Connecticut SB 3 (Online Privacy & Minors)
What it does
Connecticut SB 3, Public Act 23-56, bolts child-safety and consumer-health-data rules onto the state privacy act. An online service that knows, or ignores, that a user is under 18 has to use reasonable care against a heightened risk of harm to that minor, run a data protection assessment, and stop targeting ads at them or selling their data without consent. Platforms have to pull a minor's account offline within fifteen business days of a valid request and delete it within forty-five. The Attorney General enforces it, and there are no private lawsuits.
Why it matters
The privacy gains here are real, and so is the pressure that comes with them. A duty that switches on once a platform knows a user is a minor gives companies a reason to work out who is a minor, which is the on-ramp to age checks the law never openly demands. A standard as loose as heightened risk of harm hands the Attorney General wide room to decide which content and design count as harmful.
Our take
Data minimization for minors is worth having, and the vague harm duty stapled to it is the part civil-liberties people should watch. Connecticut wrote a knowledge trigger that rewards platforms for guessing their users' ages and a harm standard broad enough to reach speech, then handed both to the Attorney General.
Votes
- Senate — Passed (36 to 0) · May 11, 2023
- House — Passed (142 to 0) · June 2, 2023
Timeline
- June 26, 2023Signed into law (Public Act 23-56)
- October 1, 2024Minors and health-data provisions took effect
Our coverage: all privacy stories · Status checked July 19, 2026