Attorney General Tong Reminds Consumers of Their Right to Opt Out of the Sale of Their Personal Information

Press Releases

01/29/2025

Attorney General Tong Reminds Consumers of Their Right to Opt Out of the Sale of Their Personal Information

(Hartford, CT) — Attorney General William Tong today reminded Connecticut residents of their right to stop or "opt-out" of the sale and sharing of their personal information under the Connecticut Data privacy Act. Along with the attorneys general of California and Colorado, states which also have robust privacy protections, Attorney General Tong encourages consumers to consider familiarizing themselves with the Global Privacy Control (GPC), an easy-to-use browser setting or extension that automatically signals to businesses that they should not sell your personal information to third parties, including for targeted advertising.

“Websites are constantly tracking and collecting our personal information for every purpose you can imagine. In Connecticut, you can now opt out of tracking across all sites by selecting a single simple option. It’s an easy step to take back control over your data and protect your privacy,” said Attorney General Tong.

“Every single one of our online interactions is a robust source of data that broadcasts who we are, what we like, and how we live. Many websites install tracking software that allows third parties to track consumers, use the information they learn to create entire profiles of users, and deploy targeted ads that follow us around our time surfing the web,” said California Attorney General Rob Bonta. “Today, I remind Californians of their right to opt-out and take back control of their personal data. Global Privacy Control is the easiest way to limit the number of third parties that have access to our personal information and online behavioral data. I also encourage mobile device manufacturers to develop an easy, GPC-like feature that consumers can use to signal the right to opt-out.”

Data comes from nearly everywhere online, even when people think they’re not revealing anything. Websites can track and amass personal information and behavioral data like pages visited, time spent on pages, clicks, and detailed purchase information to create and share profiles and inferences about consumers. Apps and other software can collect and transmit sensitive personal information, including a user’s precise geolocation and biometric data. Preventing third parties from receiving this information is a key step to protecting private information and stopping the proliferation of your data in the online ecosystem.

HOW DO I OPT OUT?

Consumers have two options to opt out of the sale of their data:

OPTION 1: Enabling Global Privacy Control

The GPC is a signal that allows users to automatically indicate to the websites they visit that they would like to opt-out of the “sale” of their personal information. The GPC signal is an easy way to opt-out because a consumer does not have to make individualized requests to opt-out on each website they visit. GPC can be downloaded via a browser extension; some browsers offer a GPC setting. Installing GPC is simple and ensures your personal is protected. For information on GPC, please see here.

Click here for a video produced by Wesleyan University’s Privacy-Tech-Lab to show you how to install GPC.

OPTION 2: Opt Out One Business at a Time

Businesses that sell personal information must provide a clear and conspicuous link on their website that allows you to submit an opt-out request. Businesses cannot require you to create an account to submit your request or ask for additional information to process your opt-out.

If you can’t find a business’s link, review its privacy policy to see if it sells or shares personal information for purposes of targeted advertising. If the business does, it must also include that link in its privacy policy. If an opt out link is not working or difficult to find, you may report the business to our office by filing a complaint online with the Office of the Attorney General.

The Connecticut Data Privacy Act

The CTDPA was enacted in July of 2023—one of the first comprehensive consumer privacy laws in the country. Several of the CTDPA’s key provisions have subsequent effective dates, including the critical requirement that controllers honor global opt out preference signals (“OOPS”) sent by consumers. The OOPS provisions allow consumers the ability to opt out of targeted advertising and the sale of their personal data across all activities online in one place.

Connecticut consumers can now send their OOPS through a variety of platforms to “signal” to websites that they are opting out of targeted advertising and the sale of their personal data. Each consumer opt out “signal” will be sent automatically by using, for example, the Global Privacy Control through a privacy protective browser or browser extension. Over 40 million people already use the GPC.

All businesses covered by the CTDPA must respond to a consumer’s OOPS. This signal must be sent from a platform or mechanism that enables the business to accurately determine whether the consumer is a Connecticut resident. If a consumer’s OOPS conflicts with that consumer’s previously given privacy choice or their voluntary participation in that business’s loyalty rewards or discount program, the business must still comply with the OOPS. Though, the business may notify the consumer of the conflicting signals and ask the consumer to confirm their choice with the understanding that it would affect their previously given privacy choice or participation in their loyalty rewards or discount program.

As of January 1, 2025, businesses subject to the CTDPA must treat Connecticut residents’ privacy preferences submitted through browser signals as requests to opt-out of sales or targeted advertising. To implement the GPC, businesses can get started here. Click here for a video produced by Wesleyan University’s Privacy-Tech -Lab showing how businesses can implement global privacy control.

Consumers should note that not all Connecticut businesses are covered by the CTDPA. The law includes specific revenue thresholds and exempts certain industries regulated by other privacy frameworks—such as health care companies subject to the Health Insurance Portability and Accountability Act of 1966 (HIPAA).

For more information about the CTDPA, visit the Attorney General’s FAQ page here.

###

Twitter: @AGWilliamTong

Facebook: CT Attorney General

Media Contact:

Elizabeth Benton
elizabeth.benton@ct.gov

Consumer Inquiries:

860-808-5318
attorney.general@ct.gov