Connecticut's CTDPA Just Got a Lot Bigger — And Fintechs May Not Know They're Covered

TL;DR

• Connecticut’s CTDPA expanded on July 1, 2026: applicability threshold dropped to 35,000 residents, with additional triggers for sensitive data processing and data sales regardless of volume
• The entity-level GLBA exemption is gone for most fintechs and nonbank lenders — replaced by a data-level exemption that leaves significant data exposure
• A profiling impact assessment requirement kicks in August 1 for new automated systems affecting credit decisions, fraud flags, or personalized pricing
• Connecticut eliminated the 60-day cure period — the AG can proceed directly to enforcement action without first giving you a window to fix the problem

If you run compliance for a fintech or nonbank lender and haven’t reviewed Connecticut’s data privacy law since 2023, you’re operating blind. The Connecticut Data Privacy Act — CTDPA — is no longer the law you knew.

On July 1, 2026, sweeping amendments took effect that changed who the law applies to, what exemptions remain, and how fast the Attorney General can move when something goes wrong. If your legal team is still treating this like a 2022 law with a comfortable GLBA carveout, you have a compliance gap — and Connecticut has a no-warning enforcement window to find it.

Here’s what changed and what you need to address before August 1.

What Changed on July 1

Lower Thresholds — With New Volume-Free Triggers

The original CTDPA applied to controllers that processed personal data of at least 100,000 Connecticut residents per year. The July 1 amendments cut that threshold nearly in half. More significantly, they added two new triggers that have no volume minimum at all.

The CTDPA now applies if, during the prior calendar year, your organization:

1. Controlled or processed the personal data of at least 35,000 Connecticut consumers (down from 100,000), excluding data processed solely to complete a payment transaction; OR
2. Controlled or processed consumers’ sensitive data — regardless of volume, excluding payment-transaction-only data; OR
3. Offered consumers’ personal data for sale in trade or commerce — regardless of volume

Those second and third triggers are where the law picks up entities that previously weren’t paying attention. An organization that sells one Connecticut resident’s email address or profile data for marketing purposes — regardless of how small the operation — potentially triggers CTDPA applicability. A fintech that processes financial account data of even a handful of Connecticut residents is processing “sensitive data” (financial account information is now on the sensitive data list) with no volume minimum.

If your company buys, sells, or shares consumer data with third-party data brokers, marketing platforms, or analytics vendors, run the volume-free triggers before assuming you’re out of scope.

The GLBA Exemption Changed — And Fintechs Are the Losers

This is the change most financial services compliance teams missed, because it’s buried in language that sounds similar to prior law.

Under the original CTDPA: The GLBA entity-level exemption meant that if your institution was a “financial institution” subject to GLBA, the entire organization was generally exempt from the CTDPA. It didn’t matter what type of data you were processing — the exemption covered you as an entity.

Under the July 1 amendments: Connecticut replaced the entity-level GLBA exemption with a data-level exemption. The exemption now applies only to data that is regulated under GLBA — not to the organization as a whole.

This shift follows the erosion pattern tracked across multiple states. As we covered in how state privacy laws are narrowing GLBA’s safe harbor and the GLBA erosion in sensitive data treatment, California, Oregon, and Colorado had already moved in this direction. Connecticut just joined that group.

What that means practically for a bank: A bank collects data from customers for GLBA-covered financial products and services — that data gets data-level protection. But the same bank’s marketing analytics, website behavioral tracking from visitors who never became customers, or employee data from third-party HR platforms? Connecticut looks at that data separately. If it doesn’t fall within GLBA’s scope, the CTDPA applies to it.

Fintechs face a different problem. Many fintech companies are not “financial institutions” under GLBA in the first place — they’re technology vendors, data aggregators, payment facilitators, or service providers to GLBA-covered institutions. The entity-level exemptions Connecticut added to replace the GLBA blanket are narrow. They cover banks, credit unions, insurers, certain health carriers, and registered broker-dealers and investment advisers. That list doesn’t include:

• Nonbank mortgage servicers and originators
• Earned wage access (EWA) providers
• Buy now, pay later (BNPL) lenders
• Payments processors that are not chartered banks
• Third-party administrators for financial institutions
• Data aggregators and open banking platforms

For these entities, Connecticut’s CTDPA now applies to all personal data they handle outside GLBA’s specific coverage — and “outside GLBA” covers a lot of ground.

Compare this to Rhode Island, which we covered in RIDTPPA at six months. Rhode Island kept entity-level exemptions for clearly GLBA-covered institutions, making it more protective for traditional financial institutions. Connecticut’s approach is more aggressive and the fintech exposure is real.

Sensitive Data — Financial Account Information Is on the List Now

The amendments significantly expanded what qualifies as “sensitive data” under the CTDPA. Sensitive data requires opt-in consent before processing (with limited exceptions) and triggers applicability at any volume.

Sensitive data under the amended CTDPA now includes:

• Financial account information — this is new and important for financial services
• Social Security numbers and government-issued identifiers
• Consumer health data
• Precise geolocation data
• Neural data
• Biometric data used for unique identification
• Personal data of known children under 13
• Data revealing race, ethnicity, religious beliefs, sexual orientation, or citizenship/immigration status

The addition of financial account information to the sensitive data list has direct implications for fintechs, data aggregators, and open banking platforms. If you process bank account numbers, routing numbers, credit card numbers, investment account data, or payment history data from Connecticut residents — even in a B2B context where you serve the bank rather than the consumer directly — you are processing sensitive data. The volume threshold doesn’t apply. One Connecticut resident’s account data flowing through your platform puts you in scope.

