Issue link: https://nebusinessmedia.uberflip.com/i/1540922
22 HARTFORDBUSINESS.COM | NOVEMBER 3, 2025 FOCUS | CYBERSECURIT Y Connect with us today! 860-448-4295 NMLS #402928 From the day you open your doors to the day you pass it on, and every day in between. Let's grow your business, together! We're here for it! be prohibited from selling or using a minor's data altogether. The new definition also broadens what counts as health information, covering data that consumers routinely log through fitness apps and wearable devices such as smartwatches. For those businesses, there will be no minimum data threshold — meaning even small app developers or niche health companies will be required to comply. "Almost all of the questions we're getting, almost all the action we're seeing is on the healthcare side," Roberts said. "There's a lot of compa- nies that were nowhere near the threshold for state laws broadly, so they don't have any compliance program." "That will be a game changer," agrees Lucan at the Attorney General's office. In fact, she believes the entire law should have no lower thresh- olds for the number of records that trigger compliance with the state's privacy requirements. "We shouldn't have to play a numbers game there. We should be able to protect Connecticut residents," she said. Up until January of this year, the Attorney General's office could send non-compliant companies a "cure" notice, giving them a grace period to work toward compliance. That no longer applies. Now, Lucan says, when the office receives a consumer complaint or notices a potential violation, it moves straight to an investigation. She says currently there are "dozens" of open investigations over a wide range of issues. Even so, Lucan says her office uses discretion when dealing with small businesses that might struggle with compliance, to ensure they aren't unduly burdened. The most high-profile case to date involved TicketNetwork, which was fined $85,000 in July. The attorney general's office said the company's privacy notice was largely unreadable and lacked key information about data rights. The state first flagged the issues to the company in November 2023. The extra investigative work has required more oversight, and the privacy office has grown from two attorneys a decade ago to six now, with a legal investigator also part of the team. Lucan says they're currently hiring for a paralegal. "My work was so different 10 years ago than it is now," she said. "The nature of the cases, the diversity of the cases, the different technologies we're looking at, everything has changed." AI oversight Meantime, artificial intelligence represents the next frontier in Connecti- cut's data-privacy enforcement. While lawmakers — and Gov. Ned Lamont — have been hesitant to pass sweeping AI-specific legislation, the 2026 amend- ments to the Connecticut Data Privacy Act will, in effect, regulate certain AI uses. Specifically, companies that use algorithms to build customer "profiles" will need to give consumers the right to opt out. "I think this was a recognition that even without a broader bill, AI is here. It's a really pressing issue," Lucan said. Another change she sees on the horizon is a growing movement among the states to coordinate their efforts on data privacy. Connecticut recently announced it will work with Colorado and California to implement and enforce "universal opt-out" provisions — just one effort to reduce the patchwork of privacy laws companies must follow across state lines. Roberts, of Day Pitney, said he hears complaints from companies about the ongoing costs of data privacy provisions, particularly when those businesses say they receive very little feedback from customers about their new rights. But he urges a different philosophy. "It's sort of like car insurance," he said. "Thank goodness, I don't use car insurance on a day-in, day-out basis. But when I need it, I want it there." Data Divide Continued from page 21 YEAR 2018 1 (California) 12% 2021 3 18% 2023 10 34% 2025 20 50% ADVANCE YOUR CAREER. MASTER THE DATA. SHAPE THE FUTURE. Online M.S. in Applied Data Science at Eastern Build expertise in data analytics, machine learning, and cybersecurity to lead in today's digital economy. easternct.edu/graduate-division LEARN MORE HBJ Grad Div 25.indd 1 HBJ Grad Div 25.indd 1 10/27/25 5:17 PM 10/27/25 5:17 PM U.S. STATES WITH PRIVACY LAWS OVER TIME Source: TrustArc, "U.S. Consumer Privacy Laws 2025 Update" (published June 2025). STATES WITH COMPREHENSIVE LAWS % OF U.S. POPULATION COVERED