New AI, Data Privacy Compliance Laws Take Effect Oct. 1

Connecticut employers using artificial intelligence, facial recognition technology, consumer data, or automated pricing tools should be aware of significant new compliance requirements taking effect Oct. 1

The requirements were featured in two major laws enacted during the 2026 legislative session. 

Sections of Public Act 26-64 (SB 4) and Public Act 26-15 (the Connecticut Artificial Intelligence Responsibility and Transparency Act, or CART Act), take effect Oct. 1 and together represent one of the most expansive state privacy and AI regulatory frameworks in the country. 

The changes expand consumer privacy rights and create new obligations for businesses related to AI, data collection, facial recognition, genetic information, and employment decision-making.  

What Employers Need to Know 

Many Connecticut businesses have focused on AI as a tool for improving efficiency, customer service, hiring, and operations.

The CBIA Foundation’s recently released 2026 Survey of Connecticut Businesses found 42% of businesses are using artificial intelligence in their operations, while 54% of non-users are unclear how to adopt it. 

Employers utilizing AI should carefully evaluate whether their existing practices comply with the new requirements.

In preparation for the Oct. 1 effective date, employers utilizing AI should carefully evaluate whether their existing practices comply with Connecticut’s new requirements.

Several provisions apply directly to employers, while others may affect retail operations, customer data practices, marketing activities, and technology vendors. 

The state’s consumer privacy law receives significant updates through SB 4, including several provisions that may affect Connecticut businesses. 

Surveillance Pricing 

Businesses that use personal data to customize prices for consumers face new limitations and disclosure requirements.

The law regulates so-called “surveillance pricing,” where consumer data is used in automated pricing decisions, including new disclaimers for price increases.

Businesses should review pricing practices that rely on individualized consumer data.

While dynamic pricing based on factors such as loyalty programs, discounts, supply, demand, or operational costs remains permissible, businesses should review pricing practices that rely on individualized consumer data.  

In an unusual process, the surveillance pricing sections of the bill were modified in another bill, HB 5222, the day after passage of SB 4. 

“While the final bill avoids banning dynamic pricing models used to attract and retain customers, businesses using advanced analytics or AI‑driven pricing tools will need to review their systems carefully to ensure compliance and avoid triggering disclosure or enforcement risks,” warned CBIA’s Chris Davis.  

Facial Recognition, Geolocation Data 

Companies using facial recognition technology for security, loss prevention, or other purposes must comply with new transparency requirements.

Businesses will be required to post clear signage notifying consumers whenever facial recognition technology is being used and provide access to a publicly available facial recognition policy through a website link or QR code. 

The legislation prohibits the sale of consumers’ precise geolocation information starting, creating new restrictions on how location data may be shared, transferred, or monetized.

Consumers receive broader rights to delete certain personal information.

Businesses that collect location-based information through mobile applications, connected devices, or marketing platforms should review their data practices. 

Consumers receive broader rights to delete certain personal information, including some profiles generated from publicly available information.

The law also narrows what qualifies as publicly available data and expands privacy protections for Connecticut residents.  

Data Protections 

The law creates a new data broker registry administered by the Connecticut Department of Consumer Protection.

Businesses meeting the statutory definition of a data broker will be required to register by Jan. 1, 2027.  

Direct-to-consumer genetic testing companies face extensive new consent, disclosure, security, and consumer control requirements.

Consumers are granted property rights over their genetic samples and test results.

Consumers are granted property rights over their genetic samples and test results, along with exclusive control over how that information is collected, used, retained, disclosed, and destroyed.  

The CART Act establishes a broad framework governing the use of artificial intelligence in Connecticut.

Several provisions have immediate implications for employers and technology providers starting Oct. 1. 

AI in Employment Decisions, Chatbots

The most significant employer-related provision requires businesses to provide written notice when artificial intelligence is used to make decisions affecting the terms, conditions, or privileges of employment.

This could include AI-assisted hiring, promotion, compensation, discipline, scheduling, or other workplace decisions. 

The law also prohibits employers from using AI in a manner that results in unlawful discrimination.

Any discriminatory outcomes generated through AI-based decision-making may be treated as violations of Connecticut’s employment discrimination laws.

The most significant employer-related provision requires businesses to provide written notice when artificial intelligence is used.

Employers using recruiting software, applicant screening tools, predictive analytics, or other automated employment systems should review those technologies carefully.  

The CART Act establishes extensive rules for companies operating AI chatbots and companion technologies that interact with children.

The law requires safety protocols, parental controls, and restrictions on harmful or manipulative interactions.

Chatbots may not encourage self-harm, violence, substance abuse, or disordered eating, nor may they engage in romantic or sexual interactions with children.  

Preparing for Compliance 

While not every Connecticut business falls within the scope of the Connecticut Data Privacy Act, employers should assess whether they: 

• Use AI or automated decision-making tools in employment decisions
• Collect, process, or sell consumer data
• Utilize facial recognition technology
• Engage in personalized pricing practices
• Handle precise geolocation information. 
• Operate as, or work with, data brokers
• Develop or deploy consumer-facing AI applications 

For many businesses, particularly smaller employers without dedicated compliance staff, understanding how these requirements apply to existing technologies and business operations will be an important challenge in the months ahead. 

These new requirements represent another major step in Connecticut’s rapidly expanding regulatory framework governing artificial intelligence, privacy, and data practices.

Employers should work with legal counsel, technology providers, and compliance teams to evaluate current practices and identify any changes needed.

---

For more information, contact CBIA’s Chris Davis (860.244.1931).