed to circumvent the otherwise applicable licensing procedures.

(2) The department may issue a provisional authorization to an applicant for an occupational license in advance of issuance or denial of such license for a period not to exceed six months.

Provisional authorization shall permit such applicant to perform the functions and require the applicant to comply with the requirements of the occupational license applied for as set forth in the provisions of this chapter and regulations adopted pursuant to this chapter.

Provisional authorization shall not constitute approval for an occupational license.

During the period of time that any provisional authorization is in effect, the applicant granted such authorization shall be subject to and comply with all applicable statutes and regulations.

Any provisional authorization issued by the department shall expire immediately upon the earlier of:

(A) The date of issuance of written notice from the department that the occupational license has been approved or denied, or(B)sixmonthsafterthedatetheprovisionalauthorizationwasissued.

(3) An individual whose occupational license application is denied after a period of provisional authorization shall not reapply for an occupational license for a period of one year from the date of the denial.

(4) An individual whose provisional authorization expires pursuant to subparagraph (B) of subdivision (2) of this subsection may apply for anadditionalprovisionalauthorization.Thedepartmentmayissuesuch additional provisional authorization upon a determination that the conditions of subparagraph (B) of subdivision (1) of this subsection exist.

[(j)] (l) When an incident occurs, or is reasonably suspected to have occurred, that causes a disruption in the operation, security, accuracy, integrity or availability of the lottery gaming system, the vendor Public Act No.

25-113 12 of 80 Substitute Senate Bill No.

1295 licensed to provide such lottery gaming system shall, immediately upon discovery of such incident, but not later than twenty-four hours after discovery of such incident, provide the department with a written incident report including the details of the incident and the vendor's proposed corrections.

Not later than five business days after notifying the department of an incident, the vendor licensee shall provide the department with a written incident report that (1) details the incident, including the root cause of the incident, and (2) outlines the vendor's plan to make corrections, mitigate theeffects of the incident and prevent incidents of a similar nature from occurring in the future.

If the vendor licensee is unable to determine the root cause and correct the incident within the initial five business days, the licensee shall continue to update the department every five business days with written incident reports until the root cause is determined and the incident is corrected.

The department may require the vendor licensee to submit the lottery gaming system to a gaming laboratory for recertification.

[(k)] (m) (1) [The] After a hearing held in accordance with chapter 54, the commissioner may, for good cause, suspend, [or] revoke, [for good cause] refuse to renew or place conditions on a vendor, affiliate, lottery sales agent or occupational license, [after a hearing held before the commissioner in accordance with chapter 54] deny an application for any such license or impose a civil penalty on a vendor, affiliate, lottery sales agent or occupational licensee for good cause, including, but not limited to:

(A) Any failure to comply with theprovisions of this chapter, chapter 226 or the regulations adopted pursuant to said chapters;

(B) any conduct likely to mislead, deceive or defraud the public or the commissioner;

(C) any provision of materially false or misleading information;

(D) any criminal conviction or civil judgment involving fraud,theft or another financialcrime;

(E)any demonstratedinsolvency, including, but not limited to, the filing of a bankruptcy petition or any failure to meet material financial obligations that directly impact the licensee's ability to operate in compliance with the provisions of this Public Act No.

25-113 13 of 80 Substitute Senate Bill No.

1295 chapter and chapter 226;

or (F) any failure to complete an application.

The commissioner may order summary suspension of any such license in accordance with subsection (c) of section 4-182.

(2) Any such applicant aggrieved by the action of the commissioner concerning an application for a license, or any person or business organization whose license is suspended or revoked, may appeal pursuant to section 4-183.

(3) The commissioner may impose a civil penalty on any licensee for a violation of any provision of this chapter or any regulation adopted under section 12-568a in an amount not to exceed two thousand five hundred dollars per violation after a hearing held in accordance with chapter 54.

(4) No lottery sales agent shall keep any unauthorized gambling device, illegitimate lottery ticket or illegal bookmaking equipment, or allow any professional gambling, as defined in section 53-278a, at the lottery sales agent's retail facility.

In the event the department finds any unauthorized gambling device, illegitimate lottery ticket, illegal bookmaking equipment or professional gambling at a lottery sales agent's retail facility, the lottery sales agent shall be fined not more than four thousand dollars per violation, and the commissioner shall issue a notice of violation to the lottery sales agent that (A) includes an order summarily suspending the lottery sales agent license the commissioner issued to the lottery sales agent, and (B) notifies the suspended lottery sales agent that the suspended lottery sales agent (i) is liable for the fine imposed pursuant to this subdivision, (ii) shall immediately cease all activity that requires a lottery sales agent license, and (iii) may, not later than fifteen days after the lottery sales agent receives such notice of violation, submit to the commissioner a written request that a hearing be held in accordance with the provisions of chapter 54 concerning such summary suspension and fine.

If the suspended lottery sales agent requests a hearing within such fifteen-day period, the commissioner Public Act No.

25-113 14 of 80 Substitute Senate Bill No.

1295 shall conduct a hearing in accordance with the provisions of chapter 54 concerning such summary suspension and fine.

If the suspended lottery sales agent does not request a hearing within such fifteen-day period, the summary suspension order issued, and fine imposed, pursuant to this subdivision shall be deemed a final decision subject to appeal pursuant to section 4-183.

A summary suspension order issued pursuant to this subdivision shall remain in effect until the summary suspension is lifted and all fines imposed pursuant to this subdivision have been paid.

The summary suspension may be lifted by a written order issued by the commissioner or upon a final decision rendered after a hearing held in accordance with the provisions of chapter 54.

[(l)] (n) The commissioner may require that the books and records of any vendor or affiliate licensee be maintained in any manner which the commissioner may deem best,andthat any financialor other statements based on such books and records be prepared in accordance with generally accepted accounting principles in such form as the commissioner shall prescribe.

The commissioner or a designee may visit, investigate and place expert accountants and such other persons as deemed necessary in the offices or places of business of any such licensee, or require that the books and records of any such licensee be provided to the department, for the purpose of satisfying [himself or herself] the commissioner that such licensee is in compliance with the regulations [of] adopted by the department.

[(m)] (o) For the purposes of this section, (1) "business organization" means a partnership, incorporated or unincorporated association, firm, corporation, limited liability company, trust or other form of business or legal entity;

(2) "control" means the power to exercise authority over or direct the management and policies of a licensee;

and (3) "person" means any individual.

[(n)] (p) The Commissioner of Consumer Protection may adopt such regulations, in accordance with chapter 54, as are necessary to Public Act No.

25-113 15 of 80 Substitute Senate Bill No.

1295 implement the provisions of this section.

Sec.

3.

(NEW) (Effective July 1, 2025) (a) For purposes of this section:

(1) "House rules" means the terms and conditions for sports wagering;

and (2)"Internalcontrols"meansthewrittensystemofadministrativeand accounting processes and procedures implemented or anticipated to be implemented at a master wagering licensee or online gaming operator that are designed to ensure compliance with chapter 229b of the general statutesandtheregulationspromulgatedthereunder,including, but not limited to, (A) financial reporting, (B) effectiveness and security of operations, (C) "know your customer" procedures, and (D) deterring fraud and anti-money laundering.

