Connecticut Announces Its First Privacy Fine
The $85,000 settlement with TicketNetwork is the first of its kind from a state other than California. Learn the key requirements and how to prepare.
With a recent announcement from Attorney General William Tong, Connecticut became the first U.S. state besides California to impose a fine for violations of the state’s comprehensive data privacy law. The target of the enforcement action was TicketNetwork, an online ticket reseller. The case was settled for $85,000.
Here’s what we learned from the state’s announcement.
What Did TicketNetwork Do Wrong?
Unfortunately, the statement from the attorney general’s office does not offer much detail as to what TicketNetwork is alleged to have done wrong. It does tell us that the company privacy policy was:
- “Largely unreadable,”
- “Missing key data rights,” and
- “Contained rights mechanisms that were misconfigured or inoperable”
While we’d love to know in more depth what all of this means (for instance, how bad does a privacy policy have to be in order to be “unreadable”?), but the takeaway seems to be that TicketNetwork’s problems were far-ranging and the site was non-compliant in a general way. As AG Tong said, “This law has now been in effect for two years. There is no excuse for continued non-compliance.”
Timeline for Enforcement
The attorney general’s office first contacted TicketNetwork in November 2023, giving the company 60 days to cure any alleged violations. The cure period expired in January 2024, meaning the case took approximately 18 months to resolve.
This squares with a statement from the California Privacy Protection Agency’s deputy director for enforcement, indicating that the average time needed to resolve a consumer protection case is 18 months. It also explains why, after an initial lull, we are starting to see a dramatic uptick in enforcement.
Businesses should also keep in mind that, while TicketNetwork had a mandatory 60-day cure period to fix any violations, the CTDPA’s cure-period provision expired on January 1, 2025. The state can now proceed directly to enforcement with no warning.
Nationwide Privacy Compliance
There are already over a dozen different state privacy laws in effect in the United States, with more on the way. Without a dedicated privacy professional on staff, keeping up with all of these laws and their amendments is unmanageable for many businesses. However, as enforcement increases, it is more important than ever to stay current with the legal landscape.
TrueVault helps businesses of all sizes manage all sides of privacy compliance. Through a combination of guided workflows, vendor integrations, and close product support, you can get your business privacy-compliant in a matter of days, not months. Best of all, TrueVault US customers get new states added to their privacy center when they go into effect, at no extra cost!
Contact our team today to learn how TrueVault can help your business get compliant.
Privacy work that stays current — without adding more chaos.
TrueVault helps lean ecommerce teams keep privacy workflows current as vendors, tracking tools, and privacy laws keep changing.
