Privacy CompliancePrivacy Notices
Connecticut Privacy Notices Need an AI Training Statement. Does Yours?
Since July 1, 2026, Connecticut requires a privacy notice to state whether the business collects, uses, or sells personal data to train large language models. The statement appears to be required regardless of whether the answer is yes or no, so a notice that is silent on the topic may be at risk.
By Alex Proctor
Published September 22, 2026
Summary
Connecticut amended its privacy law, effective July 1, 2026, to require a new statement in the privacy notice. The notice has to disclose whether the company collects, uses, or sells personal data to train large language models. The wording suggests that the statement is required whether the answer is yes or no, but no company has been cited for leaving it out yet. The same amendment lowered Connecticut's coverage threshold, so a company that was out of scope in June may be covered today.
What Does Connecticut Require?
The requirement comes from Public Act 25-113, which amended the Connecticut Data Privacy Act. A privacy notice now has to include "a statement disclosing whether the controller collects, uses or sells personal data for the purpose of training large language models."
The statute uses the word "whether," which suggests that a company that does not train models on personal data still has to say so. I want to be careful here, because no company has been cited for leaving the statement out yet. However, a missing statement is easy for a regulator to find. Adding a truthful "no" costs nothing.
What Else Did the Amendment Add to the Notice?
The AI training statement arrived with several other changes to the notice:
| Notice item | What Connecticut requires |
|---|---|
| AI training statement | Say whether personal data is collected, used, or sold to train large language models |
| Date of last update | Show the most recent month and year the notice was updated |
| Languages | Offer the notice in each language in which the product or service is provided |
| Material changes | Notify affected consumers of a retroactive material change and let them withdraw consent |
Connecticut Public Act 25-113, effective July 1, 2026.
Who Is Covered Now?
More companies than before. Connecticut has about 3.7 million residents. It dropped its threshold from the personal data of 100,000 consumers to 35,000, which is just under 1 percent of the state's population. There is now no minimum at all for a company that processes sensitive data or offers personal data for sale.
Precise location is sensitive data under the statute. A retailer or an app that collects precise location from Connecticut residents may therefore be covered regardless of its size. A company that was out of scope in June may be covered today.
What Counts as Training a Large Language Model?
The statute does not define the term, and the Connecticut Attorney General's office has not yet explained what it covers, so this section reflects my interpretation. The statement covers three activities, which are collecting, using, and selling personal data for the purpose of training.
A company that trains or fine-tunes its own model on customer data is clearly covered. So is a company that sells or licenses customer data to a model developer. The less obvious case is a company that sends customer data to an AI vendor whose terms allow the vendor to train on it. Whether that counts may depend on the contract, which is one reason I treat vendor terms as an AI risk for ordinary businesses.
A company that wants to train a model on personal data it already holds has a second requirement to meet. Connecticut requires consent before personal data is processed for a material new purpose. Updating the privacy notice would not satisfy that requirement by itself.
Do Other States Require This?
Vermont is the only other state so far. Its new privacy law, Act 145, requires an identically worded statement and takes effect on January 1, 2028.
Other AI disclosure requirements exist, but they may need to be placed outside the privacy notice. Several states require a chatbot to disclose that the user is talking to AI, and California will require a notice before certain automated decisions starting in 2027. A company that uses AI with customer data may owe more than one of these.
What Should the Statement Say?
A company that does not train models on personal data can meet the requirement with one sentence, such as "We do not collect, use, or sell personal data to train large language models." The sentence should cover all three verbs in the statute. A statement that addresses only "use" leaves collection and sale unanswered.
A company that does train models should say so and name the specifics. Those are the categories of personal data involved and whether the data goes to the company's own model or to an outside developer.
The statement has to remain accurate after it is published. Regulators test the claims in a privacy notice against what the business does. A company that answers no and later adopts an AI tool that trains on customer data has an inaccurate notice. The answer should be checked each time the company adds an AI vendor, renews an AI vendor's contract, or changes the data it sends to one.
Questions
Does a company that does not train AI models still need the statement?+
On a plain reading, yes. The statute requires a statement disclosing whether the company collects, uses, or sells personal data to train large language models, and the word whether covers both answers. No regulator has cited a company for omitting it yet, so this is a reading of the text and not a ruling.
Does the requirement apply to companies outside Connecticut?+
Yes, if the company does business in Connecticut or targets its residents and meets one of three conditions. The company handles the personal data of at least 35,000 Connecticut consumers, processes any sensitive data, or offers personal data for sale. Precise location counts as sensitive data, so the second condition reaches many companies that do not think of themselves as covered.
Do other AI disclosures belong in the privacy notice?+
Sometimes, but not always. Connecticut's AI training statement belongs in the privacy notice, and Vermont will require the same statement in 2028. Other requirements point elsewhere, such as chatbot disclosures that appear in the chat itself and California's notice before certain automated decisions, which is given at the point of use from 2027. A privacy notice can still describe those practices even when the law places the formal disclosure somewhere else.
Briefings are informational and do not constitute legal advice.
Using AI with customer data?
I'll check what your privacy notice says about AI.
Website Privacy Audits include a detailed video review of your live site, a written report for your team or counsel, and a remediation review call. Priority audits add 72-hour delivery and testing of demand letter claims.
Standard $449. Priority $649.
My audits are most useful when you have a consent management setup to validate, a demand letter with specific claims to assess, or a team or client that needs an external web privacy expert. If you already know you have major gaps, your budget may be better spent addressing them directly. I recommend Captain Compliance, the platform I help build, for privacy technology needs.