(b) (1) (A) An online gaming operator may void any sports wagers that the online gaming operator has accepted from patrons, without obtaining prior approval from the department, if:

(i) The sporting event for which such wagers were accepted has been cancelled, delayed for more than twenty-four hours beyond the originally scheduled start time of such sporting event or transferred to another venue;

(ii) Such wagers were accepted on sporting event players that take no part in the sporting event;

(iii) Such wagers were accepted for an act, or set of acts, to be performed during a sporting event and such act, or set of acts, does not occur;

(iv) Such wagers were accepted based on a specific team qualifying to participate in a post-season tournament and a reduction has been made in the number of teams that are allowed to participate in such Public Act No.

25-113 16 of 80 Substitute Senate Bill No.

1295 tournament;

or (v) Such wagers were accepted on a sporting event and (I) there has been a change in the format of, or the number of participants scheduled to participate in, a phase of the sporting event, or (II) a phase of the sporting event is no longer scheduled to occur.

(B) For all sports wagers voided under subparagraph (A) of this subdivision, the online gaming operator shall reflect such voidance in thepatrons' online gaming accountsandpromptly credit thefundsfrom such voided wagers to such patrons' online gaming accounts.

(C)Eachsportswagering retailer shallpost andmaintaina notice that informs patrons how to determine whether a sports wager has been voided subject to the house rules and how to receive a refund for a voided sports wager.

Such notice shall be (i) in a form and manner approved by the commissioner, (ii) at least eight and one-half inches by eleven inches in size, (iii) in at least twenty-point font, and (iv) posted and maintained at any location in such sports wagering retailer's facility or facilities where a patron may place a sports wager.

(2) An online gaming operator shall modify or void a sports wager that the online gaming operator has accepted from a patron, without obtaining prior approval from the department, if:

(A) The patron requests that the online gaming operator modify or void such wager prior to the sporting event for which such wager was accepted;

and (B) (i) The online gaming operator, or the electronic wagering platform operated by the online gaming operator, erroneously communicated the type, amount or parameters of such wager to the patron, or (ii) an employee of a sports wagering retailer committed an error in entering such wager into the electronic wagering platform operated by the online gaming operator.

Public Act No.

25-113 17 of 80 Substitute Senate Bill No.

1295 (3) Each online gaming operator shall maintain a change log record of all sports wagers that such online gaming operator voids or modifies pursuant to subdivision (1) or (2) of this subsection.

Such record shall be maintained in a form and manner prescribed by the commissioner.

For eachsuch wager, such recordshall,at aminimum,includethe following information:

(A) The name of the affected patron, unless the wager was placed at a retail sports wagering facility;

(B) The reason the online gaming operator voided or modified such wager;

(C) The type of such wager, broken down by market;

(D) The sporting event associated with such wager and the date or dates on which such sporting event occurred or was scheduled to occur;

and (E) Any other information the commissioner, in the commissioner's discretion, requires to properly identify and assess the impact of such voided or modified wager.

(c) (1) If an online gaming operator may not void a specific sports wager under subsection (b) of this section, the online gaming operator may submit a written request to the department, in a form and manner prescribed by the commissioner, to void such wager.

Such request shall, at a minimum, include the following information:

(A) The reason for such request;

(B) The name of each patron who would be affected by voiding such wager, unless the wager was placed at a retail sports wagering facility;

(C) The sporting event associated with such wager and the date or dates on which the sporting event occurred or was scheduled to occur;

Public Act No.

25-113 18 of 80 Substitute Senate Bill No.

1295 (D) The type of such wager;

(E) The total amount of such wager;

and (F) The online gaming operator's plan to contact the patrons who wouldbeaffected by voiding suchwager,unlesssuchwager wasplaced at a retail sports wagering facility.

(2) Upon receiving a written request submitted under subdivision (1) of this subsection, the department may request, and the online gaming operator shall disclose to the department, any additional information the department requires in order to review such request and assess the potential impact that granting such request would have on the affected patrons and the integrity of gaming.

(3) No online gaming operator that submits a request to the department under subdivision (1) of this subsection shall void any sports wager that is the subject of the request unless the department has issued a written notice to the online gaming operator, in a form and manner prescribed by the commissioner, approving such request.

(d) (1) Not later than September 1, 2025, each online gaming operator shall submit to the department, in a form and manner prescribed by the commissioner, such online gaming operator's internal controls concerning voiding sports wagers and allocating patron funds.

The department shall review such internal controls to ensure that such internal controls (A) provide for affected patrons to be notified not later than twenty-four hours after the department approves a request to void any sports wager, regardless of whether such wager was placed online oratasportswageringretailerfacility,(B)provideforthepromptreturn of patron funds after the online gaming operator or sports wagering retailer voids any sports wager, and (C) address any other matter the commissioner, in the commissioner's discretion, determines is integral to preserving the integrity of gaming.

Not later than December 1, 2025, Public Act No.

25-113 19 of 80 Substitute Senate Bill No.

1295 the department shall send notice to each online gaming operator disclosing whether the department has approved or disapproved the internal controls such online gaming operator submitted to the department pursuant to this subdivision.

(2) If the department approves an online gaming operator's internal controls pursuant to subdivision (1) of this subsection, the online gaming operator shall include such internal controls in the online gaming operator's house rules, and the online gaming operator shall display such house rules in a clear and conspicuous location on the electronic wagering platform operated by the online gaming operator.

Sec.

4.

(NEW) (Effective July 1, 2026) (a) As used in this section:

(2)"Cyberbullying"(2) meansany"Cyberbullying" unwantedandaggressivebehavioronmeans any act, carried out on a social media platform;platform, that (A) is reasonably likely to (i) cause physical or emotional harm to a consumer, or (ii) place a consumer in fear of physical or emotional harm, or (B) infringes on any right afforded to a consumer under the laws of this state or federal law;

and sSB1295(6) /"Social Filemedia No.platform" has the same meaning as provided in section 42-528 of the general statutes, as amended by this act.

576(b) 1Not sSB1295later Filethan October 1, 2026, each owner of a social media platform shall incorporate an online safety center into the social media Public Act No.

57625-113 (6)20 "Socialof media80 platform"Substitute hasSenate theBill sameNo. meaning as provided in section 42-528 of the general statutes.

(b)1295 Not later than January 1, 2026, each owner of a social media platform shall incorporate an online safety center into the social media platform.

(c) Not later than JanuaryOctober 1, 2026, each owner of a social media platform shall establish a cyberbullying policy for the social media platform.Suchpolicy shall,ataminimum,set forththemannerinwhich such owner handles reports of cyberbullying on such social media platform.

2.5.

Section 42-52942-515 of the general statutes is repealed and the following is substituted in lieu thereof (Effective OctoberJuly 1, 2025):2026):

As used in this section and sections 42-516 to 42-526, inclusive, as amended by this act, unless the context otherwise requires:

(1) "Abortion" means terminating a pregnancy for any purpose other than producing a live birth.

(2) "Affiliate" means a legal entity that shares common branding with another legal entity or controls, is controlled by or is under common Public Act No.

25-113 21 of 80 Substitute Senate Bill No.

