Connecticut Bans Geolocation Data Sales, Vermont Moves to Become 24th State with Comprehensive Privacy Law

Want to receive these privacy recaps in your inbox each week? Subscribe here.

Connecticut’s Governor has signed SB 4 into law, introducing changes to the state’s privacy framework, including an outright ban on selling precise geolocation data, new protections for genetic testing and facial recognition, and a tightened purpose limitation standard, with the earliest provisions taking effect October 1, 2026. 

Meanwhile, Vermont’s S. 71 has passed the legislature and, if signed, would make Vermont the 24th state with a comprehensive privacy law, distinguished by uniquely broad coverage triggers and one of the widest definitions of sensitive data in the country, including neural data and government-issued identification documents.

Keep reading to learn more and discover my takeaways.

United states

Connecticut Governor Signs Privacy Amendments.

Connecticut SB 4 was signed into law with earliest provisions taking effect October 1, 2026 (some requirements take effect on a staggered timeline through 2028). Two additional bills amending SB 4 (HB 5222 and HB 5563) have passed both legislative chambers and have been sent to the Governor, who has not yet signed them. 

Taken together (assuming all three are signed), the bills make significant substantive changes to Connecticut’s privacy framework, including: lowering the purpose limitation threshold by removing the word “material,” so that any new processing purpose (not just a material one) now triggers the existing five-factor compatibility analysis; adding an outright ban on the sale of precise geolocation data regardless of consumer consent; creating a data broker registration and accessible deletion mechanism; adding specific protections for direct-to-consumer genetic testing (including a consumer property right in biological samples and separate consent requirements for third-party sharing and research use); imposing a written disclosure and acceptance requirement for large subscription-based GenAI platforms; and creating operational requirements for companies using facial recognition technology under the law’s security exemption.

TAKEAWAY

With provisions taking effect as early as October 1, 2026, companies may need to take some or all of the following actions: 

1. Determine whether the company qualifies as a “data broker” under Connecticut’s definition, which differs from California’s.
2. Revisit purpose limitation practices; the removal of “material” means any new use of previously collected data now triggers the five-factor analysis.
3. If selling or sharing precise geolocation data, assess whether that practice must stop entirely, as the ban applies even with consumer consent. 
4. Re-evaluate privacy notices, consent flows, and data processing agreement workflows; and
5. If applicable, implement sector-specific controls for genetic testing, facial recognition, or subscription-based AI services.        

Vermont Sends Comprehensive Privacy Bill to Governor.

Vermont S. 71 passed the legislature in an amended form from its original version. If signed by the Governor, Vermont will become the fourth state this year and the 24th state overall with a comprehensive privacy law, taking effect on January 1, 2028.

TAKEAWAY

Although many provisions of the Vermont law borrow from other states (most notably Connecticut and Maryland), Vermont’s applicability structure and scope of sensitive data set it apart. Vermont’s applicability threshold has three independent triggers, any one of which is sufficient: 

35,000 or more consumers annually; 

3,000 or more consumers whose sensitive data is processed; or 

3,000 or more consumers whose personal data is offered for sale. 

A separate no-threshold provision also applies specific obligations to any controller processing personal data that is or may be used for health care decisions, regardless of consumer volume. This makes Vermont the only state with a comprehensive privacy law that uses an activity-based coverage trigger entirely independent of scale. 

Vermont’s sensitive data scope is among the broadest of any state, and notably includes neural data and government-issued identification documents. While these categories are no longer unique to Vermont (Connecticut and California also include government-issued IDs, and Connecticut, California, and Colorado also cover neural data), Vermont’s neural data coverage carries no limiting qualifier, whereas the other states require either an identification purpose (Colorado) or exclude inferred data (California). Vermont is also the only state whose purpose limitation standard uses a “material new purpose” formulation, borrowing Connecticut’s five-factor framework while retaining the “material” threshold that Connecticut removed in its 2026 amendments.    

A LITTLE MORE PRIVACY, IF YOU PLEASE

• Opening up the server-side black box: Introducing Event Consent Monitoring
• Which industry has the highest consent rate in Europe in 2026?
• Alabama Personal Data Protection Act (APDPA): Everything you need to know

A Little Privacy, Please weekly recaps are provided for general, informational purposes only, do not constitute legal advice, and should not be relied upon for legal decision-making. Please consult an attorney to determine how legal updates may impact you or your business.