With 3 states changing their privacy laws, more than half the US population is now covered

With 3 states changing their privacy laws, more than half the US population is now covered

On July 1, Connecticut lowered the number of residents’ data a business has to handle before the state’s privacy law applies. The threshold dropped from 100,000 consumers to 35,000, a 65% cut, according to Clym’s analysis of Connecticut’s updated privacy law.

Connecticut also removed the threshold entirely for two kinds of businesses: any company that processes sensitive personal data or that sells personal data in exchange for money or anything of value is now covered, no matter how many Connecticut residents it reaches.

Connecticut wasn’t the only state moving that day. Arkansas activated the first state law in the country to extend core children’s privacy protections to teenagers, and Utah added a consumer right that most other states already had: the right to correct inaccurate personal data.

All three changes took effect July 1, joining a patchwork of 20 state privacy laws that now cover more than half the U.S. population.

Connecticut: A lower bar and a longer list of what counts as sensitive

Connecticut’s amendment does more than lower the threshold. It also expands what counts as sensitive data, which requires explicit opt-in consent before a business can collect it. The updated list now includes neural data from wearable and neurotech devices, disability status and treatment information, nonbinary or transgender status, and financial account credentials.

The state also raised its age threshold for children’s data protection from 16 to 18 and closed a consent loophole. Previously, a business could sell a minor’s data or use it for targeted advertising if it obtained consent. Under the new rules, that’s outright prohibited for anyone under 18, regardless of consent.

None of this comes with a grace period. Connecticut’s attorney general has had the authority to enforce the Connecticut Data Privacy Act without offering businesses a chance to fix a violation first since the law’s 60-day cure period sunset on Dec. 31, 2024, according to the Connecticut Attorney General’s office.

Violations can run up to $5,000 each under the Connecticut Unfair Trade Practices Act, and the state counts violations per consumer affected, not per incident. The office brought its first CTDPA enforcement action in 2025, an $85,000 settlement with TicketNetwork.

Arkansas: The first state to extend privacy protections to teens

More from this section

How hot does it get in the desert? A climate scientist explains its blazing heat

+3

Archaeologists find rare mosaic floor within 4th-century Roman villa

+4

Coral reef presumed dead for 60 years found alive off Africa

Arkansas’s Children and Teens’ Online Privacy Protection Act, signed in April 2025 and effective July 1, 2026, makes it the first state to expand core federal children’s privacy protections beyond kids under 13 to include teenagers, according to law firm Varnum LLP. The law splits consent into two tiers: parental consent is required to collect a child’s personal information, while either a parent or the teen can consent for users aged 13 to 16.

Operators aren’t required to verify age, but they’re expected to comply once they have actual knowledge of a user’s age. The law bars targeted advertising to minors using their personal data and limits collection to what’s necessary for the service being provided.

Enforcement rests exclusively with the Arkansas attorney general, who can pursue civil penalties of up to $10,000 per knowing and willful violation. Arkansas residents have no private right to sue.

Utah: A smaller change with a longer runway

Utah’s update is narrower. Starting July 1, residents gained the right to ask a business to correct inaccurate personal data it holds about them. Before this change, Utah and Iowa were the only two comprehensive privacy law states without a correction right; Iowa is now the only one left. Utah businesses have 45 days to respond to a correction request, and violations can bring civil penalties of up to $7,500 each.

Why the scale matters for small businesses

Connecticut’s threshold change is the one most likely to catch small businesses off guard, because 35,000 residents is a low bar for any company with a website that draws Connecticut visitors.

Small businesses make up 99.4% of all businesses in the state and employ 726,097 people, or 48.1% of Connecticut’s workforce, according to the U.S. Small Business Administration’s 2025 Connecticut state profile.

Many of those businesses now have to check whether routine tools, like analytics platforms or ad pixels that share data with third parties, count as a “sale” of personal data under the law’s broad definition.

Nationally, the SBA counts more than 36.2 million small businesses, employing 62.3 million people, or 45.9% of the private-sector workforce.

Under most state privacy laws, including Connecticut’s, Arkansas’s, and Utah’s, it doesn’t matter where a business is headquartered. What matters is where its customers live.

This story was produced by Clym and reviewed and distributed by Stacker.