1295 control with another legal entity.

For the purposes of this subdivision, "control" and "controlled" mean (A) ownership of, or the power to vote, more than fifty per cent of the outstanding shares of any class of voting security of a company, (B) control in any manner over the election of a majority of the directors or of individuals exercising similar functions, or (C) the power to exercise controlling influence over the management of a company.

(3) "Authenticate" means to use reasonable means to determine that a request to exercise any of the rights afforded under subdivisions (1) to (4), inclusive, of subsection (a) of section 42-518, as amended by this act, is being made by, or on behalf of, the consumer who is entitled to exercise such consumer rights with respect to the personal data at issue.

(4) "Biometric data" means data generated by automatic measurements of an individual's biological characteristics, such as a fingerprint, a voiceprint, eye retinas, irises or other unique biological patterns or characteristics that are used to identify a specific individual.

"Biometric data" does not include (A) a digital or physical photograph, (B) an audio or video recording, or (C) any data generated from a digital or physical photograph, or an audio or video recording, unless such data [is] are generated to identify a specific individual.

(5) "Business associate" has the same meaning as provided in HIPAA.

(6) "Child" has the same meaning as provided in COPPA.

(7) "Consent" means a clear affirmative act signifying a consumer's freely given, specific, informed and unambiguous agreement to allow the processing of personal data relating to theconsumer.

"Consent" may include a written statement, including by electronic means, or any other unambiguous affirmative action.

"Consent" does not include (A) acceptance of general or broad terms of use or a similar document that contains descriptions of personal data processing along with other, Public Act No.

25-113 22 of 80 Substitute Senate Bill No.

1295 unrelated information, (B) hovering over, muting, pausing or closing a given piece of content, or (C) agreement obtained through the use of dark patterns.

(8) "Consumer" means an individual who is a resident of this state.

"Consumer" does not include an individual acting in a commercial or employment context or as an employee, owner, director, officer or contractor of a company, partnership, sole proprietorship, nonprofit organization or government agency whose communications or transactions with the controller occur solely within the context of that individual's role with the company, partnership, sole proprietorship, nonprofit organization or government agency.

(9) "Consumer health data" means any personal data that a controller uses to identify a consumer's physical or mental health condition, [or] diagnosis or status, and includes, but is not limited to, gender-affirming health data and reproductive or sexual health data.

(10) "Consumer health data controller" means any controller that, alone or jointly with others, determines the purpose and means of processing consumer health data.

(11) "Controller" means a person who, alone or jointly with others, determines the purpose and means of processing personal data.

(12) "COPPA" means the Children's Online Privacy Protection Act of 1998, 15 USC 6501 et seq., and the regulations, rules, guidance and exemptions adopted pursuant to said act, as said act and such regulations, rules, guidance and exemptions may be amended from time to time.

(13) "Covered entity" has the same meaning as provided in HIPAA.

(14) "Dark pattern" means a user interface designed or manipulated with the substantial effect of subverting or impairing user autonomy, Public Act No.

25-113 23 of 80 Substitute Senate Bill No.

1295 decision-making or choice, and includes, but is not limited to, any practice the Federal Trade Commission refers to as a "dark pattern".

(15) ["Decisions that produce legal or similarly significant effects concerning the consumer"] "Decision that produces any legal or similarly significant effect" means [decisions] any decision made by the controller, or on behalf of the controller, that [result] results in the provision or denial by the controller of any financial or lending [services,] service, any housing, any insurance, any education enrollment or opportunity, any criminal justice, any employment [opportunities,] opportunity or any health care [services or access to essential goods or services] service.

(16) "De-identified data" means data that cannot reasonably be used to infer information about, or otherwise be linked to, an identified or identifiable individual, or a device linked to such individual, if the controller that possesses such data (A) takes reasonable measures to ensure that such data cannot be associated with an individual, (B) publicly commits to process such data only in a de-identified fashion and not attempt to re-identify such data, and (C) contractually obligates any recipients of such data to satisfy the criteria set forth in subparagraphs (A) and (B) of this subdivision.

(17) "Gender-affirming health care services" has the same meaning as provided in section 52-571n.

(18) "Gender-affirming health data" means any personal data concerning an effort made by a consumer to seek, or a consumer's receipt of, gender-affirming health care services.

(19) "Geofence" means any technology that uses global positioning coordinates, cell tower connectivity, cellular data, radio frequency identification, wireless fidelity technology data or any other form of locationdetection,oranycombinationofsuchcoordinates,connectivity, Public Act No.

25-113 24 of 80 Substitute Senate Bill No.

1295 data, identification or other form of location detection, to establish a virtual boundary.

(20) "HIPAA" means the Health Insurance Portability and Accountability Act of 1996, 42 USC 1320d et seq., as amended from time to time.

(21) "Identified or identifiable individual" means an individual who can be readily identified, directly or indirectly.

(22) "Institution of higher education" means any individual who, or school, board, association, limited liability company or corporation that, is licensed or accredited to offer one or more programs of higher learning leading to one or more degrees.

(23) "Mental health facility" means any health care facility in which at least seventy per centofthehealthcare servicesprovidedinsuchfacility are mental health services.

(24) "Neural data" means any information that is generated by measuring the activity of an individual's central nervous system.

[(24)] (25) "Nonprofit organization" means any organization that is exempt from taxation under Section 501(c)(3), 501(c)(4), 501(c)(6) or 501(c)(12) of the Internal Revenue Code of 1986, or any subsequent corresponding internal revenue code of the United States, as amended from time to time.

[(25)] (26) "Person" means an individual, association, company, limited liability company, corporation, partnership, sole proprietorship, trust or other legal entity.

[(26)] (27) "Personal data" means any information that is linked or reasonably linkable to an identified or identifiable individual.

"Personal data" does not include de-identified data or publicly available Public Act No.

25-113 25 of 80 Substitute Senate Bill No.

1295 information.

[(27)] (28) "Precise geolocation data" means information derived from technology, including, but not limited to, global positioning system level latitude and longitude coordinates or other mechanisms, that directly identifies the specific location of an individual with precision and accuracy within a radius of one thousand seven hundred fifty feet.

"Precise geolocation data" does not include the content of communications or any data generated by or connected to advanced utility metering infrastructure systems or equipment for use by a utility.

[(28)] (29) "Process" and "processing" mean any operation or set of operations performed, whether by manual or automated means, on personal data or on sets of personal data, such as the collection, use, storage, disclosure, analysis, deletion or modification of personal data.

[(29)] (30) "Processor" means a person who processes personal data on behalf of a controller.

[(30)] (31) "Profiling" means any form of automated processing performed on personal data to evaluate, analyze or predict personal aspects related to an identified or identifiable individual's economic situation, health, personal preferences, interests, reliability, behavior, location or movements.

[(31)] (32) "Protected health information" has the same meaning as provided in HIPAA.

[(32)] (33) "Pseudonymous data" means personal data that cannot be attributed to a specific individual without the use of additional information, provided such additional information is kept separately and is subject to appropriate technical and organizational measures to ensure that the personal data [is] are not attributed to an identified or identifiable individual.

Public Act No.

