Connecticut SB 3 (Online Privacy & Minors)
Connecticut, United States- Introduced
- Passed Senate
- Passed House
- Became Law
Adds child-safety and health-data rules to Connecticut's privacy law, with a vague harm-to-minors duty and account-deletion mandates the Attorney General enforces.
Latest update
Minors and health-data provisions took effect
Current position
In force since Oct 2024
What it does
Connecticut SB 3, Public Act 23-56, bolts child-safety and consumer-health-data rules onto the state privacy act. An online service that knows, or ignores, that a user is under 18 has to use reasonable care against a heightened risk of harm to that minor, run a data protection assessment, and stop targeting ads at them or selling their data without consent. Platforms have to pull a minor's account offline within fifteen business days of a valid request and delete it within forty-five. The Attorney General enforces it, and there are no private lawsuits.
Why it matters
The law strengthens privacy protections for minors while also creating pressure for platforms to determine which users are under eighteen. A duty that switches on once a platform knows a user is a minor gives companies a reason to work out who is a minor, which is the on-ramp to age checks the law never openly demands. A standard as loose as heightened risk of harm hands the Attorney General wide room to decide which content and design count as harmful.
Our take
Data minimization for minors is worth having, and the vague harm duty stapled to it is the part civil-liberties people should watch. Connecticut wrote a knowledge trigger that rewards platforms for guessing their users' ages and a harm standard broad enough to reach speech, then handed both to the Attorney General.
Timeline
Minors and health-data provisions took effect
LatestSigned into law (Public Act 23-56)
Sponsors
Sen. James Maroney, Sen. Martin Looney, Rep. Matt Blumenthal
Votes
- Senate — Passed (36 to 0) · May 11, 2023
- House — Passed (142 to 0) · June 2, 2023