Connecticut officials unveiled plans on Thursday to tighten oversight of online activity by minors and expand protections for residents’ personal information as lawmakers prepare a slate of bills this legislative session. The announcements, made by Attorney General William Tong and state Senator James Maroney at a morning briefing, signalled a push to build on the Connecticut Data Privacy Act and to address gaps revealed since the law took effect. According to the Attorney General’s office, the move responds to broader concerns about emerging technologies and data collection practices. [2],[4]

Tong warned of the risks to residents if data safeguards are not strengthened, saying, "If we don’t take action, and we just leave our information open to the dark web, there are very serious consequences for people here in Connecticut." The officials framed the proposals as targeted updates rather than an overhaul, focusing on areas where the current statute does not reach. The CTDPA, enacted in 2022 and effective July 1, 2023, grants Connecticut residents specific rights over their personal data and sets obligations for covered businesses, but does not cover all categories of data or actors. [1],[2]

Enforcement activity over the past year has informed the policy agenda. The Attorney General’s report on CTDPA implementation recorded nearly 70 complaints about data deletion and similar issues and more than 1,830 breach notifications, prompting 63 warning letters and several Assurances of Voluntary Compliance that yielded more than $750,000 in payments in 2025. Officials say about a third of complaints involved entities or data that are currently exempt from the law, highlighting limits in the statute’s scope. [4],[6]

Lawmakers signalled particular concern about chatbot and generative artificial intelligence systems that increasingly serve as interactive companions for young people. Maroney cited research suggesting widespread teen engagement with companion chatbots and warned that current legal definitions did not anticipate these uses. He said the legislature will examine narrower definitions of "publicly available information" and potential bans on commercial geolocation tracking while considering a state-level analogue to California’s Delete Act to give consumers clearer rights to remove personal data. [1],[3]

Governor Ned Lamont has filed complementary measures that would place a Chief Data Officer within the Office of Policy and Management, establish an AI "regulatory sandbox" through the Department of Economic and Community Development, and require certain chatbot developers to adopt protocols for users exhibiting mental-health distress. A separate administration bill would set default safety settings for minors on online platforms and require platforms to report metrics about minor usage, including numbers, average time spent and usage patterns by age and time of day. The proposals reflect an ambition to balance consumer safeguards with preservation of innovation. [1],[2]

Advocates and investigators have flagged how easy it can be for children and adolescents to circumvent age controls, sometimes exposing them to sexualised or violent content from AI companions and apps with weak age-verification measures. A recent CT Insider investigation found reports of students forming relationships with AI companions and described popular companion apps as lacking robust age protections despite content that appeals to children and teens. Those findings have helped shape the urgency lawmakers expressed at the press conference. [1],[4]

The administration and legislators acknowledged trade-offs. Lawmakers emphasised they do not wish to stifle technological development yet argued regulation is required to curb harms that have already materialised. Maroney warned that an unfettered "move fast" approach by some technology companies has produced real-world consequences and said Connecticut must act carefully to avoid repeating mistakes while still encouraging responsible innovation. The state’s 2025 amendment process and proposals before the General Law committee aim to align Connecticut’s privacy regime more closely with other state laws while filling identified gaps. [1],[3]

The coming weeks are expected to bring specific bill texts and committee debates that will define the pace and reach of any new requirements for platforms, AI developers and data collectors. Industry groups, privacy advocates and state agencies are likely to engage in the deliberations as lawmakers weigh whether additional statutory authority or new regulatory tools are required to protect minors and other vulnerable groups. Government materials note the Attorney General retains exclusive enforcement power under the CTDPA, a factor that will shape how new provisions are policed. [2],[6]

Source Reference Map

Inspired by headline at: [1]

Sources by paragraph:

Source: Noah Wire Services