The original headline is too long and has a colon. I need to rewrite it to be punchy, under 12 words, preserving key facts.

Short summary

Connecticut's amended Data Privacy Act (CTDPA), effective July 1, 2026, dramatically lowers compliance thresholds and now covers any business processing sensitive data or selling personal data regardless of volume. New obligations include profiling impact assessments, expanded consumer rights, heightened minor protections, LLM training disclosures in privacy notices, and stricter data minimization. Companies that previously fell outside the law's scope—especially small businesses using tracking cookies, ad pixels, or sharing data for AI training—may now be covered and should audit their data practices immediately.

• •Compliance thresholds lowered from 100,000 to 35,000 consumers; any entity processing sensitive data or selling personal data is now covered regardless of volume
• •New obligations include profiling impact assessments by August 1, 2026, LLM training disclosures in privacy notices, and blanket prohibitions on targeted ads to minors aged 13-17
• •Common marketing practices like tracking cookies, ad pixels, and sharing data with AI-training vendors now qualify as 'sales' under the expanded law

Generated with AI, which can make mistakes.