All Roll Calls
Yes: 214 • No: 18
ConnecticutSB 012952025 Regular SessionSenateWALLET
AN ACT CONCERNING BROADBAND INTERNET, GAMING, SOCIAL MEDIA, ONLINE SERVICES AND CONSUMER CONTRACTS.
Sponsored By: General Law Committee
Signed by Governor
Summary
To (1) require the owner of a social media platform to incorporate an online safety center into, and establish a cyberbullying policy for, the owner's social media platform, (2) redefine "heightened risk of harm to minors" to include processing minors' personal data in a manner that presents any reasonably foreseeable risk of harm to minors' physical or mental health, and (3) require the controller of an online service, product or feature that is offered to minors to (A) include a default setting in such service, product or feature to prevent adults from sending unsolicited communications to minors, (B) not use any system design feature to significantly increase, sustain or extend minors' use of such service, product or feature, and (C) disclose to the Attorney General a plan established and implemented to mitigate or eliminate any heightened risk of harm to minors.
general law
Personalized for You
How does this bill affect your finances?
Personalize government policy and PRIA will tell you what this bill means for your household, plus every other piece of legislation we track. PRIA reads each provision against your financial profile to show you exactly what matters to your wallet.
Bill Overview
Analyzed Economic Effects
27 provisions identified: 14 benefits, 2 costs, 11 mixed.
Survivors can block connected-car access
Beginning July 1, 2026, covered connected-car providers must act on qualifying adult survivors' access requests within two business days. Requests must identify the vehicle identification number and abuser and include required ownership, exclusive-possession, or court-order proof. Providers must take requested access-blocking steps, or explain applicable in-car controls, and block access to newly generated service data. They cannot demand extra fees or documentation; technical or operational inability requires prompt notice and required information. Before formally notifying an abuser, providers must alert the survivor and take reasonable steps to delay notice at least three days, until after access ends. Request information must stay confidential and be securely disposed of within 90 days, except a limited verification record. Third-party sharing requires the survivor's affirmative consent or must be necessary to carry out the request.
Capped broadband bills for qualifying households
Connecticut’s energy and environmental agency must establish the Net Equality Program by September 30, 2026. Households qualify within a qualified provider’s Connecticut service area when a resident receives SNAP or other provider-recognized public assistance. Beginning October 1, 2026, qualified providers must accept subscription requests and publicize enrollment steps, including prominently on their websites. Program service costs no more than $40 monthly, including equipment, taxes, fees, and charges. Annual inflation adjustments begin by June 1, 2027, using the prior calendar year’s change in consumer prices.
Car buyers see optional charges upfront
Beginning October 1, 2025, Connecticut dealers must include imposed optional add-on charges in a vehicle's quoted selling price. Each charge must appear separately and be labeled optional. Dealers cannot preprint optional add-on amounts on orders or invoices before discussing them with the buyer. Dealers can still offer optional products and services.
Companies must assess profiling risks for minors
Beginning July 1, 2026, covered companies must assess online services that profile users they know, or willfully disregard, are minors. Assessments must cover how profiling works, data inputs and outputs, risks, transparency, and safeguards after launch. Companies must review and retain assessments and carry out plans to reduce or eliminate identified heightened risks to minors. The Attorney General can demand a relevant risk-reduction plan during an investigation. Companies must provide it within 90 days after notice.
Minimum speeds for affordable household broadband
Net Equality broadband must deliver at least 100 Mbps download and 5 Mbps upload from October 1, 2026, through September 30, 2027. Beginning October 1, 2027, minimum speeds are 100 Mbps download and 20 Mbps upload. Service speeds and response times must support distance learning and telehealth. Beginning June 1, 2030, the administering agency can raise these minimums no more often than every two years. Allowed deviations for legal or federal-program requirements cannot reduce speeds below the applicable minimums.
Safer online settings for kids
Beginning July 1, 2026, covered services face safeguards when they know, or willfully disregard, that users are minors. They cannot use design features that significantly increase or extend minors' use; education-directed services are excluded from that rule. Precise location collection must be strictly needed, last only as long as necessary, and show a signal throughout collection. Messaging safeguards must block unsolicited contact from unconnected adults by default and offer easy controls for minors and parents. Services mainly providing email or qualifying private direct messages are excluded from the messaging rule. Social platforms cannot require parents to open new accounts to request a child's account be hidden or deleted, though accessible existing accounts may be required.
Stronger limits on children's data use
Beginning July 1, 2026, general consent protections for targeted ads and data sales extend to ages 13–17, adding ages 16–17. Separate online-service rules generally bar these uses for minors, except processing reasonably needed to provide the service. Those rules also limit unrelated uses and retention, but exclude services used under an educational entity's direction. They apply when companies know, or willfully disregard, that users are minors. Important automated decisions involving minors face necessity limits and require the minor's consent, or parental consent for children under 13. These decisions include loans, housing, insurance, education, criminal justice, jobs, health care, and essential goods or services. The law also allows internal operations that comply with the federal children's privacy law's internal-operations exception.