25-113 26 of 80 Substitute Senate Bill No.

1295 [(33)] (34) "Publicly available information" (A) means information that [(A)] (i) is lawfully made available [through] from federal, state or municipal government records, or [widely distributed media, and (B)] (ii) a controller has a reasonable basis to believe (I) a consumer has lawfully made available to the general public, or (II) has been lawfully madeavailabletothegeneralpublicfromwidelydistributedmedia,and (B) does not include any biometric data that can be associated with a specific consumer and were collected without the consumer's consent.

[(34)] (35) "Reproductive or sexual health care" means any health care-related services or products rendered or provided concerning a consumer'sreproductivesystemorsexualwell-being,including,but not limited to, any suchservice or product renderedor providedconcerning (A) an individual health condition, status, disease, diagnosis, diagnostic test or treatment, (B) a social, psychological, behavioral or medical intervention, (C) a surgery or procedure, including, but not limited to, an abortion, (D) a use or purchase of a medication, including, but not limited to, a medication used or purchased for the purposes of an abortion, (E) a bodily function, vital sign or symptom, (F) a measurement of a bodily function, vital sign or symptom, or (G) an abortion, including, but not limited to, medical or nonmedical services, products, diagnostics, counseling or follow-up services for an abortion.

[(35)] (36) "Reproductive or sexual health data" means any personal data concerning an effort made by a consumer to seek, or a consumer's receipt of, reproductive or sexual health care.

[(36)] (37) "Reproductive or sexual health facility" means any health care facility in which at least seventy per cent of the health care-related services or products rendered or provided in such facility are reproductive or sexual health care.

[(37)](38)"Saleofpersonaldata"meanstheexchangeofpersonaldata for monetary or other valuable consideration by the controller to a third Public Act No.

25-113 27 of 80 Substitute Senate Bill No.

1295 party.

"Sale of personal data" does not include (A) the disclosure of personal data to a processor that processes the personal data on behalf of the controller, (B) the disclosure of personal data to a third party for purposes of providing a product or service requested by the consumer, (C) the disclosure or transfer of personal data to an affiliate of the controller, (D) the disclosure of personal data where the consumer directs the controller to disclose the personal data or intentionally uses thecontrollerto interact withathirdparty,(E)thedisclosure ofpersonal data that the consumer (i) intentionally made available to the general public via a channel of mass media, and (ii) did not restrict to a specific audience, or (F) the disclosure or transfer of personal data to a third party as an asset that is part of a merger, acquisition, bankruptcy or other transaction, or a proposed merger, acquisition, bankruptcy or other transaction, in which the third party assumes control of all or part of the controller's assets.

[(38)] (39) "Sensitive data" means personal data that includes (A) data revealing (i) racial or ethnic origin, (ii) religious beliefs, (iii) a mental or physical health condition, [or] diagnosis, disability or treatment, (iv) sex life, sexual orientation or status as nonbinary or transgender, or (v) citizenship or immigration status, (B) consumer health data, (C) [the processing of] genetic or biometric data [for the purpose of uniquely identifying an individual] or information derived therefrom, (D) personal data collected from [a known] an individual the controller has actual knowledge, or wilfully disregards, is a child, (E) data concerning an individual's status as a victim of crime, as defined in section 1-1k, [or] (F) precise geolocation data, (G) neural data, (H) a consumer's financial account number, financial account log-in information or credit card or debit card number that, in combination with any required access or security code, password or credential, would allow access to a consumer's financial account, or (I) government-issued identification number, including, but not limited to, Social Security number, passport number, state identification card number or driver's license number, Public Act No.

25-113 28 of 80 Substitute Senate Bill No.

1295 that applicable law does not require to be publicly displayed.

[(39)](40)"Targeted advertising"meansdisplaying advertisementsto a consumer where the advertisement is selected based on personal data obtainedorinferredfromthatconsumer'sactivitiesovertimeandacross nonaffiliated Internet web sites or online applications to predict such consumer's preferences or interests.

"Targeted advertising" does not include (A) advertisements based on activities within a controller's own Internet web sites or online applications, (B) advertisements based on thecontextofa consumer'scurrent searchquery,visit to anInternetweb site or online application, (C) advertisements directed to a consumer in response to the consumer's request for information or feedback, or (D) processing personal data solely to measure or report advertising frequency, performance or reach.

[(40)] (41) "Third party" means a person, such as a public authority, agency or body, other than the consumer, controller or processor or an affiliate of the processor or the controller.

[(41)] (42) "Trade secret" has the same meaning as provided in section 35-51.

Sec.

6.

Section 42-516 of the general statutes is repealed and the following is substituted in lieu thereof (Effective July 1, 2026):

The provisions of sections 42-515 to 42-525, inclusive, as amended by this act, apply to persons that:

[conduct] (1) Conduct business in this state, or [persons that] produce products or services that are targeted to residents of this state, and [that] during the preceding calendar year [:

(1) Controlled] controlled or processed the personal data of not [less] fewer than [one hundred thousand] thirty-five thousand consumers, excluding personal data controlled or processed solely for the purpose of completing a payment transaction;

[or (2) controlled or processed the personal data of not less than twenty-five thousand consumers and Public Act No.

25-113 29 of 80 Substitute Senate Bill No.

1295 derived more than twenty-five per cent of their gross revenue from the sale of personal data] (2) control or process consumers' sensitive data, excluding personal data controlled or processed solely for the purposes of completing a payment transaction;

or (3) offer consumers' personal data for sale in trade or commerce.

Sec.

7.

Subsections (a) and (b) of section 42-517 of the general statutes arerepealedandthefollowingissubstitutedinlieuthereof(EffectiveJuly 1, 2026):

(a) The provisions of sections 42-515 to 42-525, inclusive, as amended by this act, do not apply to any:

(1) Body, authority, board, bureau, commission, district or agency of this state or of any political subdivision of this state;

(2) person who has entered into a contract with any body, authority, board, bureau, commission, district or agency described in subdivision (1) of this subsection while such person is processing consumer health data on behalf of such body, authority, board,bureau,commission,district or agencypursuant to suchcontract;

(3)nonprofitorganization;(4)candidatecommittee,nationalcommittee, party committee or political committee, as such terms are defined in section 9-601;

(5) institution of higher education;

[(5)] (6) national securities association that is registered under 15 USC 78o-3 of the Securities Exchange Act of 1934, as amended from time to time;

[(6) financial institution or data subject to Title V of the Gramm-Leach-Bliley Act, 15 USC 6801 et seq.;] (7) covered entity or business associate, as defined in 45 CFR 160.103;

(8) tribal nation government organization;

[or] (9) air carrier, as defined in 49 USC 40102, as amended from time to time, and regulated under the Federal Aviation Act of 1958, 49 USC et seq., and the Airline Deregulation Act of 1978, 49 USC 41713, as said acts may be amended from time to time;

(10) insurer, as defined in section38a-1,oritsaffiliate,fraternalbenefitsociety,withinthemeaning of section 38a-595, health carrier, as defined in section 38a-591a, insurance-support organization, as defined in section 38a-976, or Public Act No.

25-113 30 of 80 Substitute Senate Bill No.

