Affirmative
Require a clear act. Hovering, muting, pausing or closing content does not count. A preselected checkbox is not the consumer’s affirmative act.
A DIFFERENT STATE. A CONSIDERED YES.
Connecticut consent
Choose an activity. Check the rules for the data and the person.
START WITH SCOPE
This guide assumes a covered controller, a Connecticut consumer, and nonexempt personal data. Sensitive-data processing is its own coverage route, subject to the payment-only exclusion. Check §§ 42-516, 42-517 and 42-524 first. Specialized health-data restrictions may also apply under § 42-526. [1]
Hover over or tap a marked term for its Connecticut definition, or a statute citation for the legal text. With a keyboard, focus the control and press Enter or Space. Press Esc or tap elsewhere to close.
Goofus & Gallant
Two lemonade-delivery founders. Enable JavaScript to try their fictional apps, or use the consent guide below.
01
THE CONSENT TRIGGER
Do you need consent?
Choose a path.
Consent is one part of the test.
Choose an activity to check the requirement.
The interactive guide needs JavaScript. For sensitive data, consent generally comes first. Ordinary sales, targeted advertising and significant-decision profiling generally carry opt-out rights. Minors and particular data types have additional consent requirements or prohibitions. The sources below set out the differences.
Assumes a covered controller and nonexempt data. These are hypothetical choices; no personal information is requested. Hover over or tap underlined terms and citations for the source text. With a keyboard, focus the control and press Enter or Space.
02
THE CONSENT STANDARD
How to ask for consent
Five elements in § 42-515(7).
All must be satisfied.
Freely given
Make saying no a genuine option. Agreement obtained through dark patterns cannot supply valid consent.
Specific
Identify the processing the person is agreeing to. A general acceptance of broad terms containing unrelated material is excluded.
Informed
Explain the data use before asking. Also provide the accessible, clear and meaningful privacy notice required by § 42-520(b); a notice alone does not supply consent.
Unambiguous
Use a choice whose meaning is clear. The act must communicate agreement to the described processing. [4]
03
THE FOLLOW-THROUGH
Changes and withdrawal
Withdrawal of consent
Provide an effective revocation mechanism at least as easy as the consent mechanism. Stop processing as soon as practicable, and no later than 15 days after receiving the request. This is the consent-withdrawal deadline, not the general rights-request deadline. [5]
Use for a new purpose
Obtain consent for a new purpose that is neither reasonably necessary to nor compatible with the disclosed purposes. Consider reasonable expectations, the relationship between purposes, impact, collection context and safeguards. Sensitive-data processing still must satisfy the sensitive-data rule. [6]
Material changes to the notice or practices
For a retroactive material change to the notice or practices, notify affected consumers about data to be collected after the change. Give a reasonable opportunity to withdraw consent to further, materially different collection, processing or transfer of previously collected data. [7]
Rights and nondiscrimination
Do not discriminate for exercising statutory rights. The statute preserves the ability to withhold a product requiring data the controller does not collect or maintain, and qualifying voluntary loyalty-program offerings. These exceptions do not replace valid consent where required. [8]
FOLLOW THE AUTHORITY
Sources
Pinpoint citations for the assigned text.
Plain-language summaries throughout.
Coverage & exclusions
§§ 42-516, 42-517, 42-524; see also § 42-526.
The flow assumes coverage and no applicable exemption; it does not resolve special health-data restrictions.
Sensitive data & consent trigger
§ 42-515(7), (9), (28), (30), (40); § 42-520(a)(1)(D).
Reported or inferred data used to identify health can fall within consumer health data. The rule requires necessity and consent.
Sales & the geolocation bar
§ 42-515(29), (39); § 42-520(a)(1)(H), (a)(3); § 42-521(a)(2).
Sensitive-data sales require consent. Controllers and third parties may not sell precise geolocation data, subject to the stated exclusions.
Valid agreement & dark patterns
§ 42-515(7), (14); § 42-520(b)(1)–(2).
A clear affirmative act must be freely given, specific, informed and unambiguous. Dark-pattern agreement is excluded.
Withdrawal
§ 42-520(a)(1)(G).
An effective mechanism at least as easy as giving consent; cease processing as soon as practicable, within 15 days.
New purposes
§ 42-520(a)(1)(B)(i)–(v), (D).
Apply the five purpose-compatibility factors and the sensitive-data requirement.
Retroactive material changes
§ 42-520(b)(3)(A)–(B).
Notify affected consumers and allow a reasonable opportunity to withdraw for further materially different uses of prior data.
No discrimination & limits
§ 42-520(a)(1), final sentence; § 42-520(a)(2).
Rights exercise is protected; the text provides specific product/service and voluntary-program limits.
Tooltip definitions
§ 42-515, as reproduced in the October 2026 reader.
Each tooltip identifies its own subsection. Connecticut terms are not substituted with Colorado definitions.
Ordinary data and opt-outs
§ 42-518(a)(5); § 42-520(a)(1)(A), (B), (D), (c). Ordinary data does not create a blanket opt-in rule. Sale, targeted advertising and covered automated profiling carry opt-out rights. Honor qualifying signals for sale and targeted advertising even when they conflict with an existing setting; the statute permits a notice of the conflict and a choice to confirm the setting.
Children and teenagers
§ 42-515(40)(D); § 42-520(a)(1)(D), (I); § 42-529a. Child-data processing must comply with COPPA. Sale and targeted advertising involving known or wilfully disregarded ages 13–17 are prohibited. Online minors rules additionally restrict purposes, necessity, retention, geolocation and engagement features; significant automated profiling needs necessity plus consent. Read the limited educational exceptions separately.
Sensitive categories beyond health
§ 42-515(40); § 42-520(a)(1)(D), (H), (a)(3). The October 2026 definition includes crime-victim status, neural data, account/card information combined with access credentials, and nonpublic government identifiers, as well as the other listed sensitive categories. Consent and reasonable necessity both matter. Precise geolocation sales are prohibited.
Facial recognition for on-premises security
§ 42-524(a)(1)(I), (a)(2). The security/fraud exception has additional on-premises facial-recognition limits: matching against an exclusively owned and maintained database, entrance signage, and a linked policy including the Attorney General’s contact information. A consumer-consented commercial transaction has a specified exception to those conditions. This does not remove all other duties.
About this edition & its boundaries
This educational guide follows the assigned Week 6 reader, pp. 49–61: P.A. 25-113 (effective July 1, 2026), P.A. 26-64 and P.A. 26-100 § 45 (effective October 1, 2026). Subsection numbering follows that reader. Official compilations can display earlier versions alongside future-effective text; check the effective date before comparing a subsection.
The flow includes ordinary and sensitive data, children, teenagers, online-service rules, precise location, profiling and opt-outs. Data brokers, health-facility geofencing and specialized exemptions still require separate review. The minors branches use the July 2026 text; do not substitute the older version that allowed consent for activities now prohibited. This is a course-reader snapshot, not an exhaustive compliance guide. Connecticut is presented through its statute; Colorado’s detailed consent rules are not Connecticut regulations.