Connecticut bans the sale of precise geolocation data from October 1

Since October 1, 2026, controllers and third parties may not sell a Connecticut consumer’s precise geolocation data, meaning data that locates a person to within a radius of 1,750 feet. The prohibition comes from Public Act 26-64 (Senate Bill 4), which Connecticut enacted in May 2026 to amend the Connecticut Data Privacy Act (CTDPA). Until now, selling that data was a consent question, because precise geolocation is sensitive data under the CTDPA and processing sensitive data requires the consumer’s consent. The amended Act prohibits the sale itself, and the Attorney General’s guidance states that prohibition without a consent exception. For any business whose app, SDK or ad partner passes device location downstream, that is a change in kind, not in degree.

What Connecticut’s new law changed on October 1

Attorney General William Tong announced on September 16, 2026 that the amendments take effect on October 1. His office lists six headline changes in Public Act 26-64: limits and disclosure duties for surveillance pricing, signage and policy requirements for facial recognition technology, consent obligations and a property right for direct-to-consumer genetic testing, narrower treatment of publicly available information with expanded deletion rights for profiles built from it, a ban on the sale of precise geolocation data, and a data broker registry.

The Attorney General’s CTDPA guidance now states the geolocation rule directly: “Controllers and third parties are prohibited from selling a Consumer’s precise geolocation data.” The same guidance defines precise geolocation data as data that directly identifies an individual’s location “within a radius of one thousand seven hundred fifty (1,750) feet.”

Why consent no longer settles it

Most consent programmes treat location as a toggle: ask, record the answer, and let data flow if the answer is yes. Under the Attorney General’s reading, that model no longer covers a sale of precise location in Connecticut. Collection and other processing of precise geolocation still require consent, as sensitive data always has. The prohibition on selling it is stated in the guidance without any consent exception.

Scope matters here too. The CTDPA reaches anyone doing business in Connecticut, or targeting Connecticut residents, who has controlled or processed consumers’ sensitive data, excluding data processed solely to complete payment transactions. That is a separate trigger from the 35,000-consumer threshold. A small app that collects precise location is in scope on that ground alone.

Minors already had stricter rules. For controllers offering an online service, product or feature to minors under 18, the guidance says a controller “shall not collect a minor’s precise geolocation data unless such collection is strictly necessary,” and only with a signal shown to the minor for the entire duration of collection. It also says a controller “shall not process a minor’s data for purposes of (i) targeted advertising, or (ii) any sale.”

Data brokers have until January 1, 2027

The same Act creates a data broker registry. Data brokers must register with the Connecticut Department of Consumer Protection by January 1, 2027. Legal commentary on the Act describes a later phase that adds a centralized deletion mechanism for registered brokers, due by July 1, 2028. That mirrors California’s model, where the Delete Act’s DROP platform became mandatory for brokers in August 2026 and produced its first fines within days.

Enforcement of the CTDPA rests with the Attorney General alone. His guidance puts civil penalties at up to $5,000 per violation under the Connecticut Unfair Trade Practices Act.

What to do now

Map every place precise location leaves your systems: mobile SDKs, ad network and attribution libraries, location-based audience partners, and analytics tools that receive device coordinates rather than a coarse region. For each flow, decide with counsel whether it is a sale under the CTDPA; if it is, consent is no longer a basis to keep it running for Connecticut consumers. Check what your SDK partners do with location after it reaches them, since the prohibition binds third parties as well as controllers. Where you only need a region, reduce precision before coordinates leave the device so the data no longer locates anyone within 1,750 feet. If you buy or license data about people you have no direct relationship with, assess whether you are a data broker and plan for registration before January 1, 2027. On the web side, an inventory of the third-party scripts and pixels that actually run on your pages, which is what CookieGate’s crawler produces, shows where location-capable tags sit. For the US opt-out rules that sit alongside this, including CCPA/CPRA, see our regulations overview.

Sources

• Connecticut Office of the Attorney General, press release, September 16, 2026: Attorney General Tong Advises Connecticut Consumers and Businesses of Rights and Requirements Related to New and Updated Privacy Laws portal.ct.gov
• Connecticut Office of the Attorney General: The Connecticut Data Privacy Act portal.ct.gov
• Venable, July 2026: 2026 Mid-Year State Privacy Law Update venable.com
• Snell & Wilmer, July 7, 2026: Connecticut Data Privacy Act: 2026 Amendments swlaw.com