1295 insurance agent or insurance producer, as such terms are defined in section 38a-702a;

(11) bank, Connecticut credit union, federal credit union, out-of-state bank or out-of-state credit union, or any affiliate or subsidiary thereof, as such terms are defined in section 36a-2, that (A) is only and directly engaged in financial activities as described in 12 USC 1843(k), (B) is regulated and examined by the Department of Banking or an applicable federal bank regulatory agency, and (C) has established a program to comply with all applicable requirements established by the Banking Commissioner or the applicable federal bank regulatory agency concerning personal data;

or (12) agent, broker-dealer, investment adviser or investment adviser agent, as such terms are definedinsection36b-3, who isregulatedby theDepartment ofBanking or the Securities and Exchange Commission.

(b) The following information and data [is] are exempt from the provisions of sections 42-515 to 42-526, inclusive, as amended by this act:

(1) Protected health information under HIPAA;

(2) patient- identifying information for purposes of 42 USC 290dd-2;

(3) identifiable private information for purposes of the federal policy for the protection of human subjects under 45 CFR 46;

(4) identifiable private information that is otherwise information collected as part of human subjects research pursuant to the good clinical practice guidelines issued by the International Council for Harmonization of Technical Requirements for Pharmaceuticals for Human Use;

(5) personal data for purposes of the protection of human subjects under 21 CFR Parts 6, 50 and 56, or personal data used or shared in research, as defined in 45 CFR 164.501, that is conducted in accordance with the standards set forth in this subdivision and subdivisions (3) and (4) of this subsection, or other research conducted in accordance with applicable law;

(6) information and documents created for purposes of the Health Care Quality Improvement Act of 1986, 42 USC 11101 et seq.;

(7) patient safety work product for purposes of section 19a-127o and the Patient Safety and Quality Improvement Act, 42 USC 299b-21 et seq., as amended from Public Act No.

25-113 31 of 80 Substitute Senate Bill No.

1295 time to time;

(8) information derived from any of the health care-related information listed in this subsection that is de-identified in accordance with the requirements for de-identification pursuant to HIPAA;

(9) information originating from and intermingled to be indistinguishable with, or information treated in the same manner as, information exempt under this subsection that is maintained by a covered entity or business associate, program or qualified service organization, as specified in 42 USC 290dd-2, as amended from time to time;

(10) information used for public health activities and purposes as authorized by HIPAA, community health activities and population health activities;

(11) the collection, maintenance, disclosure, sale, communication or use of any personal information bearing on a consumer's credit worthiness, credit standing, credit capacity, character, general reputation, personal characteristics or mode of living by a consumer reporting agency, furnisher or userthatprovidesinformationfor use inaconsumerreport, and by a user of a consumer report, but only to the extent that such activity is regulated by and authorized under the Fair Credit Reporting Act, 15 USC 1681 et seq., as amended from time to time;

(12) personal data collected, processed, sold or disclosed in compliance with the Driver's Privacy Protection Act of 1994, 18 USC 2721 et seq., as amended from time to time;

(13) personal data regulated by the Family Educational Rights and Privacy Act, 20 USC 1232g et seq., as amended from time to time;

(14) personal data collected, processed, sold or disclosed in compliance with the Farm Credit Act, 12 USC 2001 et seq., as amended from time to time;

(15) data processed or maintained (A) in the course of an individual applying to, employed by or acting as an agent or independent contractor of a controller, processor, consumer health data controller or third party, to the extent that the data [is] are collected and used within the context of that role, (B) as the emergency contact information of an individual under sections 42-515 to 42-526, inclusive, as amended by this act, used for emergency contact purposes, or (C) that [is] are necessary to retain to administer benefits for another individual relating to the individual who is the subject of the Public Act No.

25-113 32 of 80 Substitute Senate Bill No.

1295 information under subdivision (1) of this subsection and used for the purposes of administering such benefits;

[and] (16) personal data collected, processed, sold or disclosed in relation to price, route or service, as such terms are used in the Federal Aviation Act of 1958, 49 USC 40101 et seq., and the Airline Deregulation Act of 1978, 49 USC 41713, as said acts may be amended from time to time;

(17) data subject to Title V of the Gramm-Leach-Bliley Act, 15 USC 6801 et seq., as amended from time to time;

and (18) information included in a limited data set, as described in 45 CFR 164.514(e), as amended from time to time, to the extent such information is used, disclosed and maintained in the manner specified in 45 CFR 164.514(e), as amended from time to time.

Sec.

8.

Section 42-518 of the general statutes is repealed and the following is substituted in lieu thereof (Effective July 1, 2026):

(a) A consumer shall have the right to:

(1) Confirm whether or not a controller is processing the consumer's personal data and access such personal data, including, but not limited to, any inferences about the consumer derived from such personal data and whether a controller or processor is processing a consumer's personal data for the purposes of profiling to make a decision that produces any legal or similarly significant effect concerning a consumer, unless such confirmation or access would require the controller to reveal a trade secret or the controller is prohibited from disclosing such personal data under subsection (e) of this section;

(2) correct inaccuracies in the consumer's personal data, taking into account the nature of the personal data and the purposes of the processing of the consumer's personal data;

(3) delete personal data provided by, or obtained about, the consumer;

(4) obtain a copy of the consumer's personal data processed by the controller, in a portable and, to the extent technically feasible, readily usable format that allows the consumer to transmit the data to another controller without hindrance, where the processing is carried out by Public Act No.

25-113 33 of 80 Substitute Senate Bill No.

1295 automated means, provided such controller shall not be required to revealanytradesecret;[and](5)optoutoftheprocessingofthepersonal data for purposes of (A) targeted advertising, (B) the sale of personal data, except as provided in subdivision (2) of subsection [(b)] (a) of section 42-520, as amended by this act, or (C) profiling in furtherance of [solely] any automated [decisions that produce] decision that produces any legal or similarly significant [effects] effect concerning the consumer;

(6) if the consumer's personal data were processed for the purposes of profiling in furtherance of any automated decision that produced any legal or similarly significant effect concerning the consumer, and if feasible, (A) question the result of such profiling, (B) be informed of the reason that such profiling resulted in such decision, (C) review the consumer's personal data that were processed for the purposes of such profiling, and (D) if the profiling decision concerned housing, taking into account the nature of the personal data and the purposes for which such personal data were processed, allow the consumer to correct any incorrect personal data that were processed for the purposes of such profiling and have the profiling decision reevaluated based on the corrected personal data;

and (7) obtain from the controller a list of the third parties to which such controller has sold the consumer's personal data or, if such controller does not maintain a list of the third parties to which such controller has sold the consumer's personal data, a list of all third parties to which such controller has sold personaldata,providedthecontrollershallnotberequiredtorevealany trade secret.

(b)A consumer may exercise rightsunder this sectionby a secure and reliable means established by the controller and described to the consumer in the controller's privacy notice.

A consumer may designate an authorized agent in accordance with section 42-519 to exercise the rights of such consumer to opt out of the processing of such consumer's personal data for purposes of subdivision (5) of subsection (a) of this section on behalf of the consumer.

In the case of processing personal Public Act No.

25-113 34 of 80 Substitute Senate Bill No.

