Connecticut's Privacy Report Reveals 1,830 Breaches and Rising

The Numbers Behind Three Years of Enforcement

On February 5, 2026, Connecticut Attorney General William Tong released the third annual enforcement report under the Connecticut Data Privacy Act. The numbers paint a clear picture of a state that is not treating its privacy law as symbolic. In 2025 alone, the office received more than 1,830 data breach notifications, issued 63 warning letters to companies that failed to protect personal information, and processed close to 70 formal CTDPA complaints from residents.

"Connecticut has one of the nation's first and strongest data privacy laws, and the Office of the Attorney General is active and aggressive in protecting our rights to privacy, security and safety online," Tong said in the press release accompanying the report.

Active Investigations Into Child Safety

For the first time, the report discloses multiple active and ongoing investigations related to the safety of children and teens online. The Attorney General's office is investigating companies across several categories:

• Social media platforms and messaging apps targeting minors
• Gaming platforms potentially misusing minors' data for targeted advertising
• AI chatbots that pose risks to minors through data collection or content
• Data brokers selling information about children
• Connected vehicles collecting geolocation data

The specifics of these investigations are confidential, but the disclosure itself signals that enforcement is moving beyond reactive breach responses toward proactive targeting of companies whose business models depend on collecting data from vulnerable populations.

What Changed in 2026

The CTDPA was amended in 2025 with several provisions taking effect in 2026. The changes lower applicability thresholds so that all sensitive data processing and all sales of personal data are now covered under the law, regardless of volume. The definition of sensitive data was expanded to include disability status and gender identity.

The most significant change is a categorical prohibition on processing personal data of minors under 18 for targeted advertising or sale. Unlike other states that allow this with parental consent, Connecticut's ban is absolute. Companies cannot target ads at minors using their personal data, period.

The amendments also introduced AI disclosure requirements. Companies that use personal data to train large language models must disclose this practice to consumers. This provision puts Connecticut at the forefront of states addressing the intersection of AI and privacy law.

The Complaint Gap

One detail in the report stands out. Of the roughly 70 CTDPA complaints received, about one third involved entities or data that are currently exempt from the law. Residents are filing complaints about privacy violations that the law does not yet cover, suggesting that public expectations for data protection are outpacing the regulatory framework.

The most common complaint theme was difficulty getting companies to delete personal data. Despite the CTDPA granting residents the right to request deletion, many reported that companies either ignored requests, made the process unnecessarily difficult, or claimed exemptions that may not apply.

A Model for Other States

Connecticut is one of 20 states with comprehensive privacy laws on the books as of 2026. But not all enforcement offices are equal. The AG's Privacy Section is staffed with five assistant attorneys general and support staff dedicated to privacy enforcement, a level of investment that many states have not yet matched.

The report matters because it provides a rare window into how privacy enforcement actually works at the state level. Most state privacy laws include annual or biennial reporting requirements, but Connecticut's reports have been among the most detailed, providing specific numbers on complaints, investigations, and enforcement actions that other states have been less transparent about.

For anyone who uses the internet in the United States, the patchwork of state laws means your protections depend on where you live. Connecticut residents now have some of the strongest. Everyone else is still waiting.