When Must Data Brokers Register Under Connecticut's New Data Broker Law?

Data brokers that sell or license Connecticut residents' personal data must register with the state's Department of Consumer Protection before January 1, 2027, when Connecticut's data broker registration requirement takes effect. A business that sells or licenses brokered personal data without registering by that date can't legally continue selling it in Connecticut.

What Counts as a "Data Broker" Here

Connecticut defines a data broker as any business, or part of a business, that sells or licenses brokered personal data to another party. Unlike California's broker law, Connecticut doesn't require that the broker have collected the data itself — a company that only licenses data it acquired from someone else still qualifies. That distinction matters for ad-tech vendors, audience-data resellers, co-op data providers, and identity-resolution companies that repackage third-party data rather than collecting it firsthand.

Registration Costs and What Gets Disclosed

Registering costs a $2,500 initial fee, with a $2,500 annual renewal. Registered brokers must disclose the categories of personal data they broker, where that data comes from, what opt-out mechanisms they offer, their breach history, and their practices around minors' data — disclosures that go well beyond what a comprehensive privacy law typically requires of an ordinary controller.

Penalties for Skipping Registration

Selling or licensing brokered personal data in Connecticut without registering can draw penalties of up to $200 per day, per consumer, for each violation. That per-day, per-consumer structure can scale into a large number quickly for any broker working with a sizable Connecticut-resident dataset, which makes this a meaningfully different risk calculation than a flat per-violation penalty.

Who in Marketing Actually Needs to Register

This isn't limited to companies that market themselves as data brokers. A marketing agency that licenses a client's compiled audience lists to a separate DSP, an identity-graph vendor that resells matched cookie or device IDs, or a co-op data company that pools and licenses purchase history across retailers can all meet Connecticut's broker definition — even if "data broker" isn't how they describe their own business.

It Sits on Top of the Comprehensive Privacy Law

This registration requirement is separate from Connecticut's existing comprehensive privacy law (the CTDPA) and specifically targets the data-broker layer of the ad-tech supply chain — companies that may never interact with a consumer directly but still monetize that consumer's data. The same update also bans the sale of consumers' precise geolocation data by controllers and third parties, and restricts "surveillance pricing" by retailers and delivery services.

What's Still Coming

The state must build a centralized consumer deletion tool by July 1, 2028, after which registered brokers will need to process deletion requests submitted through that tool rather than handling each request individually.

Bottom Line

If your agency or ad-tech stack licenses Connecticut consumer data to other parties — even data you didn't originally collect — confirm before January 1, 2027 whether you meet Connecticut's data-broker definition, and budget for the $2,500 registration fee if you do.

Sources: Hunton Andrews Kurth, "Connecticut Privacy Law Updates: Data Broker Rules, Geolocation Sale Ban, Surveillance Pricing Restrictions"; Wilson Sonsini Goodrich & Rosati, "Connecticut Updates Its Data Privacy Act"; Pandectes, "Data Broker Compliance in 2026: California, Connecticut, New Jersey and Beyond.