Clearer privacy notices and opt-outs
Privacy notices must explain requests and appeals, data sales, targeted ads, contact options, and data use for large language model training. They must show their update month and year and meet prominent-display, language, and disability-access rules. Companies must notify affected consumers about major retroactive privacy changes and allow withdrawal of consent to materially different uses of earlier data. Clear website links and qualifying, consumer-chosen signals must allow opt-outs from targeted ads and data sales. Signals must establish a legitimate Connecticut request, cannot rely on defaults, and override conflicting settings or qualifying rewards-program choices. When a company links opting out to a charge and offers a data-use incentive, it must explain that incentive's terms.
Clearer subscription terms and consent records
Beginning October 1, 2025, covered subscription and ongoing-service agreements must clearly explain renewal terms. The rules cover Connecticut consumer agreements entered into or amended on or after October 1, 2023. Written or electronic disclosures must stand out and be retainable; spoken disclosures must be easy to hear and understand. Specified utility, financial, insurance, and audiovisual agreements are excluded. Courts and state agencies reviewing renewal consent must consider whether the business produced a lawful consent record, including applicable telephone-recording requirements.
More businesses must protect consumer data
Beginning July 1, 2026, broader coverage applies to businesses operating in Connecticut or targeting its residents. A business qualifies if it handled at least 35,000 consumers' personal data during the prior calendar year. Handling consumers' sensitive data or offering their personal data for sale also triggers coverage, without that count requirement. Data used only to complete payment transactions does not count toward the 35,000-consumer threshold.
Privacy protections cover nervous system data
Beginning July 1, 2026, Connecticut’s privacy law treats neural data as sensitive personal data. This means information generated by measuring activity in a person’s central nervous system. Covered companies must apply the law’s sensitive-data protections to this information.
Risk reviews for major automated decisions
Effective July 1, 2026, covered companies must assess profiling used for decisions with legal or similarly major effects on consumers. This requirement covers processing activities created or generated on or after August 1, 2026. Reviews must address purpose, data, performance, risks, transparency, risk reduction, and safeguards after launch. Similar operations can share an assessment, and reasonably similar assessments under another applicable law count. Data processors must provide practical, necessary help based on available information and the processing involved. The Attorney General can obtain relevant assessments during investigations; they remain confidential and exempt from public disclosure.
Social media users get safety resources
The requirements take effect July 1, 2026, with platform safety centers required by October 1, 2026. Centers must give Connecticut users cyberbullying-prevention resources, mental-health service links, behavioral-health education, and instructions for reporting harmful behavior. They must also explain social media’s effects on mental health. By October 1, 2026, platforms must establish policies explaining how they handle cyberbullying reports.
Sports bettors gain wager cancellation safeguards
Effective July 1, 2025, operators need written state approval to cancel sports wagers outside the regular cancellation rules. They must provide additional information on request and log covered wager changes and cancellations, including reasons, market types, events, and dates. Logs must identify affected patrons when applicable, but names are not required for retail wagers. Operators must submit cancellation controls by September 1, 2025; the state must approve or reject them by December 1, 2025. Controls must require notice within 24 hours after state approval of a cancellation and prompt return of patron funds. Approved controls must appear in house rules and clearly on the electronic wagering platform.
Stronger safeguards for sensitive personal data
Beginning July 1, 2026, covered companies must limit data collection, secure it, and obtain consent for incompatible new uses. Sensitive-data use requires consent and reasonable necessity; selling sensitive data also requires consent. Expanded protections cover specified health, disability, treatment, transgender or nonbinary status, brain-activity, and genetic or biometric information. Health data includes information used to identify mental or physical health, including gender-affirming, reproductive, and sexual health. Financial credentials qualify when they enable account access; government ID numbers qualify when public display is not legally required. Identifiable biometric data collected without consent cannot count as public information. Access responses must confirm collection without revealing protected identifiers or credentials, and children's sensitive data must follow federal children's privacy rules.
Some organizations escape state privacy requirements
Beginning July 1, 2026, specified political committees, insurance entities, financial firms, and financial information are exempt from state privacy requirements. Banks, credit unions, and related firms qualify only with listed financial activities, regulatory oversight, and a personal-data compliance program. Specified investment professionals must be regulated by Connecticut's banking department or the Securities and Exchange Commission. The exemptions also cover specified information regulated by the federal financial privacy law.
