Connecticut Just Redefined "Sensitive Data," and It Now Includes Your Brain

General information here, not legal advice, and if any of this touches your specific business or job, talk to an actual employment or privacy attorney. But as someone who spends the day job side of my life buried in HR compliance, this one is worth understanding, because it is a genuine shift in how broadly "sensitive data" gets defined.

Connecticut's amended Data Privacy Act took effect July 1, 2026, and the headline change is what now counts as sensitive data. The expanded list includes biometric and genetic information, neural data, mental or physical disability and treatment details, transgender and nonbinary status, financial account information, and government issued identification numbers. Selling any of that without consumer consent is now explicitly prohibited.

Neural data is the one that jumps out. A few years ago that category did not meaningfully exist in privacy law, because there was not much consumer neural data being collected. That has changed fast, wearable EEG, sleep tracking headbands, and neurotech wellness devices have all moved from lab curiosities to actual retail products. Connecticut just became one of the states saying, in effect, if your product reads someone's brain activity, it gets treated with the same legal weight as their social security number.

The other change that matters more than it sounds like it should is the threshold drop. Previously, businesses only had to comply if they processed data belonging to 100,000 or more Connecticut residents. That threshold just dropped to 35,000. On top of that, any business that sells even a single resident's data, or handles even one resident's sensitive data, is now covered, full stop, regardless of overall volume. That is a huge expansion of who this law actually reaches. A lot of smaller companies that assumed they were too small to worry about state privacy law are not too small anymore.

For businesses, the practical obligations tightened too. Sensitive data processing now has to be "reasonably necessary and proportionate" to whatever purpose was disclosed to the person, not just technically permitted by some checkbox they clicked once. Privacy notices need to be posted in specific, prescribed locations, not buried in a footer link nobody opens. Material changes to how data gets used require actual notification, and residents can withdraw consent and have that respected going forward. There are also new minor protections, a business cannot sell or share personal data when it has actual knowledge, or is willfully ignoring signs, that the person is a minor.

Here is why this actually lands on my desk twice, once as an HR person and once as someone building privacy first apps. On the employer side, this changes the calculus around biometric time clocks, wellness program genetic testing, and any employee assistance program data that touches mental health treatment. All of that now falls under the stricter sensitive data bucket in Connecticut, which means tighter consent requirements and a real paper trail obligation if you are collecting any of it, even with good intentions.

On the software side, this is the argument for building local encryption in from day one instead of retrofitting it once a state regulator asks a hard question. A law that keeps expanding the definition of sensitive data, and keeps lowering the threshold for who has to comply, is not a one time compliance project. It is a trend line. The honest read is that "we do not collect it, or we encrypt it on device and never see it," is a much easier compliance story to tell two years from now than "we collected it and have a policy about it," even if that policy is airtight today.

One more date to flag: additional protections under a related bill, SB 4, take effect October 1, 2026, covering geolocation data, facial recognition, and deletion rights specifically. This is not a one and done update, Connecticut has been revising this law almost every year since it passed, and that pace does not look like it is slowing down.

Sources: Benesch Law, Mintz, and Proskauer on Privacy. You can see what this studio builds at jcmobileappstudio.com/apps.