• by Wendy Davis  @wendyndavis, May 11, 2022

Connecticut Governor Ned Lamont has signed a new privacy law that gives state residents new rights, including the right to opt out of targeting advertising.

With the move, Connecticut has become the fifth state to enact a comprehensive privacy law that allows consumers to reject online ad targeting. California, Colorado, Virginia and Utah have similar laws. Maine has a narrower law that requires internet access providers to obtain consumers' opt-in consent before drawing on their web use for ad targeting.

The Association of National Advertisers on Wednesday renewed its call for a federal privacy statute that would override state measures.

"The emerging patchwork for state laws does not protect all consumers and will create a compliance nightmare for US business,” Christopher Oswald, ANA executive vice president for government relations, said Wednesday.

As with laws in California, Colorado, Virginia and Utah, the Connecticut bill gives residents the right to learn what data has been collected about them and opt out of its sale.

The measure specifically gives residents the right to opt out of the processing of their data for targeted ads -- meaning ads based on users' activity over time and across nonaffiliated websites or apps.

The Connecticut law also explicitly requires companies to honor universal opt-out requests -- like those sent through browser signals like the “Global Privacy Control.”

Colorado's privacy law includes a similar mandate, and the California attorney general has said businesses that collect personal data must comply with opt-out requests sent through the Global Privacy Control.

Connecticut's bill also requires companies to obtain people's opt-in consent before processing "sensitive" data -- including information about their race, religion, health condition, sexual orientation, biometrics and precise geolocation.

The measure includes a provision prohibiting companies from obtaining consent via “dark patterns,” meaning an interface designed to subvert users' choices.

The Connecticut law's provisions will take effect in July 2023.