To the Connecticut neighbors who have ever wondered how far their personal information has spread. Today, I want to write a somewhat serious but important message like a letter.

Last weekend, I was having coffee with a colleague, and they suddenly showed me their phone. They said their name and old address appeared on a site they had never signed up for.

When they asked, "Can I request to have this deleted?" I couldn't give a proper answer at that moment. So, I decided to look it up myself.

To cut to the chase, Connecticut residents have the right to make a request. The law that supports this is the Connecticut Data Privacy Act, abbreviated as CTDPA.

This law allows consumers to do several things. They can verify whether a company has their information, obtain a copy, correct inaccurate information, and request deletion.

Consumers can also opt out of targeted advertising, the sale of personal information, and some profiling. This will be the most practical option for those who have felt uneasy about ads.

The Attorney General's office has indicated that deletion requests apply not only to information the company has directly received from me but also to information collected through third parties. The scope is broader than expected.

So, how long does a company have to respond? They must respond within 45 days from the date of the request, and they can extend this period by another 45 days if necessary.

So, it can take up to 90 days. Honestly, that feels a bit long, but at least the deadline is set by law.

You might be wondering about the cost; you can make a request for free once every 12 months. If you make repeated requests within the same period, they may charge a fee, so keep that in mind.

To actually delete your data, here's what you need to do. First, find the privacy policy link or something like "Your Privacy Choices" at the bottom of the company's website.

There should be a request form or an email address there. Clearly state that you are a Connecticut resident and that you want your data deleted.

They may require you to verify your identity, so don't be too surprised. However, if they ask for overly sensitive information, it's good to be cautious.

Make sure to capture the date and content of your request. Having a record is the best assurance when calculating the 45 days or if any issues arise later.

If the company denies your request, they must provide a reason and inform you of how to appeal. If the issue remains unresolved even after the appeal, you can report it using the online complaint form from the Attorney General's office.

In the complaint form, select "Consumer Data Privacy" as the subject. If your parents find English daunting, having a child assist them can make it quick.

One more thing, there's good news for those who find it tedious to opt out on every site. Starting January 1, 2025, companies will have to respect opt-out signals sent by browsers.

A notable example is the Global Privacy Control, abbreviated as GPC. If you enable this feature in supported browsers or extensions, your opt-out preference will be automatically communicated to the sites you visit.

This year, many laws have changed. Starting July 1, 2026, the threshold for applicability will be lowered from 100,000 consumers to 35,000.

Companies handling sensitive information will be subject to these regulations regardless of their size. Local small businesses are no longer exempt.

Using minors' information for targeted advertising or sales is now prohibited, regardless of consent. Parents raising children are particularly pleased about this change.

Companies must also disclose whether they use personal information for training large language models, or AI. Given the current climate, this is a necessary provision.

On May 27 of this year, the governor signed SB 4, which became Public Act 26-64. A significant portion of this law went into effect on October 1.

Notably, the sale of precise location data is now prohibited. With some exceptions for public safety or fraud prevention, selling Connecticut consumers' precise location data is illegal.

Data brokers will need to register with the state starting January 1, 2027, and pay $2,500 annually. Finally, there will be a list of who is buying and selling my information.

The most anticipated change is the unified deletion system that will be established by July 1, 2028. With one request, you will be able to demand deletion from all registered data brokers.

Of course, as regulations increase, the burden on companies also grows, so it's understandable that there are opposing voices. Still, considering the reality of individuals having to send emails to dozens of companies, I would like to support this change.

If it were me, I would turn on the browser GPC tonight and submit deletion requests to a couple of frequently used shopping sites. It's better to do it gradually rather than trying to do everything at once and getting overwhelmed.

Finally, I have a question for you all. 1 means you have already made a deletion request, 2 means you are considering it, and 3 means you still find it bothersome. Please just leave the number in the comments.