While Congress talks about artificial intelligence, Connecticut is regulating it.
A batch of new Connecticut laws on data privacy and AI took effect October 1, and together they amount to one of the more serious attempts any state has made to govern how algorithms affect ordinary people. Not the abstract, science-fiction version of AI risk that dominates Washington hearings. The practical version: the chatbot your kid talks to at night, the software watching you at work, and the invisible system that decides what price you see when you shop online.
The biggest piece is Public Act 26-64, which expands the Connecticut Data Privacy Act. Consumers gain broader rights to access, correct, delete, and opt out of certain uses of their personal data, including profiling and targeted advertising. The law bans the sale of precise geolocation data outright. And it goes after a practice consumer advocates call surveillance pricing, where companies use your personal data and behavioral tracking to figure out the highest price you, specifically, will tolerate.
Connecticut's approach there is worth savoring. Businesses that use personal data in dynamic pricing may have to post a disclosure along the lines of: 'THIS PRICE WAS INCREASED BY A PRICE SETTING DEVICE USING YOUR PERSONAL DATA.' That is not a warning label anyone's marketing department wants to print, which is rather the point. The law also restricts or prohibits certain personalized pricing practices based on specific consumer data. Separately, businesses that sell or license consumer data will have to register annually with the state beginning January 1, 2027, and Connecticut plans a first-of-its-kind centralized system letting consumers request deletion of their data from registered data brokers in one place.
A second law, Public Act 26-15, targets online safety. Operators of AI companions, meaning chatbots that converse in natural language and sustain relationships across multiple interactions, must disclose at set intervals that users are talking to a machine, build in safeguards for minors, detect and respond to indicators of suicide or self-harm, and restrict manipulative interactions. When an operator knows or has reason to believe a user is a minor, the obligations escalate: parental consent for certain algorithmic feeds, bans on manipulating kids into purchases or prolonged engagement, and prohibitions on romantic or sexually explicit interactions. Connecticut is not alone here. California recently signed SB 1119, known as Adam's Law, which requires companion chatbot operators to verify users' ages or apply child protections to everyone, with penalties up to $15,000 per affected child for intentional violations. A regulatory template for chatbots is clearly forming, and it is forming in state capitols.
Then there is the workplace. Public Act 26-73, effective now, expands Connecticut's electronic monitoring law. Employers must tell workers what types of monitoring may occur, identify the specific workplace locations that may be monitored, post notices in those areas, and give newly hired prospective employees a written statement about which prohibited activities may be monitored without prior warning.
The heavier artillery arrives later. Under Public Act 26-15, most employer obligations around AI in hiring, promotion, discipline, compensation, and termination decisions take effect October 1, 2027. When they do, employers using resume screeners, AI interview analysis, productivity scoring, predictive retention analytics, or automated disciplinary recommendations will need to give applicants and employees advance written notice of the tool's purpose, trade name, and the categories and sources of personal data it analyzes. They will be expected to run pre-deployment risk assessments and post-deployment bias monitoring, and to keep records of how the tools are used and what was done to evaluate fairness.
That one-year gap between the consumer rules and the workplace rules is the most honest part of the whole package. Lawmakers were willing to police how companies treat shoppers immediately, but gave employers a full extra year before they have to tell workers an algorithm is judging them. Even in a state willing to regulate, the boss's algorithm gets a longer runway than the retailer's.
Still, the direction is unmistakable. Delaware just amended its privacy law to require adverse action notices, human review requests, and impact assessments for automated employment decisions, effective January 1, 2027. California's new package includes a No Robo Bosses Act requiring human involvement in AI-driven discipline and termination, plus a ban on workplace tools that collect workers' neural data or predict their emotional state. The federal government has produced no comprehensive equivalent. The rules that will actually govern algorithmic management in America are being written state by state, and they are converging on the same core ideas: notice, human review, and bias testing.
For workers, the practical shift is simple to state and hard to overstate. In a growing number of jurisdictions, your employer will have to tell you, in writing, when software rather than a person is shaping decisions about your career. Millions of people are already evaluated by systems they have never seen. The era of plausible deniability, for employers, is starting to close.
Free Game Takeaway
If you work or shop in Connecticut, you now have concrete rights worth using. You can request access to and deletion of your personal data, and the state's centralized data-broker deletion system launching in 2027 will make that far easier than contacting brokers one by one. If a price online seems personally inflated, that is now a regulated practice, not a paranoid suspicion. Workers should ask HR directly whether AI tools are used in hiring, evaluation, or discipline, because employers now have notice obligations that will only expand through 2027. Everyone else should watch their own state legislature: Connecticut, California, and Delaware are converging on the same model of disclosure, human review, and bias assessment, and that model is the most likely shape of AI workplace rules wherever you live. If you run a business that touches Connecticut consumers or employees, the compliance clock on notices, bias testing, and vendor documentation is already running.