If an automated tool helps make a job decision, its use is no defence against a discrimination complaint. Evidence of anti-bias testing can be taken into account.
Who must do it
Employers in Connecticut.
The law
Public Act 26-15, sections 13 and 14 (amending C.G.S. 46a-60(b)(1) and 46a-81c)
Who enforces it
Commission on Human Rights and Opportunities and the courts.
Tell people when an AI tool helps decide about their job
If an automated tool is a substantial factor in a job decision, give the person a written notice before the decision. Tell people in plain language when they are interacting with such a tool.
Who must do it
Businesses in Connecticut, such as employers, recruiters and staffing firms, that use automated tools in job decisions about Connecticut staff or applicants. Developers of tools sold for job decisions must give users the information they need.
The law
Public Act 26-15, sections 7 to 12
Who enforces it
Attorney General only, as an unfair trade practice. For violations up to December 31, 2027, the Attorney General may first give 60 days to fix them. No private lawsuits.
Post signs if you use face recognition on your premises
If you use face recognition on your premises against security threats, fraud or crime, match faces only against your own database. Post clearly legible signs at each public entrance saying it is in use, with a link or QR code to your face recognition policy, which must give the Attorney General’s contact details.
Who must do it
Businesses covered by the Connecticut Data Privacy Act: those serving people in Connecticut that handle the data of at least 35,000 consumers, process sensitive data, or sell personal data. It protects people as consumers, not as workers.
The law
Public Act 26-64, section 16 (C.G.S. 42-524)
Who enforces it
Attorney General only, as an unfair trade practice; no private lawsuits.
Let people challenge automated profiling decisions
Let people opt out of profiling used for automated decisions with legal or similarly significant effects. If you made such a decision, where feasible let them question the result, tell them the reason and let them review their data; for housing decisions, let them correct the data and get the decision re-evaluated. Do an impact assessment for such profiling.
Who must do it
Businesses covered by the Connecticut Data Privacy Act: those serving people in Connecticut that handle the data of at least 35,000 consumers, process sensitive data, or sell personal data. It protects people as consumers, not as workers.
The law
Connecticut Data Privacy Act, C.G.S. 42-518 and 42-522, as amended by Public Act 25-113 (impact assessments for processing from August 1, 2026)
Who enforces it
Attorney General only, as an unfair trade practice; no private lawsuits.
Label prices raised by algorithms using personal data
If an automated process uses a customer’s personal data to set a price shown online, and the price is not a discount, show the notice “THIS PRICE WAS INCREASED BY A PRICE SETTING DEVICE USING YOUR PERSONAL DATA”. Retailers and delivery apps may not set personal prices from tracking data at all, except for cost differences, supply and demand, and open discount or loyalty schemes.
Who must do it
Businesses selling to people in Connecticut, for the label; retailers and delivery apps, for the ban. Insurers, banks and other financial institutions are excluded.
The law
Public Act 26-64, section 11
Who enforces it
Attorney General only, as an unfair trade practice; no private lawsuits.
Get consent before calling people with an AI voice
Calls that use AI-generated or cloned voices count as artificial-voice calls under the federal robocall law, so they need the called person’s prior express consent, unless it is an emergency or an exemption applies. The message must also identify the caller.
It applies in Connecticut because Connecticut is part of the United States.
ConnecticutFrom January 1, 2027
AI companions must say they are not human and handle crises
An AI companion needs a published protocol that detects talk of suicide, self-harm or violence and refers users to help such as the 988 line, and it must not claim to be human. If it could be mistaken for a person, show a clear AI notice: always visible, or at the start of each day’s first chat and then hourly for minors and every three hours for adults.
Who must do it
Operators of AI companion chatbots used in Connecticut.
The law
Public Act 26-15, sections 4 to 6
Who enforces it
Attorney General only, as an unfair trade practice; no private lawsuits.
If you know or have reason to believe a user is under 18, use measures that meet industry standards to keep your AI companion safe for them. It must not encourage self-harm, suicide, violence, disordered eating or drug use, discourage seeking help, engage in romantic or sexual talk, or use manipulative engagement tactics. Give minors and parents tools to manage screen time and account settings.
