New AI and Privacy Rules for Businesses Take Effect in Connecticut

On October 1, Connecticut implemented two new laws governing artificial intelligence (AI) and data privacy, creating a compliance regime for businesses operating in the state. The Connecticut Artificial Intelligence Responsibility and Transparency (CART) Act mandates disclosures for AI subscriptions, safeguards for whistleblowers involved with large frontier models, and new regulatory definitions of technologies covered under the law.

In addition, Connecticut's consumer protection legislation requires generative AI subscription providers to notify consumers of key subscription terms and obtain written consent. Companion legislation expands the Connecticut Data Privacy Act, establishing a data broker regulatory framework, prohibiting the sale of genetic information from Connecticut residents, and placing restrictions on facial recognition, precise geolocation, and personalized algorithmic pricing.

Businesses affected by these changes include those using automated employment decision processes, where applicants and employees must receive plain-language notices regarding AI's role in employment decisions. The new rules do not exempt employers from liability for discrimination caused by such systems. Starting January 1, 2027, companies must notify chatbot users they are not communicating with a human and implement safeguards concerning suicide, self-harm, and interactions with minors.

Additional youth-related social media provisions commence on January 1, 2028, including parental controls, default settings that limit notifications to minors, and limitations on information displayed to younger users. Although multiple state agencies are responsible for different aspects of the laws, enforcement power primarily lies with Connecticut's Attorney General's Office.

Sen. James Maroney, D-Milford, co-chairman of the legislature's General Law Committee and lead author of the AI and data privacy regulations, emphasized that this is just the beginning, as more regulations are expected in the future.