1295 data of a [known] consumer who the controller has actual knowledge, or wilfully disregards, is a child, the parent or legal guardian may exercise such consumer rights on the child's behalf.

In the case of processing personal data concerning a consumer subject to a guardianship, conservatorship or other protective arrangement, the guardian or the conservator of the consumer may exercise such rights on the consumer's behalf.

(c) Except as otherwise provided in sections 42-515 to 42-525, inclusive, as amended by this act, a controller shall comply with a request by a consumer to exercise the consumer rights authorized pursuant to said sections as follows:

(1) A controller shall respond to the consumer without undue delay, but not later than forty-five days after receipt of the request.

The controller may extend the response period by forty-five additional days when reasonably necessary, considering the complexity and number of the consumer's requests, provided the controller informs the consumer of any such extension within the initial forty-five-day response period and of the reason for the extension.

(2) If a controller declines to take action regarding the consumer's request, the controller shall inform the consumer without undue delay, but not later than forty-five days after receipt of the request, of the justification for declining to take action and instructions for how to appeal the decision.

(3) Information provided in response to a consumer request shall be provided by a controller, free of charge, once per consumer during any twelve-month period.

If requests from a consumer are manifestly unfounded, excessive or repetitive, the controller may charge the consumer a reasonable fee to cover the administrative costs of complying with the request or decline to act on the request.

The controller bearstheburdenofdemonstrating themanifestly unfounded, Public Act No.

25-113 35 of 80 Substitute Senate Bill No.

1295 excessive or repetitive nature of the request.

(4) If a controller is unable to authenticate a request to exercise any of the rights afforded under subdivisions (1) to (4), inclusive, of subsection (a) of this section or subdivision (6) of said subsection using commercially reasonable efforts, the controller shall not be required to comply with a request to initiate an action pursuant to this section and shall provide notice to the consumer that the controller is unable to authenticate the request to exercise such right or rights until such consumer provides additional information reasonably necessary to authenticate such consumer and such consumer's request to exercise such right or rights.

A controller shall not be required to authenticate an opt-out request, but a controller may deny an opt-out request if the controller has a good faith, reasonable and documented belief that such request is fraudulent.

If a controller denies an opt-out request because the controller believes such request is fraudulent, the controller shall send a notice to the person who made such request disclosing that such controller believes such request is fraudulent, why such controller believes such request is fraudulent and that such controller shall not comply with such request.

(5) A controller that has obtained personal data about a consumer from a source other than the consumer shall be deemed in compliance with a consumer's request to delete such data pursuant to subdivision (3) of subsection (a) of this section by (A) retaining a record of the deletion request and the minimum data necessary for the purpose of ensuring the consumer's personal data remains deleted from the controller's records and not using such retained data for any other purpose pursuant to the provisions of sections 42-515 to 42-525, inclusive, as amended by this act, or (B) opting the consumer out of the processing of such personal data for any purpose except for those exempted pursuant to the provisions of sections 42-515 to 42-525, inclusive, as amended by this act.

Public Act No.

25-113 36 of 80 Substitute Senate Bill No.

1295 (d) A controller shall establish a process for a consumer to appeal the controller'srefusaltotake actiononarequestwithinareasonableperiod of time after the consumer's receipt of the decision.

The appeal process shall be conspicuously available and similar to the process for submitting requests to initiate action pursuant to this section.

Not later than sixty days after receipt of an appeal, a controller shall inform the consumer in writing of any action taken or not taken in response to the appeal, including a written explanation of the reasons for the decisions.

If the appeal is denied, the controller shall also provide the consumer with an online mechanism, if available, or other method through which the consumer may contact the Attorney General to submit a complaint.

(e) A controller shall not disclose the following personal data in response to a request to exercise the consumer's rights under subdivision (1) of subsection (a) of this section, and shall instead inform the consumer or the person exercising such right on behalf of the consumer, with sufficient particularity, that the controller has collected such personal data:

(1) The consumer's Social Security number;

(2) the consumer's driver's license number, state identification card number or other government-issued identification number;

(3) the consumer's financial account number;

(4) the consumer's health insurance identification number or medical identification number;

(5) the consumer's account password;

(6) the consumer's security question or answer thereto;

or (7) the consumer's biometric data.

Sec.

9.

Section 42-520 of the general statutes is repealed and the following is substituted in lieu thereof (Effective July 1, 2026):

(a) (1) A controller shall:

[(1)] (A) Limit the collection of personal data to what is [adequate, relevant and] reasonably necessary and proportionate in relation to the purposes for which such data [is] are processed, as disclosed to the consumer;

[(2) except as otherwise provided in sections 42-515 to 42-525, inclusive] (B) unless the controller obtains the consumer's consent, not process the consumer's personal Public Act No.

25-113 37 of 80 Substitute Senate Bill No.

1295 data for [purposes] any material new purpose that [are] is neither reasonably necessary to, nor compatible with, the [disclosed] purposes [for which suchpersonaldataisprocessed, as] that were disclosedto the consumer, [unless the controller obtains the consumer's consent;

(3)] pursuant to subparagraph (A) of this subdivision, taking into account (i) the consumer's reasonable expectation regarding such personal data at the time such personal data were collected based on the purposes that were disclosed to the consumer pursuant to subparagraph (A) of this subdivision, (ii) the relationship that such new purpose bears to the purposes that were disclosed to the consumer pursuant to subparagraph (A) of this subdivision, (iii) the impact that processing such personal data for such new purpose might have on the consumer, (iv) the relationship between the consumer and the controller and the context in which the personal data were collected, and (v) the existence of additional safeguards, including, but not limited to, encryption or pseudonymization, in processing such personal data for such new purpose;

(C) establish, implement and maintain reasonable administrative, technical and physical data security practices to protect the confidentiality, integrity and accessibility of personal data appropriate to the volume and nature of the personal data at issue;

[(4)] (D) not process sensitive data concerning a consumer unless such processing is reasonably necessary in relation to the purposes for which such sensitive data are processed and without obtaining the consumer's consent, or, in the case of the processing of sensitive data concerning a [known] consumer who the controller has actual knowledge, or wilfully disregards, is a child, without processing such data in accordance with COPPA;

[(5)] (E) not process personal data in violation of [the laws] any law of this state [and federal laws that prohibit] that prohibits unlawful discrimination against consumers, and any evidence, or lack of evidence, concerning proactive anti-bias testing or any similar proactive effort to avoid processing such data in violation of such law, including, but not limited to, any evidence or lack of evidence concerning the quality, efficacy, recency and scope of any such testing or effort, the Public Act No.

25-113 38 of 80 Substitute Senate Bill No.

1295 results of such testing or effort and the response to the results of such testing or effort, shall be relevant to any claim available for a violation of such law and any defense available thereto;

(F) not process personal data in violation of any federal law that prohibits unlawful discrimination against consumers;

[(6)] (G) provide an effective mechanism for a consumer to revoke the consumer's consent under this section that is at least as easy as the mechanism by which the consumer provided the consumer's consent and, upon revocation of such consent, cease to process the data as soon as practicable, but not later than fifteen days after the receipt of such request;

(H) not sell the sensitive data of a consumer without the consumer's consent;

and [(7)] (I) not process the personal data of a consumer for purposes of targeted advertising, or sell the consumer's personal data, [without the consumer's consent,] under circumstances where a controller has actual knowledge, or wilfully disregards, that the consumer is at least thirteen years of age but younger than [sixteen] eighteen years of age.

