Connecticut's privacy amendments reach a lot more SaaS companies
Connecticut's amended Data Privacy Act and new AI provisions begin taking effect this month, and the lowered applicability threshold pulls in small software companies that assumed they were exempt.
Connecticut’s 2026 amendments to its Data Privacy Act begin taking effect October 1, along with a package of new AI provisions. The change that matters most to software companies is not the AI material. It is the applicability threshold, which law firm summaries describe as dropping to 35,000 consumers and, separately, covering anyone who processes sensitive data or offers personal data for sale. The old test also required a revenue tie to data sales. That requirement is gone.
The practical effect is that the “we are too small for state privacy laws” assumption no longer holds for a lot of SaaS companies. A product with a few thousand paying business customers can easily touch 35,000 Connecticut residents through user accounts, end-user data, or analytics, and under the new language a single category of sensitive data can put you in scope regardless of volume. The sensitive data definition also got wider, now reaching financial account credentials and government ID numbers. If your product collects either one, even as a pass-through feature, check whether you are in.
The second thing to sort out is whether you are a controller or a processor. Most B2B software companies are processors for their customers’ data, and the statute treats that role differently. But the distinction is a matter of contract and actual practice, not a label in your terms of service. If you use customer data to improve your product, train a model, or build benchmarks, you are making your own decisions about that data, and a regulator can reasonably call you a controller for that use. I have seen plenty of data processing addendums that say “processor” in the header and then grant the vendor broad rights to use data for its own purposes. Those two things cannot both be true.
The amendments also add consumer rights around profiling: the right to question a result, to learn the reason for it, and to have the decision reevaluated on corrected data. For anyone selling a scoring or ranking feature into hiring, lending, housing, or insurance, your customers will start asking how your product supports those requests. Connecticut also added employer notice requirements for AI tools used in employment decisions, covering the tool’s purpose, trade name, and the categories and sources of data it uses. Your customers will need that information from you, and they will need it in writing.
Enforcement sits with the Connecticut Attorney General, who has been an active and fairly public enforcer of the original act. That is a reason to take the scoping question seriously now rather than after a letter arrives.
This quarter, do one concrete thing: run a Connecticut scoping exercise. Pull your user counts by state, list every category of sensitive data your product touches, and write a one-page memo stating whether you are a controller, a processor, or both for each data use. Then compare that memo to what your DPA and privacy policy actually say. Where they disagree, fix the document or fix the practice. It is a small amount of work, and it produces exactly the record you will want if anyone ever asks.