Quick answer
If you live in Connecticut, you can ask covered companies to delete the personal information they have about you, and they must respond within 45 days. Send your request through the company's privacy form or privacy email, and keep a record of when you sent it.
Your rights under the CTDPA
The Connecticut Data Privacy Act (CTDPA) gives Connecticut residents the right to:
- Find out what personal information a company has about you, including conclusions it has drawn about you
- Get a list of the companies it sold your information to
- Have it deleted
- Correct information that's wrong
- Get a copy of your data in a usable format
- Opt out of targeted advertising, the sale of your data, and certain kinds of profiling
- Question certain automated decisions made about you, such as for housing or employment
What makes Connecticut's law stand out
Connecticut overhauled its law in July 2026. It now covers companies with as few as 35,000 Connecticut customers, down from 100,000, and companies that process sensitive information or offer personal data for sale can be covered even if they fall below that threshold.
The update also added new rights: you can see the conclusions a company has drawn about you (like marketing profiles), get a list of the companies it sold your data to, and question the results of certain automated decisions. Companies must also honor browser privacy signals like Global Privacy Control.
Which companies have to comply
Companies doing business in Connecticut that handle the personal information of at least 35,000 Connecticut residents a year (not counting information used only to process a payment), or that process sensitive information or offer personal data for sale, even if they fall below that threshold (subject to the law's exclusions). Connecticut also has separate rules for companies that handle consumer health data.
That covers most large retailers, streaming services, apps, and online platforms, but not every small business. Certain health, financial, credit-reporting, and other regulated information is exempt when it's covered by specified federal or state laws, and companies can keep data they're legally required to retain.
How to ask a company to delete your data
- Find the company's privacy policy, usually linked at the bottom of its website. Look for a privacy request form or a privacy email address.
- Ask the company to delete your personal information, and say that you're a Connecticut resident making the request under the CTDPA.
- Expect the company to verify your identity, often by email. That's normal, and it protects you from someone else deleting or requesting your data.
- Write down the date you sent the request. You'll need it if the company misses its deadline.
How long companies have to respond
Companies must respond within 45 days. They can take up to 45 more days when reasonably necessary, as long as they tell you.
If a company ignores or refuses your request
If a company refuses your request, it has to offer a way to appeal. If the appeal is denied too, you can file a complaint with the Connecticut Attorney General.
Make your requests in minutes, not evenings
The hard part isn't the law. It's knowing which companies have your data and writing to each one. DataTrail scans your inbox (read-only) to find every company that has your email address, writes a deletion request that cites the CTDPA, and tracks the 45-day deadline for you. You review each one and send it from your own email.
Join the waitlistEnforced by the Connecticut Attorney General. This page is general information, not legal advice, and laws change. For the official text, see Connecticut's state legislature or Attorney General website.