AI, Data Privacy Bills Advance Despite Growing Concerns

As the 2026 legislative session continues to move at a rapid pace, several high profile bills affecting Connecticut employers have advanced through the committee process.

Concerns persist about cost, compliance burdens, and unintended consequences for businesses—particularly small employers—as measures regarding artificial intelligence and data privacy and security continue to gain traction. 

SB 4 significantly expands Connecticut’s consumer privacy framework, including new requirements related to data brokers, allows for consumers to request deletion of their data through a centralized state request database, creates algorithmic pricing disclosures, restricts the use of facial recognition, and prohibits certain data-sharing practices. 

In testimony before the General Law Committee, CBIA’s Chris Davis warned that SB 4’s overly broad definitions of “data broker” and “data service provider” could unintentionally sweep in businesses engaged in routine commercial activity, triggering costly registration, reporting, and liability requirements.

CBIA also raised concerns that the bill’s approach to algorithmic pricing could discourage responsible, efficiency-enhancing data tools used by businesses to manage inventory and stabilize consumer prices.

The bill, which the committee approved on a 16-4 vote, also restricts the use of facial recognition systems, raising safety, loss prevention, and security concerns across industries. Additionally, the sale, sharing, or transferring of geolocation data would be significantly restricted. 

Online Safety, AI

SB 5, which won unanimous committee approval, also addresses online safety and artificial intelligence, while creating workforce development and research initiatives related to emerging technologies.

The bill provides protections for whistleblowers at frontier AI developers, requires disclosures about synthetic content, expands requirements for AI related employment-based decision making, requires subscription-based AI providers to disclose key subscription terms, regulates the use of chatbots, and develops a regulatory sandbox program for emerging AI-related technologies.

CBIA testimony emphasized the importance of striking the right balance between ethical AI use and economic growth.

While supporting provisions related to workforce development and public-private collaboration, CBIA cautioned that other sections could impose duplicative and burdensome regulatory requirements, particularly on small businesses that lack the resources to navigate complex compliance regimes.

Data Breach Mandates

SB 117 proposes new data breach notification mandates and penalties related to electronic personal information.

The bill defines a “massive breach of security” as affecting 100,000-plus Connecticut residents and requires impacted companies to submit a timeline for completing a forensic report and allows the Connecticut Attorney General to request a copy of the report.

An impacted business could also face fines up to $250,000 for a compliance violation. 

Impacted businesses could face fines up to $250,000 for a compliance violation.

CBIA testified in opposition due to SB 117’s first-in-the-nation mandates and significant new penalties.

CBIA highlighted that even small businesses could be exposed to hundreds of thousands of dollars in compliance costs following a breach, without clear evidence that the bill would meaningfully improve consumer protection outcomes. 

SB 117 has advanced out of the General Law Committee and now awaits action by the Senate.

Cybersecurity Requirements 

SB 403 establishes new cybersecurity standards for covered entities, including critical infrastructure operators.

In testimony before the Public Safety and Security Committee, CBIA raised concerns that the bill’s definition of “covered entity” is so broad it could apply to nearly all employers.

CBIA also cautioned that requirements such as accelerated post-quantum cryptography timelines and identity assurance standards may not be feasible for businesses operating legacy or industrial control systems, creating compliance risks without improving security outcomes.

SB 403 did not advance out of committee, but proponents are pushing for sections of the bill to be included in SB 4 or SB 5 going forward.

Small Business AI Support

SB 417 lays the groundwork for a statesupported initiative to help small businesses adopt artificial intelligence technologies, currently structured as a planning and study effort.

CBIA has expressed support for the bill’s direction, noting its alignment with our policy agenda to help small businesses modernize and remain competitive.

By focusing on planning rather than immediate mandates, SB 417 allows for stakeholder input to ensure any future program reflects realworld business needs.

SB 417 advanced out of the Commerce Committee with bipartisan support and now awaits action by the Senate.

Workplace Systems

SB 435 addresses workforce and economic development policy affecting employers statewide by establishing various comprehensive requirements concerning the use of automated employment-related decision systems and AI technologies.

In testimony, CBIA highlighted the importance of ensuring that new programs or mandates do not duplicate and add to the compliance burdens of existing laws or create additional administrative burdens for employers already navigating a tight labor market.

This comprehensive proposal would not only be very expensive to implement and comply with, but would surely put Connecticut employers at a disadvantage nationally and impact in-state employer competitiveness. 

The Labor and Public Employees Committee approved the bill on a party-line 9-4 vote March 19.

Online Safety

HB 5037 restricts algorithms and notifications for minors without parental consent by establishing various default settings.

In addition, the bill requires that social media platforms annually report to the state the number of minors on their platform, the number of minors with parental consent to use addictive algorithms, and the average amount of time per day a minor spends on the platform, broken down by both age and time of day. 

Following recent court decisions enjoining similar restrictions passed in other states, concerns remain regarding the constitutionality of such measures. 

Well-intentioned policies must not unintentionally harm job creators, discourage innovation, or increase costs for employers and consumers.

HB 5037 advanced out of the General Law Committee and awaits action by the Senate. 

CBIA will continue to work with lawmakers to improve these proposals as they move forward.

Our focus remains on ensuring that well-intentioned policies do not unintentionally harm job creators, discourage innovation, or increase costs for Connecticut employers and consumers, especially small employers. 

Members are encouraged to stay engaged and share feedback as these bills continue through the legislative process. 

---

 For more information, contact CBIA’s Chris Davis (860.244.1931).