# Regulatory Standards — Connecticut CTDPA

## Primary Legislation

### Connecticut Data Privacy Act — Conn. Gen. Stat. §42-515 through §42-525

Enacted: May 10, 2022 (SB 6). Effective: July 1, 2023.

- **§42-515**: Definitions (including dark pattern, consumer, controller, processor, sensitive data)
- **§42-516**: Applicability thresholds and exemptions
- **§42-517**: Exemptions (entity-level and data-level)
- **§42-518**: Controller duties (minimization, security, consent, privacy notice, DPIAs)
- **§42-519**: Processor duties and contract requirements
- **§42-520**: Consumer rights (access, correct, delete, portability, opt-out, appeal)
- **§42-521**: De-identified data provisions
- **§42-522**: Limitations on applicability
- **§42-523**: Construction of the act
- **§42-524**: Enforcement by AG
- **§42-525**: Cure period (60 days until Dec 31, 2024; discretionary after)

### 2023 Amendments (SB 3)

Amended the CTDPA to:
- Expand the definition of "consumer" to clarify scope
- Add requirements for transparency in automated decision-making
- Clarify the interaction between CTDPA and CUTPA enforcement

## Dark Pattern Framework

### CTDPA Definition (§42-515(8))

"Dark pattern" means a user interface designed or manipulated with the substantial effect of subverting or impairing user autonomy, decision-making or choice, and includes, but is not limited to, any practice the Federal Trade Commission refers to as a "dark pattern."

### FTC Dark Patterns Report (September 2022)

The FTC report "Bringing Dark Patterns to Light" identified categories:
- **Endorsements and testimonials**: Fake or misleading endorsements
- **Design asymmetry**: Making one choice visually dominant
- **Bundled consent**: Combining consent for unrelated purposes
- **Confirm-shaming**: Using emotional manipulation
- **Interface interference**: Manipulating the user interface to steer choices
- **Forced action**: Requiring consent to access features
- **Hidden information**: Obscuring material terms
- **Nagging**: Repeated requests to reconsider
- **Obstruction**: Making it difficult to cancel/opt out
- **Sneaking**: Adding items/charges without clear disclosure
- **Social proof**: Fake activity indicators
- **Urgency**: Artificial countdown timers

### CTDPA-Specific Application

The dark pattern prohibition in the CTDPA specifically applies to:
1. Obtaining consent for sensitive data processing (§42-518(a)(5))
2. Any consent mechanism used to establish a lawful basis for processing
3. Consent for processing children's personal data

## Comparison: CTDPA Loyalty Program Exemption

| Aspect | CTDPA | CCPA/CPRA | VCDPA |
|--------|-------|-----------|-------|
| Loyalty program exemption | Explicit exemption (§42-517(c)) | Financial incentive provisions (§1798.125) | No specific exemption |
| Scope | Data collected for program purposes | Incentives permitted if reasonable | Standard rules apply |
| Consumer choice | Voluntary participation | Opt-in to incentive | N/A |
| Data use limitation | Program purposes only | Reasonable relation to data value | Standard purpose limitation |

## Related Connecticut Laws

### Connecticut Unfair Trade Practices Act (CUTPA) — Conn. Gen. Stat. §42-110b

CTDPA violations are enforced under CUTPA framework, providing:
- Civil penalties up to $5,000 per willful violation
- Injunctive relief
- AG investigation and enforcement authority
- No private right of action under CTDPA (though CUTPA has limited private rights)

### Connecticut Data Breach Notification — Conn. Gen. Stat. §36a-701b

Requires notification within 60 days of discovery of a security breach involving personal information of Connecticut residents.