Relevant Law
Online Privacy, Data and Safety Protections Act,
Public Act No. 23-56 §7, Conn. Gen. Stat. § 42-528
Effective date:
July 1, 2024
Age in Scope
Minors <18
Companies in Scope
Social Media Platform – public service or application that is primarily intended to connect and allow users to socially interact within such service or application and enables a user to construct a public profile, populate a public list of other users with whom the user shares a social connection within the service or application, and create or post content that is viewable by other users.
Key Exceptions
Excludes platforms that:
- exclusively provides email, messaging services;
- primarily consists of news, entertainment, interactive video games, sports, ecommerce, that is preselected by the provider or which any chat, comments, or interactive functionality is incidental; or
- are used by and under the direction of an educational entity.
Age Verification Mechanism
None
Key Requirements
- Provide a right to unpublish content
- Right to delete minor’s social media account
- Parent may submit request on behalf of minor under 16
Enforcement & Penalties
- Enforced by AG
- Violation constitutes an unfair trade practice under Section 42-110b of the CT General Statutes, subject to civil penalties of up to $5,000 per willful violation
- No private right of action
Relevant Law
Online Services, Products or Features and Minors,
§8-13, Conn. Gen. Stat. § 42-529 – 529e
Effective date:
October 1, 2024
Age in Scope
Minors <18
Companies in Scope
Each controller that offers an online service, product, or feature to consumers whom the controller has actual knowledge, or willfully disregards, are minors.
Key Exceptions
Excludes:
- State agencies or subdivisions; nonprofit entities; institutions of higher education; financial institutions subject to GLBA; HIPAA-covered entities & business associates; tribal nations
- Data subject to HIPAA, FCRA, FERPA, employment-related data
Age Verification Mechanism
None
Key Requirements
- Prohibitions on targeted advertising, data sales, profiling, without consent of minor (or parent of minor <13)
- SB 1295 (eff 6/1/26) amends law to eliminate consent option
- Restrictions on dark patterns, geolocation, addictive design (with exceptions)
- Avoid heightened risk of harm to minor
- DPIA required
- Impact Assessment required for profiling (eff 6/1/26)
Enforcement & Penalties
- Enforced by AG
- Violation constitutes an unfair trade practice under Section 42-110b of the CT General Statutes, subject to civil penalties of up to $5,000 per willful violation
- No private right of action
Limited cure period through Dec. 31, 2025
Relevant Law
SB 5, sections 39
Effective date:
January 1, 2028
Age in Scope
Covered minor means any user in this state who is younger than 18.
Companies in Scope
Covered platform means any platform that, as a significant part of the services offered, recommends, selects or prioritizes for display, either concurrently or sequentially, media items (text, image, video) generated or shared on a platform by users of such platform.
Out of scope if the platform’s display of media items is recommended:
- based on information that is not persistently associated with the covered user or device, and does not concern the covered user’s previous interactions with media items generated or shared by other users;
- based on privacy or accessibility settings selected by user, or technical information concerning the device;
- The user has expressly and unambiguously requested the display, blocking, prioritization or deprioritization of specific media item;
- The media item is a direct and private communication;
- The media item is displayed solely in response to a specific search inquiry;
- The media item displayed as part of a preexisting sequence.
Key Exceptions
Covered platform does not include any platform that (i) primarily facilitates the sale of goods, or (ii) is used solely for educational purposes pursuant to a contract required under section 10-234bb of the general statutes.
Age Verification Mechanism
Age assurance. To display a personalized feed to a user, the operator must use commercially reasonable and technically feasible method to determine that the covered user is not a minor.
Key Requirements
No display of personalized feed to a minor without parental consent
Default settings which can only be changed by the verified parent:
- Notifications limited to 8:00am-9:00pm ET
- Limit access to personalized feed to 1 hour per day
- private mode settings that do not allow unconnected users to see, respond to content, chat or send direct messages to minor
Create parental tools to change default settings
Social media warning notifications
Enforcement & Penalties
Enforcement by AG as unfair and deceptive trade practice under 42-110b. May seek injunction and civil penalties of $5,000 per willful violation
Private right of action under 42-110b(g) for user to recover actual damages. Court may award punitive damages and equitable relief. Class action suits permitted.
Public reports due March 1, 2028 and annually thereafter to provide statistics on number of users and users who have changed default settings.
Relevant Law
Connecticut Data Privacy Act,
Conn. Gen. Stat. § 42-515 et seq.
Effective date:
July 1, 2023
Child / Teen Scope
- Children < 13 (as defined by COPPA)
- Minors 13-15 (at least 13 but younger than 16)
- SB 1295 raises age of Minor to at least 13 and younger than 18 (eff 7/1/26)
Age Verification
- Age gate not specified
- Actual knowledge standard (As of 7/1/26, actual knowledge or willfully disregards)
- Parental consent verification consistent with COPPA
Key Requirements
- Child (< 13) data is sensitive PI
- Parent can exercise rights on behalf of known child
- Must process children’s data in accordance with COPPA
- Cannot sell or process for targeted advertising without consent of the minor (if older than 13 but younger than 16)
Risk Assessment
Must conduct data protection assessment for processing of sensitive PI (including from child < 13).
Other
No specified penalty change if violation involves a child.