Data mapping is not optional here. You need to know where Connecticut resident financial data lives in your systems, who it flows to, and whether you’re processing it outside the scope of a clear GLBA relationship.

The Profiling Impact Assessment: Two Weeks to Get Ready

Connecticut’s amendments introduced a formal impact assessment obligation for profiling. If profiling produces a “legal or similarly significant effect” on a consumer, an assessment is required before the activity goes live.

The August 1, 2026 trigger applies to profiling activities created or generated on or after that date. Activities built before August 1 are not permanently grandfathered — they’ll need assessments as systems are updated or materially modified.

What counts as a legal or similarly significant effect:

• Financing, credit, or billing decisions
• Fraud detection that suspends or restricts access to services
• Dynamic pricing or personalized offers based on consumer profiling
• Employment, housing, or insurance decisions made through automated profiling

For financial services firms — where automated underwriting, behavioral fraud scoring, and risk-based pricing are core operations — this requirement is directly on point. Any model or algorithm that processes Connecticut resident data to make one of these decisions, and that you’re building or modifying now, needs a completed impact assessment before it goes live.

The assessment must document:

1. The purpose of the profiling activity
2. A risk analysis
3. Categories of personal data used as inputs
4. Performance metrics for the profiling system
5. Transparency measures in place
6. Post-deployment monitoring plans

This overlaps substantially with SR 26-2 model validation documentation and with CFPB adverse action notice requirements for automated credit decisions — firms that already have strong model governance infrastructure have a head start. Those that don’t should treat the August 1 trigger as an accelerant.

The data privacy KRI program covers the metrics you’ll want tracking once these assessments are in place.

No More Cure Period

Under the original CTDPA, the Attorney General was required to provide a 60-day notice-and-cure period before pursuing enforcement action. That window gave businesses a chance to fix problems after being identified.

That window is eliminated.

The July 1 amendments removed the guaranteed cure period. The AG now has full discretion whether to offer businesses time to remediate before pursuing penalties. For violations involving sensitive data, willful conduct, or harm to minors, the AG is unlikely to be generous.

Civil penalties under the amended CTDPA:

• $2,500 per non-willful violation
• $5,000 per willful violation
• The statute doesn’t cap aggregate penalties — regulators with aggressive enforcement postures can run up the total fast when violations are counted per affected consumer

State AG enforcement activity in the fintech space has been accelerating, as covered in state AG and CFPB enforcement trends for fintechs. Connecticut’s AG has been active on consumer protection generally, and data privacy is a natural enforcement priority given the statutory changes. The elimination of the cure period removes the safety net.

If you have been relying on the cure period as the backstop between a compliance gap and meaningful exposure, that backstop no longer exists.

What to Do Now

Before August 1 (two weeks):

1. Re-run your applicability analysis. Pull your existing CTDPA coverage memo and stress-test it against the three new triggers. If you serve Connecticut residents and you process financial account data, or you sell any data, you may be newly in scope regardless of how you scored before.

2. Map your GLBA exemption at the data level. Identify specifically which data you process falls within GLBA-regulated products and services. Marketing prospect data, employee files, third-party HR vendor feeds, website analytics, and data from visitors who aren’t customers are common areas that fall outside GLBA’s scope.

3. Inventory profiling systems. Identify every automated system that makes financing, credit, fraud, or pricing decisions affecting Connecticut residents. Flag which systems are being built or modified now — those need impact assessments before they go live.

4. Start impact assessment drafts. For systems with August 1 exposure, begin the documentation process now. The six elements required (purpose, risk analysis, data categories, performance metrics, transparency measures, monitoring plans) take time to assemble.

Within 30 days:

5. Update vendor contracts. Data processing agreements with processors handling Connecticut resident sensitive data need to address CTDPA requirements. Review DPAs for CTDPA-specific provisions and update where missing.

6. Build the third-party data sale disclosure. Connecticut consumers now have the right to request a list of third parties to whom their data was sold. Your consumer rights infrastructure needs to support this specific request type.

7. Brief compliance leadership. The elimination of the cure period changes the risk calculus on Connecticut data privacy compliance. This isn’t an update that can sit in queue — it’s a risk profile change that the CCO and general counsel need to understand.

So What?

Connecticut just created a category of “newly in scope” entities who had been ignoring the CTDPA entirely: fintechs, nonbank lenders, EWA providers, BNPL operators, data aggregators. If your GLBA exemption analysis hasn’t been updated since before July 1, 2026, it’s wrong.

The law is already in effect. The August 1 profiling assessment trigger is two weeks away. The AG can now move immediately without giving you time to fix it.

Run the applicability triggers. Map the GLBA exemption at the data level. Get the impact assessments in motion. The time to find out you’re covered is before the AG does.

Building or updating your data privacy compliance program? The Data Privacy Compliance Kit ($69) includes data inventory templates, processing agreement language, consumer rights workflows, and privacy impact assessment frameworks — mapped to current state law requirements including the Connecticut CTDPA.

Sources:

• Connecticut Broadens Data Privacy Act Requirements Effective July 1, 2026 | Benesch Law
• Connecticut Dramatically Expands Its Data Privacy Act | Foley & Lardner
• Connecticut’s 2026 Privacy Law Amendments Expand Scope and Raise Compliance Expectations | OneTrust
• Amended Data Privacy Laws Impact Fintechs, Nonbank Mortgage Companies | Mitchell Sandler
• Major Changes to Connecticut Consumer Privacy Law | Wiley Law