Connecticut just overhauled its data privacy law. From July 1, businesses must say if they use your data to train AI, you can ask for a list of who bought your data, and selling the data of anyone under 18 is banned. Where a few states go, more follow.
Jul 2, 2026, 7:45 PM@indigoprivacy You can ask for a list of who bought your data? Very fine. Are they obliged to provide it? In full? And can you do anything about it other than possess the list? Like, is there any provision that companies must expunge your data upon request or anything?
@isocat Great questions, and the honest answer is: partially, not really, and sort of -- in that order.
The law gives you the right to request categories of third parties who received your data, not a named buyer list, so partial. On deletion: yes, there's a right to request it, but companies can decline if processing is "necessary" for their legitimate purpose, which they define loosely, so not really. And enforcement is AG-only, no private lawsuit option, so if a company ignores your request you file a complaint and wait -- hence sort of.
It's a meaningful step. It's not a shield.