Connecticut AI law requires chatbot safeguards, bans geolocation sales

Connecticut enacts sweeping AI and privacy regulations

Connecticut is preparing to enforce some of the nation's most comprehensive artificial intelligence and data privacy laws, with new regulations taking effect October 1 that target facial recognition technology, chatbot safety, and consumer data control.

The legislation represents a major expansion of the state's existing data privacy framework, according to Connecticut Attorney General William Tong, who noted that Connecticut was among the first states to pass comprehensive data privacy legislation. The new measures significantly broaden those protections as AI becomes increasingly integrated into daily life.

Key provisions of the new laws

The expanded privacy law grants Connecticut residents substantially more control over their personal information. Companies using facial recognition technology will be required to notify consumers and explain how biometric data is collected and used.

The law prohibits the sale of consumers' geolocation data and bans surveillance pricing practices. It also establishes a registry for data brokers, enabling residents to identify which entities hold their information and request deletion.

A separate AI-focused law imposes specific safeguards on chatbot providers. Companies offering chatbot services to both children and adults must implement systems to detect and prohibit encouragement of self-harm, provide parental controls, and ensure chatbots cannot engage in romantic interactions with minors.

"It is almost absurd that we should have to say these things," Tong said, as first reported by WTNH.

Why it matters

Connecticut's approach represents one of the most aggressive state-level efforts to regulate AI technology before potential harms become entrenched. The chatbot safety provisions directly address concerns raised by recent incidents involving AI companions and vulnerable users, while the data broker registry tackles the largely invisible ecosystem of personal information trading. For technology companies operating nationally, Connecticut's rules may preview regulatory trends that could spread to other states, potentially creating compliance complexity but also establishing clearer standards for responsible AI deployment.

Regulatory momentum builds

State Senator James Maroney emphasized that the October 1 implementation marks a starting point rather than a final framework. "This is a start. This is not a finish; this is not a ceiling. This is the floor," Maroney said, signaling lawmakers' intention to continue refining AI regulations as the technology evolves.

Dr. Vahid Behzadan, a cybersecurity expert at the University of New Haven, supported the regulatory approach, arguing that establishing risk mitigation measures represents a necessary first step in governing AI advancement. He noted that informing citizens about potential harms from AI-enabled devices serves an important protective function.

Lawmakers stated their goal is to establish guardrails around rapidly developing technology before regulatory intervention becomes more difficult, prioritizing protection for Connecticut residents as AI capabilities expand.

These details were first reported by WTNH.