SB 893 would extend to Connecticut consumers the right to know the information companies have collected about them, the right to delete that information, and the right to stop the disclosure of certain information to third parties, with additional rights for sensitive data.
New protections are long overdue: consumers are constantly tracked, and information about their online and offline activities are combined to provide detailed insights into a consumers’ most personal characteristics, including health conditions, political affiliations, and sexual preferences. This information is sold as a matter of course, is used to deliver targeted advertising, facilitates differential pricing, and enables opaque algorithmic scoring—all of which can lead to disparate outcomes along racial and ethnic lines.
But we offer several suggestions to strengthen the proposed bill to provide the level of protections that Connecticut consumers deserve. At the very least, SB 893 should be modified to bring it up to the standard of the California Consumer Privacy Act (CCPA), which was recently strengthened by the passage of Proposition 24, the California Privacy Rights Act (CPRA). In particular, the CCPA as refined by CPRA takes important steps such as adding to the statute a requirement to honor browser privacy signals as an opt out (previously it was required by regulation) and removing the “right to cure” provision in administrative enforcement. The CCPA also includes authorized agent provisions so that consumers can delegate third parties to exercise rights on their behalf, which should be replicated in this bill.