AN ACT CONCERNING CONSUMER PRIVACY AND PROTECTION.

The definition of 'brokered personal data' now requires that a data broker 'obtains from a third party' before categorizing or organizing the data. This narrows the scope by excluding data brokers who generate or collect their own data rather than obtaining it from another source.

The definition of 'participating consumer' now requires a 'verified deletion request' rather than simply a 'deletion request.' Only consumers whose requests are verified by the Commissioner become participating consumers, which affects when data brokers must delete versus retain data.

Section 2(a) now explicitly states that the registration requirement applies 'on or after January 1, 2027,' clarifying that while the section takes effect October 1, 2026, the actual prohibition on unregistered sales begins January 1, 2027.

The application disclosure requirement in Section 2(c)(1) now requires 'an actively monitored electronic mail address and telephone number' rather than just an email address and phone number, ensuring data brokers maintain reachable contact information.

Section 2(c)(4) changed the conjunction from 'and' to 'or' between collecting minors' personal data and collecting precise geolocation or reproductive/sexual health data. Data brokers must now disclose if they collect either type, not both.

The deletion mechanism in Section 5 was substantially restructured. Verification of deletion requests is now performed by the Commissioner of Consumer Protection (or authorized agent) rather than by each individual data broker. If the Commissioner cannot verify a request, all non-excluded data brokers may retain the consumer's data but must process it as an exercise of the consumer's opt-out right under section 42-518(a)(5)(B). Data brokers now only need to check whether they are specifically excluded from verified requests.

The exemption in Section 7(a)(3) for businesses with existing consumer relationships was narrowed. The broad 'customer, subscriber or user of goods or services' language was removed and replaced with a focus on contractual relationships, investors, donors, and similar relationships. The phrase 'is or was' was added, extending the exemption to past relationships.

A new exemption was added in Section 7(a)(5) for 'a business collecting data used for purposes of the regulation of listed chemicals as set forth in 21 USC 830,' exempting certain chemical safety and regulatory data collection from the act.

The safe harbor for unregistered data brokers in Section 7(b) was significantly modified. Publicly available information, government records, and health/safety alert services are now combined into a single category, but with important carve-outs: the safe harbor does NOT apply if such information is 'collated and combined to create a consumer profile' made available on a publicly accessible website (for compensation or free), or if it is 'used to generate inferences with respect to consumers.' This closes a potential loophole where data brokers could aggregate public records into consumer profiles without registering.

The bill title was changed from 'AN ACT CONCERNING CONSUMER PRIVACY' to 'AN ACT CONCERNING CONSUMER PRIVACY AND PROTECTION,' reflecting the broader protective scope of the legislation.