• by Wendy Davis , Staff Writer @wendyndavis, April 28, 2022

Connecticut lawmakers on Thursday passed a privacy law that gives state residents a host of new rights -- including the right to opt out of targeted advertising.

If Governor Ned Lamont signs the measure, Connecticut will become the fifth state to enact a comprehensive privacy law that allows consumers to reject online ad targeting.

California, Colorado, Virginia and Utah have similar laws. (Maine has a narrower law that requires broadband access providers to obtain consumers' opt-in consent before drawing on their web use for ad targeting.)

The Connecticut bill passed in the House by a vote of 144-5. Last week, the state Senate unanimously passed the measure.

As with laws in California, Colorado, Virginia and Utah, the Connecticut bill gives residents the right to learn what data has been collected about them and opt out of its sale.

The measure specifically gives residents the right to opt out of the processing of their data for targeted ads -- meaning ads based on people's activity over time and across nonaffiliated websites or apps

The bill also explicitly requires companies to honor universal opt-out requests -- such as those sent through browser signals like the “Global Privacy Control.”

Privacy advocates say that mandate is critical, because it allows consumers who don't want to receive behaviorally targeted ads to opt out once and for all with a single command -- as opposed to clicking on opt-out links throughout the web.

Consumer Reports cheered news of the Connecticut measure, calling it “more workable” than some other state laws -- in part, due to the global opt-out requirement.

The new data laws in Utah and Virginia don't require companies to comply with global opt-out signals.

Colorado's privacy law includes a provision requiring companies to honor universal opt-out signals, and the California attorney general has said businesses that collect personal data must comply with opt-out requests sent through the Global Privacy Control.

Connecticut's bill also requires companies to obtain people's opt-in consent before processing "sensitive" data -- including information about their race, religion, health condition, sexual orientation, biometrics and precise geolocation.

The ad industry opposed key provisions of the bill -- including the restrictions regarding sensitive data.

“Legal requirements that limit entities’ ability to use demographic data responsibly to reach consumers with important and pertinent messaging ... can have unintended consequences and, ultimately, serve as a detriment to consumers’ health and welfare,” the Association of National Advertisers, American Association of Advertising Agencies, Network Advertising Initiative, Interactive Advertising Bureau, American Advertising Federation and Digital Advertising Alliance said in a letter sent to Connecticut lawmakers in March.

“Legal requirements should focus on prohibiting discriminatory uses of such data and other uses that could endanger the health or welfare of consumers instead of placing blanket opt-in consent requirements on uses of data,” the groups added.

If signed by Lamont, the law will take effect in July of 2023.