Who must do it
Operators of AI companions used in Connecticut; customer-service, game, voice-assistant and narrow-task bots are excluded.
The law
Public Act 26-15, section 6
Who enforces it
Attorney General only, as an unfair trade practice; no private lawsuits.
Do not post or buy fake reviews, including AI-written ones
Do not write, create, sell or buy reviews or testimonials that falsely suggest the reviewer exists, used the product or had the experience described. The FTC says this covers AI-generated fake reviews.
Who must do it
Businesses selling to US consumers.
The law
FTC Rule on the Use of Consumer Reviews and Testimonials, 16 CFR part 465
Who enforces it
Federal Trade Commission; civil penalties of up to $53,088 per knowing violation.
It applies in Connecticut because Connecticut is part of the United States.
United States (all states)In force
Never post AI-made intimate images of real people
It is a federal crime to knowingly publish online an intimate image of an identifiable real person without their consent, including realistic fakes made with AI.
Who must do it
Anyone, people and businesses alike.
The law
TAKE IT DOWN Act (Public Law 119-12), section 2, 47 U.S.C. 223(h)
Who enforces it
Department of Justice; fines and up to two years in prison, or three years if the person shown is a minor.
It applies in Connecticut because Connecticut is part of the United States.
United States (all states)In force
Remove reported intimate deepfakes within 48 hours
Give people a clear, plain-language way to report intimate images of themselves posted without consent, including AI-made fakes. Remove a valid reported image within 48 hours, and make reasonable efforts to remove known identical copies.
Who must do it
Public websites, apps and online services that mainly host content from users, with no size threshold. Broadband providers and email are excluded.
The law
TAKE IT DOWN Act (Public Law 119-12), section 3
Who enforces it
Federal Trade Commission; civil penalties of up to $53,088 per violation. Removals made in good faith are protected.
It applies in Connecticut because Connecticut is part of the United States.
ConnecticutIn force
Add provenance data to AI images, audio and video
Where commercially and technically reasonable, embed provenance data in images, audio and video your AI creates or materially alters, and make it hard to remove, for example with the C2PA standard.
Who must do it
Makers of generative AI systems for images, audio or video that the public can use for personal purposes and that have more than one million users a month. Business-to-business tools, games, and pure upscaling or compression tools are excluded.
The law
Public Act 26-15, section 15
Who enforces it
Attorney General, as an unfair trade practice; no private lawsuits.
Remove intimate deepfakes in 48 hours, or face state fines
Set up a written process, explained in a plain-language notice on your platform, for victims or the Attorney General to report synthetic intimate images. Remove a valid report within 48 hours and make reasonable efforts to remove copies.
Who must do it
Public websites and apps that mainly host content shared by users, as defined in the federal TAKE IT DOWN Act.
The law
Public Act 26-55, section 2
Who enforces it
Attorney General, in court; civil penalties of up to $25,000 a day for each person harmed.
When you file a federal mass-layoff (WARN) notice, also tell the Connecticut Labor Department whether the layoffs are related to your use of AI or another technological change.
Who must do it
Employers that must file a federal WARN notice, usually those with 100 or more workers.
The law
Public Act 26-15, section 26
Who enforces it
Connecticut Labor Department, in the form the Labor Commissioner sets. The act sets no penalty.
Get parents’ separate consent to train AI on kids’ data
If your site, app or service is aimed at children under 13, or you know you collect their data, get a parent’s separate, verifiable consent before disclosing a child’s personal information to third parties. The FTC says disclosing it to train or develop AI needs this consent.
Who must do it
Operators of websites, apps and online services, including education technology, aimed at children under 13 or knowingly collecting their data.
The law
Children’s Online Privacy Protection Rule, 16 CFR 312.5(a)(2), as amended in 2025
Who enforces it
Federal Trade Commission and state attorneys general; civil penalties of up to $53,088 per violation.