Does Connecticut's Privacy Law Require Businesses to Honor Universal Opt-Out Signals?

Yes. Under Connecticut's Data Privacy Act (CTDPA), controllers have been required to recognize universal opt-out mechanisms — such as Global Privacy Control — as valid consumer requests since January 1, 2025, according to the Connecticut Attorney General's own guidance on the law.

What the Signal Covers

A universal opt-out preference signal under the CTDPA functions as a standing instruction: when a consumer's browser or device sends the signal, the business must treat it as a request to opt out of both targeted advertising and the sale of that consumer's personal data, without requiring the consumer to separately visit and opt out on every individual site. Compliance guidance built around the law treats a recognized signal, such as Global Privacy Control, exactly like a manually submitted opt-out request.

One Important Condition

The signal only counts if it reflects the consumer's own affirmative choice — a browser extension or setting the consumer actively selected — rather than a vendor-set default that ships turned on for every user regardless of their preference. A business doesn't need to honor a signal that didn't originate from a deliberate consumer action, though in practice this distinction is difficult for most sites to verify and many simply honor any detected signal as a matter of caution.

The Cure Period Is Already Gone, and Penalties Are Real

Connecticut's CTDPA originally included a 60-day cure period letting businesses fix a violation before facing enforcement, but that cure period expired December 31, 2024. Since then, the Attorney General has had full discretion over whether to offer a business the chance to cure a violation before pursuing enforcement — it's no longer a guaranteed right, which raises the stakes of getting universal opt-out handling wrong now versus when the law first took effect. A CTDPA violation is treated as an unfair trade practice under Connecticut's existing consumer protection statute, and the Attorney General's own final enforcement report sets the civil penalty at up to $5,000 per willful violation — with no statutory definition of what counts as a single "violation," leaving room for the AG to count violations per consumer, per day, or per campaign depending on the facts.

Where This Fits Among Other States

Connecticut was an early adopter of the universal-signal requirement, and several states have since followed with their own versions on different timelines — Colorado's requirement predates Connecticut's, while Oregon's version only started January 1, 2026. Utah, by contrast, has no equivalent mandate at all. Advertisers managing campaigns across multiple states should treat "honor the strictest state's rule everywhere" as the practical default rather than building state-by-state signal logic.

Bottom Line

If your site or ad stack doesn't currently detect and act on Global Privacy Control for Connecticut traffic, that's been a compliance gap for well over a year with no cure period left to fall back on — fix it before, not after, an AG inquiry.

Sources: Connecticut Attorney General, "The Connecticut Data Privacy Act" official guidance page and CTDPA final enforcement report (portal.ct.gov); InfoLawGroup, "Take Five! Connecticut Enacts Fifth Comprehensive State Privacy Law" (infolawgroup.com); Kelley Drye, "State AGs and Consumer Protection: What We Learned from... Connecticut" series (kelleydrye.com).