Lottery licensees face tighter oversight, penalties
Beginning October 1, 2025, the consumer protection commissioner can deny, condition, suspend, revoke, or refuse renewal of lottery licenses for good cause after a hearing. Grounds include rule violations, fraud, materially false information, specified convictions or judgments, insolvency, and incomplete applications. Covered lottery-rule violations can bring civil penalties up to $2,500 each after a hearing. Lottery retailers cannot keep unauthorized gambling devices, illegitimate tickets, or illegal bookmaking equipment, or allow professional gambling. Violations bring fines up to $4,000 each and immediate license suspension; retailers must stop licensed activity and can request a hearing within 15 days. Suspension continues until lifted and all fines under this rule are paid. The commissioner can also require vendor and affiliate licensees’ records to check compliance.
Consumers can question automated decisions
Beginning July 1, 2026, consumers can access conclusions drawn from their data and learn about covered automated decision-making. They can question important decisions, ask why they happened, and review the data used. Housing decisions also carry correction and reevaluation rights, subject to feasibility and data-purpose limits. Covered decisions concern loans, housing, insurance, education, criminal justice, jobs, and health care; the general definition drops essential goods and services. Consumers can also obtain a list of third parties that bought their data.
Data bias checks get narrow exceptions
Beginning July 1, 2026, companies cannot process personal data in ways that violate state or federal discrimination laws. Their anti-bias testing and response can matter in related claims or defenses. The law permits necessary internal data use solely to detect or correct bias in important automated decisions. That exception requires safeguards, security, documented access controls, restrictions on reuse, deletion when finished, and no third-party access.
Sports bettors get refunds and corrections
Beginning July 1, 2025, operators can void covered wagers without prior state approval after cancellations, venue changes, or delays over 24 hours. Covered changes also include absent players or acts and changes to tournament participation or event format. Operators must promptly return voided funds to online accounts, but the wager loses its chance of a payout. Operators must correct or void specified communication or entry errors when bettors request help before the event. Retailers must post state-approved refund instructions, at least 8.5 by 11 inches with at least 20-point text.
Vehicle safety requests carry legal limits
Beginning July 1, 2026, covered connected-vehicle providers must post website instructions for survivors seeking limits on another person’s access. Survivors who submit requests must reasonably notify providers about ownership or possession changes that materially affect the need for action. Providers and their officers, directors, employees, vendors, and agents receive civil immunity for actions or omissions that comply with these rules.
Lottery workers gain endorsements, reporting duties
Beginning October 1, 2025, covered lottery workers face new licensing and reporting rules. Class III and IV applicants, and corporation employees holding those licenses on January 1, 2026, must disclose their gaming work. The commissioner can approve endorsements for lottery internet games or retail sports wagering without a separate gaming license. Class III and IV licensees must report criminal convictions within two business days after judgment. The corporation and licensees must immediately report employee job changes requiring an additional endorsement.
Online services must assess children's risks
Beginning July 1, 2026, services must assess data uses and foreseeable harm when they know or willfully disregard that users are minors. The former limit to offerings made on or after October 1, 2024, no longer applies. Covered risks include violence, sexual abuse or exploitation, material injury or intrusion, and severe, pervasive, or objectively offensive material harassment. Companies meeting assessment requirements receive a rebuttable presumption of reasonable care in Attorney General enforcement actions involving minors.
Privacy compliance help but confidential reviews
Beginning July 1, 2026, data processors must help companies respond to consumer privacy requests when possible. They must also supply available information needed for data protection and impact assessments. Required help depends on the processing involved and information available. Assessments and harm-reduction plans remain confidential and exempt from public-records disclosure. Sharing legally privileged information with the Attorney General does not waive that protection.
Lottery delivery expands with security requirements
Beginning October 1, 2025, the Connecticut Lottery Corporation can use businesses without vendor licenses to deliver tickets to retailers. The consumer protection department must approve a detailed plan before a delivery business is used. Corporation employees must pack tickets on-site under video surveillance in unmarked, tamper-evident packaging. Shipments must be tracked, signed for, and recorded; plan documentation must be kept for at least three years. The corporation must promptly report delivered packages that appear compromised.
Broadband contract preferences and legal limits
Beginning January 31, 2027, state agencies must favor qualified Net Equality providers when buying broadband, all other factors equal. The program’s specified rules cannot impair contracts already in existence on October 1, 2026. A program violation does not count as an unfair or deceptive trade practice under Connecticut’s cited consumer-protection law.
Some contractor ads can link registration
Beginning October 1, 2025, qualifying home-improvement businesses can provide a phone number or website instead of registration details in some ads. The business must be listed on a U.S. stock exchange. At least 30% of its advertising spending must fund campaigns aimed concurrently at audiences in at least five states. The alternative excludes direct-to-consumer ads, and the phone number or website must provide registration status and number.
Sponsors & Cosponsors
Sponsor
General Law Committee
Affiliation unavailable
Cosponsors
There are no cosponsors for this bill.
