Attorney General Tong to Big Tech: Hooking Kids on Addictive Apps is Illegal in Connecticut

Press Releases

07/02/2026

Attorney General Tong to Big Tech: Hooking Kids on Addictive Apps is Illegal in Connecticut

(Hartford, CT) - Attorney General William Tong issued new guidance today on expanded Connecticut privacy protections set to go into effect on July 1, including major new rights and safeguards for kids online.

Effective July 1, under the Connecticut Data Privacy Act, the following rights and safeguards apply for kids online:

• Processing minors' personal data for targeted advertising or sale is prohibited.
• Use of addictive design features aimed at extending minors' use of an online service is prohibited.
• Controllers cannot collect minors' precise geolocation data unless such data is strictly necessary to provide the online product or service
• Controllers must obtain consent prior to processing minors' personal data for profiling.
• Direct messaging applications must include default settings that prevent adults from sending unsolicited communications to a minor.

Additional measures to combat youth social media addiction were enacted this year are set to go into effect in 2028. Those include a ban on algorithms without parental consent. The law also establishes a series of default settings regarding account privacy, time of use, and notifications, including barring notifications between the hours of 9:00 p.m. and 8:00 a.m. Parental consent would be required to alter the default settings. The bill also requires a warning label pop-up when a minor opens a social media app informing them of the mental health dangers social media proposes.

"For too long, Big Tech has treated our children like social media cash cows. Connecticut is now taking matters into our own hands with protections that limit harmful data collection, curb addictive features, and give families the control they need to keep children safe online," said Attorney General Tong. "Connecticut has one of the strongest data privacy laws on the books, and we will use every inch of our authority to protect our kids online. We're investigating Roblox and TikTok, we've sued Meta, and there should be no doubt that we are serious."

In addition to new strong default protections, the legislation requires social media companies to annually report to the state the number of minors on their platform, the number of minors with parental consent to use addictive algorithms, and the average amount of time per day a minor spends on the platform, broken down by both age and time of day.

Attorney General Tong is committed to using the full extent of his law enforcement authority to protect kids online. In May, Attorney General Tong announced an investigation into the online gaming and chat platform Roblox following widespread reports of child exploitation and harm. Attorney General Tong has sued Meta, alleging that the company knowingly designed and deployed harmful features on Instagram and its other social media platforms that purposefully addict youth. A New Mexico jury recently found Meta liable for similar consumer protection violations, delivering $375 million in civil penalties. Connecticut's investigation into TikTok over similar allegations is active and ongoing.

Additional Connecticut Data Privacy Act Protections Go Into Effect July 1

The CTDPA has been in force since July 1, 2023-one of the first comprehensive consumer privacy laws in the country. Three years in, several of the CTDPA's key provisions have undergone significant updates that benefit Connecticut residents and expand upon the obligations required of covered businesses, making it one of the strongest state privacy laws on the books.

The CTDPA will apply to new businesses

The CTDPA will now apply to businesses that conduct business in Connecticut or target Connecticut residents and control or process the personal data of at least 35,000 Connecticut residents (outside of payment transactions). Further, the CTDPA will now apply to any business that sells personal data or processes sensitive data (outside of payment transactions).

The definition of sensitive data has expanded

"Sensitive data" now includes: data that reveals disability or treatment; status as nonbinary or transgender; information derived from genetic or biometric data; personal data collected from an individual the controller has actual knowledge, or willfully disregards, is a child; neural data; certain financial information (including financial account numbers in combination with security code or password); and government-issued identification information (including Social Security numbers, passport numbers, and state identification card numbers). This is important because sensitive data has heightened protections under the CTDPA and controllers must obtain affirmative opt-in consent before processing it.

New consumer rights

Connecticut residents will now have the right to: (i) obtain a list of all third parties to which a business has sold their personal data; (ii) access inferences drawn from their personal data; and (iii) know whether a controller is processing their personal data for purposes of profiling to make a decision that produces any legal or similarly significant effect concerning the consumer.

Where the profiling decision is made through automated means, consumers may (where feasible): (i) question the results of such profiling; (ii) learn the reasoning behind the decision(s) made; (iii) review the personal data elements used to conduct the profiling; and (iv) for housing-specific profiling decisions, correct any incorrect personal data used in the processing and have the decision reevaluated.

For more information about the CTDPA, visit the Attorney General's FAQ Page.
For a summary of actions undertaken in 2025 to enforce compliance, see here: 2025 report under the Connecticut Data Privacy Act (CTDPA).

###

Media Contact:

Elizabeth Benton [email protected]

Consumer Inquiries:

860-808-5318 [email protected]

• Twitter
• Facebook
• Email
• Print