A controller shall not discriminate against a consumer for exercising any of the consumer rights contained in sections 42-515 to 42-525, inclusive, as amended by this act, including denying goods or services, charging different prices or rates for goods or services or providing a different level of quality of goods or services to the consumer.

[(b)] (2) Nothing in subdivision (1) of this subsection [(a) of this section] shall be construed to require a controller to provide a product or service that requires the personal data of a consumer which the controller does not collect or maintain, or prohibit a controller from offering a different price, rate, level, quality or selection of goods or services to a consumer, including offering goods or services for no fee, iftheoffering isinconnectionwithaconsumer'svoluntary participation inabonafideloyalty,rewards,premiumfeatures,discountsorclubcard program.

[(c)] (b) (1) A controller shall provide consumers with a reasonably Public Act No.

25-113 39 of 80 Substitute Senate Bill No.

1295 accessible, clear and meaningful privacy notice that includes:

[(1)] (A) The categories of personal data processed by the controller;

[(2)] (B) the purpose for processing personal data;

[(3) how consumers may exercise their consumer rights, including how a consumer may appeal a controller's decision] (C) a description of the means, established pursuant to subsection (c) of this section, for consumers to submit requests to exercise their consumer rights pursuant to sections 42-515 to 42-525, inclusive, as amended by this act, including, but not limited to, a description of (i) how consumers may exercise their consumer rights under subsection (a) of section 42-518, as amended by this act, and (ii) how consumers may appeal controllers' decisions with regard to [the consumer's request;

(4)] requests to exercise such rights;

(D) the categories of personal data that the controller [shares with] sells to third parties, if any;

[(5)] (E) the categories of third parties, if any, [with] to which the controller [shares] sells personal data;

[and (6)] (F) a clear and conspicuous disclosure of (i) any processing of personal data for purposes of targeted advertising, or (ii) any sale of personal data to a third party for purposes of targeted advertising;

(G) an active electronic mail address or other online mechanism that [the consumer] consumers may use to contact the controller;(H)astatement disclosing whether the controller collects, uses or sells personal data for the purpose of training large language models;

and (I) the most recent month and year during which the controller updated such privacy notice.

(2) A controller shall make the privacy notice required under subdivision (1) of this subsection publicly available:

(A) Through a conspicuous hyperlink that includes the word "privacy" (i) on the home page of the controller's Internet web site, if the controller maintains an Internet web site, (ii) on the application store page or download page of a mobile device, if the controller maintains an application for use on a mobile device, and (iii) on the application's settings menu or in a similarly conspicuous andaccessiblelocation, ifthecontroller maintains anapplicationfor use onamobiledevice or other device usedto connect Public Act No.

25-113 40 of 80 Substitute Senate Bill No.

1295 to the Internet;

(B) through a medium in which the controller regularly interacts with consumers, including, but not limited to, mail, if the controller does not maintain an Internet web site;

(C) in each language in which the controller (i) provides any product or service that is subject to the privacy notice, or (ii) carries out any activity that is related to any product or service described in subparagraph (C)(i) of this subdivision;

and (D) in a manner that is reasonably accessible to, and usable by, individuals with disabilities.

(3) Whenever a controller makes any retroactive material change to the controller's privacy notice or practices, the controller shall:

(A) Notify the consumers affected by such material change with respect to any personal data to be collected after the effective date of such material change;

and (B) provide a reasonable opportunity for the consumers described in subparagraph (A) of this subdivision to withdraw consent to any further and materially different collection, processing or transfer of previously collected personal data following such material change.

The controller shall take all reasonable electronic measures to provide such notice to such affected consumers, taking into account the technology available to the controller and the nature of the controller's relationship with such affected consumers.

(4) Nothing in this subsection shall be construed to require a controller to provide a privacy notice that is specific to this state if the controller provides a generally applicable privacy notice that satisfies the requirements established in this subsection.

[(d) If a controller sells personal data to third parties or processes personal data for targeted advertising, the controller shall clearly and conspicuously disclose such processing, as well as the manner in which a consumer may exercise the right to opt out of such processing.] [(e)] (c) (1) A controller shall establish [, and shall describe in a privacy notice,] one or more secure and reliable means for consumers to Public Act No.

25-113 41 of 80 Substitute Senate Bill No.

1295 submit a request to exercise their consumer rights pursuant to sections 42-515 to 42-525, inclusive, as amended by this act.

Such means shall take into account the ways in which consumers normally interact with the controller, the need for secure and reliable communication of such requests and the ability of the controller to verify the identity of the consumer making the request.

A controller shall not require a consumer to create a new account in order to exercise consumer rights, but may require a consumer to use an existing account.

Any such means shall include:

(A) (i) Providing a clear and conspicuous [link] hyperlink on the controller's Internet web site to an Internet web page that enables [a] the consumer, or an agent of the consumer, to opt out of the processing of the consumer's personal data for purposes of targeted advertising, or any sale of the consumer's personal data;

and (ii) [Not later than January 1, 2025, allowing] Allowing a consumer to opt out of any processing of the consumer's personal data for the purposes of targeted advertising, or any sale of such personal data, through an opt-out preference signal sent, with such consumer's consent, by a platform, technology or mechanism to the controller indicating such consumer's intent to opt out of any such processing or sale.

Such platform, technology or mechanism shall:

(I) Not unfairly disadvantage another controller;

(II) Not make use of a default setting, but, rather, require the consumer to make an affirmative, freely given and unambiguous choice to opt out of any processing of such consumer's personal data pursuant to sections 42-515 to 42-525, inclusive, as amended by this act;

(III) Be consumer-friendly and easy to use by the average consumer;

(IV) Be as consistent as possible with any other similar platform, technology or mechanism required by any federal or state law or Public Act No.

25-113 42 of 80 Substitute Senate Bill No.

1295 regulation;

and (V) Enable the controller to accurately determine whether the consumer is a resident of this state and whether the consumer has made a legitimate request to opt out of any sale of such consumer's personal data or targeted advertising.

(B) If a consumer's decision to opt out of any processing of the consumer's personal data for the purposes of targeted advertising, or any sale ofsuchpersonaldata,throughanopt-out preference signalsent in accordance with the provisions of subparagraph (A) of this subdivision conflicts with the consumer's existing controller-specific privacy setting or voluntary participation in a controller's bona fide loyalty,rewards, premiumfeatures,discounts or club cardprogram,the controller shall comply with such consumer's opt-out preference signal but may notify such consumer of such conflict and provide to such consumer the choice to confirm such controller-specific privacy setting or participation in such program.

(2) If a controller responds to consumer opt‐out requests received pursuant to subparagraph (A) of subdivision (1) of this subsection by informingtheconsumerofachargefortheuseofanyproductorservice, the controller shall present the terms of any financial incentive offered pursuant to subdivision (2) of subsection [(b)] (a) of this section for the retention, use, sale or sharing of the consumer's personal data.