Roll Call Votes
House vote • 3/21/2025
House Roll Call Vote 339 AS AMENDED
Yes: 127 • No: 15
Senate vote • 3/21/2025
Senate Roll Call Vote 353
Yes: 33 • No: 2
Senate vote • 3/21/2025
Senate Roll Call Vote 352
Yes: 33 • No: 1
Senate vote • 3/21/2025
GL Vote Tally Sheet (Joint Favorable Substitute)
Yes: 21 • No: 0
Actions Timeline
Signed by the Governor
6/24/2025legislatureTransmitted by Secretary of the State to Governor
6/23/2025legislatureTransmitted to the Secretary of State
6/23/2025legislaturePublic Act 25-113
6/11/2025legislatureIn Concurrence
6/3/2025legislatureHouse Passed as Amended by Senate Amendment Schedule A
6/3/2025HouseHouse Adopted Senate Amendment Schedule A
6/3/2025HouseRules Suspended
6/3/2025legislatureHouse Calendar Number 686
6/3/2025HouseFavorable Report, Tabled for the Calendar, House
6/3/2025HouseTransmitted Pursuant To Joint Rule 17
6/3/2025legislatureSenate Passed as Amended by Senate Amendment Schedule A
6/3/2025SenateSenate Adopted Senate Amendment Schedule A 10466
6/3/2025SenateFile Number 576
4/8/2025legislatureSenate Calendar Number 319
4/8/2025SenateFavorable Report, Tabled for the Calendar, Senate
4/8/2025SenateReported Out of Legislative Commissioners' Office
4/8/2025legislatureReferred to Office of Legislative Research and Office of Fiscal Analysis 04/07/25 5:00 PM
4/2/2025legislatureFiled with Legislative Commissioners' Office
3/24/2025legislatureJoint Favorable Substitute
3/21/2025legislaturePublic Hearing 02/19
2/14/2025legislatureReferred to Joint Committee on General Law
2/13/2025legislature
Bill Text
Public Act No. 25-113
6/3/2025
File No. 576
4/8/2025
GL Joint Favorable Substitute
3/21/2025
Raised Bill
2/13/2025
Bill Analysis For File Copy 576
Bill Analysis for SB-1295, as amended by Senate "A"
Fiscal Note For File Copy 576
Fiscal Note for Amendment LCO 10405 (See Fiscal Note Details)
Fiscal Note for Amendment LCO 10466 (See Fiscal Note Details)
Fiscal Note for SB-1295, As Amended by Senate "A" (LCO 10466)
GL Joint Fav. Rpt
GL Vote Tally Sheet (Joint Favorable Substitute)
House Roll Call Vote 339 AS AMENDED
Senate LCO Amendment #10405 (D)
Senate Roll Call Vote 352
Senate Roll Call Vote 353
Senate Schedule A LCO# 10466 (D)
Summary for Public Act No. 25-113
Related Bills
HB 05013, AN ACT ADDING CERTAIN PLANTS TO THE INVASIVE PLANTS LIST.
To prohibit the sale, use and distribution of certain invasive plants in the state.
SB 01558, AN ACT CONCERNING INCOME TAXES IMPOSED BY OTHER JURISDICTIONS ON RESIDENTS OF THE STATE.
To (1) reduce a portion of the amount of the credit for income taxes paid to other states, (2) require the Attorney General to study ways to defend residents from having income tax imposed by other jurisdictions on income derived from services rendered while such resident was within this state, and (3) provide a credit to residents who file an appeal protesting the tax imposed by such other jurisdiction.
SB 01396, AN ACT CONCERNING EARNED BUT UNPAID WAGE OR SALARY INCOME ADVANCES.
To establish various requirements concerning earned but unpaid wage or salary income advances.
SB 01187, AN ACT CONCERNING FORECLOSURE, ASSIGNMENT AND OTHER ENFORCEMENT ACTIONS FOR UNPAID SEWER ASSESSMENTS AND OTHER FEES AND CHARGES.
To prohibit foreclosure, assignment and other enforcement actions for unpaid sewer assessments and other fees and charges in the case of owner-occupied real property for which the principal of such unpaid assessments, fees and charges is less than three thousand dollars unless three years have elapsed from the date any lien was filed and such lien remains unpaid.
HB 07236, AN ACT CONCERNING HUMAN TRAFFICKING AND SEXUAL ASSAULT VICTIMS.
To amend the membership of the trafficking in persons council, add victims of sexual assault and victims of trafficking in persons as protected classes for purposes of certain anti-discrimination statutes, create an affirmative defense for misdemeanor offenses for young victims of trafficking in persons and eliminate the requirement that training in identification and reporting of trafficking in persons be presented in a video format.
HB 07192, AN ACT IMPLEMENTING RECOMMENDATIONS OF THE BIPARTISAN DRUG TASK FORCE.
To implement recommendations of the bipartisan drug task force.