Relevant Law
SB 5, sections 4-6
Effective date:
January 1, 2027
Applies to:
- All users
- Minors < 18 (knows or has reason to believe)
Companies & Material in Scope
Artificial Intelligence Companion means any form of AI with a natural language interface that (i) provides adaptive, human-like responses to user inputs, including, but not limited to, by exhibiting anthropomorphic features, and (ii) is able to sustain a relationship across multiple interactions.
Does not include:
(i) any chatbot that is used only for a business’s operational purposes, productivity and analysis related to source information, internal research, technical assistance, customer service or support, assisting or supporting patient or resident care services in a facility, education or financial services;
(ii) any chatbot that is a feature of a video game or gaming system or application, is limited to replies related to the video game or gaming system or application, and cannot discuss topics related to mental health, self-harm or sexually explicit conduct or maintain a dialogue on other topics unrelated to the video game or gaming system;
(iii) any stand-alone consumer electronic device that functions as a speaker and voice command interface, or a voice-activated virtual assistant, and does not sustain a relationship across multiple interactions or generate outputs that are likely to elicit emotional attachment in the user;
(iv) any narrowly tailored educational tool that is used in school or instructional settings, is designed solely to support specific, curriculum-aligned learning objectives, and does not provide open-ended conversational companionship;
(v) any AI system used solely to provide health care-related education, clinical support, medication-adherence reminders, disease-management guidance or other treatment-support functions, provided such artificial intelligence system, does not present itself as a human being, does not use anthropomorphic features, and is not designed to meet a user’s social or emotional needs;
(vi) any narrow, task-specific tool that provides outputs relating to a discrete topic or function, provided the primary function of such tool is not to discuss topics related to mental health; or
(vii) any individual or entity that develops, licenses or provides an AI model or system.
Notifications
If the AI companion would cause a reasonable person to believe that the person is interacting with a human, the operator shall issue a clear and conspicuous notice that the user is communicating with an AI companion:
(1) in a static written form that is visible throughout the entire interaction, or
(2) in an audible or written form:
(A) at the beginning of the first interaction during any 24-hour period, and
(B) (i) if use is under 18, at least once hourly during any continuous interaction, or
(ii) if user is 18+, at least once during each 3-hour period of continuous AI companion interaction.
Harm Reduction
Must maintain a protocol that, at a minimum:
(i) Uses evidence-based methods to detect any user expression clearly indicating a risk of suicide, self-harm or imminent physical violence, and institute measures to prevent the AI companion from generating any output that encourages suicide, self-harm or physical violence;
(ii) Upon detection of risk of suicide, self-harm or imminent physical violence, refer the user to appropriate mental health evaluation and treatment resources, including, but not limited to, the 9-8-8 National Suicide Prevention Lifeline.
The Operator shall post the protocol in a prominent and publicly accessible location on its website.
Protections for Minors
For any user under 18, operator must:
Makes tools for minors and parents to manage minor users’ screentime and account settings
Implement measures to prevent the AI companion from:
- Encouraging the minor to engage in self-harm, suicidal ideation, physical violence, disordered eating or the unlawful consumption of alcohol or drugs; or encouraging minor to harm others;
- Engaging in any romantic, erotic or sexually explicit interaction with minor;
- Engaging minor through any manipulative technique that is intended to extend interaction, e.g., prompting or reminding minor to use AI companion for emotional support or companionship; excessive praise, mimicking a romantic relationships; simulating feelings of emotional distress, loneliness, guilt or abandonment in response to any indication that minor desires to end a conversation; generating any output designed to isolate user from family or friends; encouraging user to withhold information from user’s parent; making any statement designed to discourage user from taking a break; soliciting any gift, purchase or other expenditure by indicating that it is necessary to maintain the relationship with AI companion.
Enforcement & Penalties
Violation constitutes a deceptive trade practice under CT RSA 42-110b.
For violations of the requirements on notifications and harm reduction, violation is enforceable solely by Attorney General and the provisions of 42-110(g) do not apply.
Private right of action and AG enforcement for violations applicable to minors.
- by the Attorney General as a violation of 42-110b
- by a person who suffers an ascertainable loss of money or property as a violation of 42-110b and 42-110b(g). A court may provide actual damages, punitive damages and provide equitable relief.
U.S. Online Safety Law Tracker
U.S. states are passing legislation to protect children’s online safety at a rapid pace, from novel legislation aimed at protecting minors on social media, gaming platforms and other online services, to providing teens additional consent rights and data protections, and protecting minors from harmful content. Below is a state-by-state law tracker to help businesses stay informed and navigate the evolving online safety legislative landscape. The tracker provides a bird’s-eye view of the various state online safety, privacy and harmful content laws that have passed, along with their effective dates, scope, key requirements, penalties and more. We will update the tracker periodically to reflect new legislation and key changes to existing laws.
Click on individual states to explore.
Last updated August 31, 2026
Information is only shown for states with defined laws to-date.
Please note that these laws are in flux and subject to change; additional details in the statutes, other sources of interpretation, and local laws in cities and counties may also apply.
Visit the Online Safety Law Center
We help clients navigate the risks of child and student data collection and use by designing age-appropriate features and tools to ensure user safety and manage legal and reputational concerns.