Sec.

10.

Section 42-521 of the general statutes is repealed and the following is substituted in lieu thereof (Effective July 1, 2026):

(a) A processor shall adhere to the instructions of a controller and shall assist the controller in meeting the controller's obligations under sections 42-515 to 42-525, inclusive, as amended by this act.

Such assistance shall include:

(1) Taking into account the nature of processing and[theinformationavailableto theprocessor,by appropriate technical Public Act No.

25-113 43 of 80 Substitute Senate Bill No.

1295 and organizational measures,] insofar as is [reasonably practicable] possible, to fulfill the controller's obligation to respond to [consumer rights requests] consumers' requests to exercise their rights under section 42-518, as amended by this act;

(2) taking into account the nature of processing and the information available to the processor, by assisting the controller in meeting the controller's obligations in relation to the security of processing the personal data and in relation to the notification of a breach of security, as defined in section 36a-701b, of the systemoftheprocessor,inordertomeetthecontroller'sobligations;and (3) providing necessary information to enable the controller to conduct and document data protection assessments and impact assessments.

(b) A contract between a controller and a processor shall govern the processor's data processing procedures with respect to processing performed on behalf of the controller.

The contract shall be binding and clearly set forth instructions for processing data, the nature and purpose of processing, the type of data subject to processing, the duration of processing and the rights and obligations of both parties.

The contract shall also require that the processor:

(1) Ensure that each person processing personal data is subject to a duty of confidentiality with respect to the data;

(2) at the controller's direction, delete or return all personal data to the controller as requested at the end of the provision of services, unless retention of the personal data is required by law;

(3) upon the reasonable request of the controller, make available to the controller all information in its possession necessary to demonstrate the processor's compliance with the obligations in sections 42-515 to 42-525, inclusive, as amended by this act;

(4) after providing the controller an opportunity to object, engage any subcontractor pursuant to a written contract that requires the subcontractor to meet the obligations of the processor withrespect to thepersonaldata;and(5)allow, andcooperate with, reasonable assessments by the controller or the controller's designated assessor, or the processor may arrange for a qualified and independent assessor to conduct an assessment of the processor's Public Act No.

25-113 44 of 80 Substitute Senate Bill No.

1295 policies and technical and organizational measures in support of the obligations under sections 42-515 to 42-525, inclusive, as amended by this act, using an appropriate and accepted control standard or framework and assessment procedure for such assessments.

The processor shall provide a report of such assessment to the controller upon request.

(c) Nothing in this section shall be construed to relieve a controller or processor from the liabilities imposed on the controller or processor by virtue of such controller's or processor's role in the processing relationship, as described in sections 42-515 to 42-525, inclusive, as amended by this act.

(d) Determining whether a person is acting as a controller or processor with respect to a specific processing of data is a fact-based determinationthat dependsuponthecontext inwhichpersonaldata [is] are to be processed.

A person who is not limited in such person's processing of personal data pursuant to a controller's instructions, or who fails to adhere to such instructions, is a controller and not a processor with respect to a specific processing of data.

A processor that continues to adhere to a controller's instructions with respect to a specific processing of personal data remains a processor.

If a processor begins, alone or jointly with others, determining the purposes and means of the processing of personal data, the processor is a controller with respect to such processing and may be subject to an enforcement action under section 42-525.

Sec.

11.

Section 42-522 of the general statutes is repealed and the following is substituted in lieu thereof (Effective July 1, 2026):

(a) For the purposes of this section, processing that presents a heightened risk of harm to a consumer includes:

(1) The processing of personal data for the purposes of targeted advertising;

(2) the sale of personal data;

(3) the processing of personal data for the purposes of Public Act No.

25-113 45 of 80 Substitute Senate Bill No.

1295 profiling, where such profiling presents a reasonably foreseeable risk of (A) unfair or deceptive treatment of, or unlawful disparate impact on, consumers, (B) financial, physical or reputational injury to consumers, (C) a physical or other intrusion upon the solitude or seclusion, or the private affairs or concerns, of consumers, where such intrusion would be offensive to a reasonable person, or (D) other substantial injury to consumers;

and (4) the processing of sensitive data.

[(a)] (b) (1)A controllershall conduct and document a dataprotection assessment for each of the controller's processing activities that presents a heightened risk of harm to a consumer.

[For the purposes of this section, processing that presents a heightened risk of harm to a consumer includes:

(1) The processing of personal data for the purposes of targeted advertising;

(2) the sale of personal data;

(3) the processing of personal data for the purposes of profiling, where such profiling presents a reasonably foreseeable risk of (A) unfair or deceptive treatment of, or unlawful disparate impact on, consumers, (B) financial, physical or reputational injury to consumers, (C) a physical or other intrusion upon the solitude or seclusion, or the private affairs or concerns, of consumers, where such intrusion would be offensive to a reasonable person, or (D) other substantial injury to consumers;

and (4) the processing of sensitive data.] [(b) Data protection assessments] (2) Each data protection assessment conducted pursuant to subdivision (1) of this subsection [(a) of this section]shall identify andweighthebenefits that may flow,directly and indirectly, from the processing to the controller, the consumer, other stakeholders and the public against the potential risks to the rights of the consumer associated with such processing, as mitigated by safeguards that can be employed by the controller to reduce such risks.

The controller shall factor into [any] each such data protection assessment theuse ofde-identifieddataandthereasonableexpectations of consumers, as well as the context of the processing and the Public Act No.

25-113 46 of 80 Substitute Senate Bill No.

1295 relationship between the controller and the consumer whose personal data will be processed.

(c) Each controller that engages in any profiling for the purposes of making a decision that produces any legal or similarly significant effect concerning a consumer shall conduct an impact assessment for such profiling.

Suchimpact assessment shallinclude,to theextent reasonably known by or available to the controller, as applicable:

(1) A statement by the controller disclosing the purpose, intended use cases and deployment context of, and benefits afforded by, such profiling;

(2) an analysis of whether such profiling poses any known or reasonably foreseeable heightened risk of harm to a consumer, and, if so, (A) the nature of such heightened risk of harm to a consumer, and (B) the steps that have been taken to mitigate such heightened risk of harm to a consumer;

(3) a description of (A) the main categories of personal data processed as inputs for the purposes of such profiling, and (B) the outputs such profiling produces;

(4) an overview of the main categories of personal data the controller used to customize such profiling, if the controller used data to customize such profiling;

(5) any metrics used to evaluate the performance and known limitations of such profiling;

(6) a description of any transparency measures taken concerning such profiling, including, but not limited to, any measures taken to disclose to consumers that such controller is engaged in such profiling while such controller is engaged in such profiling;

and (7) a description of the post-deployment monitoring and user safeguards provided concerning such profiling, including, but not limited to, the oversight, use and learning processes established by the controller to address issues arising from such profiling.

[(c)] (d) The Attorney General may require that a controller disclose any data protection assessment or impact assessment that is relevant to an investigation conducted by the Attorney General, and the controller shall make the data protection assessment or impact assessment Public Act No.

25-113 47 of 80 Substitute Senate Bill No.

1295 available to the Attorney General.