By: Linda L. Goodman
Connecticut Attorney General announced a settlement with TicketNetwork, Inc. on July 7, 2025, as a result of an investigation into their violations of the Connecticut Data Privacy Act (“CTDPA”). Under the settlement, TicketNetwork has agreed to comply with the requirements of the CTDPA, maintain metrics for consumer rights requests received under the CTDPA, provide a report of these metrics to the Attorney General, and pay $85,000.
The offense for which they were fined….they ignored a CTDPA “cure notice” sent on November 9, 2023, four months after the law took effect. That notice flagged deficiencies in the company’s privacy notice and gave the company the chance to come into compliance without penalty. In particular, the company’s privacy notice was largely unreadable, missing key data rights, and contained rights mechanisms that were misconfigured or inoperable. Under the CTDPA’s cure period, they had 60 days – until January 8, 2024 – to resolve each deficiency. What did they do – apparently ignored it!
“To date, the Office of the Attorney General has issued four separate “privacy notice sweeps” consisting of over two dozen cure notices in total, all aimed at addressing privacy notice deficiencies. TicketNetwork is the only entity that repeatedly represented that they had resolved deficiencies when they had not done so and failed to timely respond to follow-up correspondence. Nearly all other companies took prompt steps to come into compliance.”
The Connecticut Data Privacy Act gives consumers basic baseline rights, including the right to access, correct, and delete personal data stored and collected by businesses, and the right to opt-out of the sale of personal data and targeted advertising. All businesses need to do is maintain clear privacy notices that describe these rights. This law has now been in effect for two years.
“There is no excuse for continued non-compliance, and we are prepared to use the full weight of our enforcement authority to protect consumer privacy,” said Attorney General Tong.
The CTDPA was one of the first comprehensive consumer privacy laws in the country and took effect on July 1, 2023. The CTDPA was designed similar to the CCPA in California and requires covered businesses to maintain a privacy notice that clearly describes what rights Connecticut consumers have under the law and how consumers may exercise their rights.
The attorney general made clear the CTDPA’s transparency requirements are a crucial component of the law – “these provisions ensure that Connecticut residents have insight into the collection, use, and sharing of their personal data, understand their new data rights, and are able to exercise those rights.” The Office of the Attorney General has continued to review companies’ privacy notices and the functionality of consumer rights mechanisms under the CTDPA. The CTDPA’s cure period expired on January 1, 2025, and the Office of the Attorney General has since begun the process of assessing fines for violations for privacy notice deficiencies.
Lessons?
- Don’t ignore a letter from the Attorney General’s Office; and
- Make sure the mechanism allowing consumers control over their personal information is functional!
____________________________________________________________________________________________________________
This article was originally posted on Cliclaw.com as part of my ongoing efforts to share valuable legal insights. I regularly contribute guest blogs to leading websites in the field of internet compliance. In these posts, I cover a range of topics to help businesses stay compliant in the ever-evolving digital world. You can read my latest guest contributions on Cliclaw.com.
This article is a publication of The Goodman Law Firm and is intended to provide information on recent legal developments. This article does not create an attorney-client relationship, nor should it be construed as legal advice or an opinion on specific situations. This may constitute “Attorney Advertising” under the Rules of Professional Conduct and under the law of other jurisdictions.
Linda L. Goodman is an attorney specializing in internet compliance and privacy law. With years of experience helping businesses navigate complex legal landscapes, Linda contributes expert insights on compliance issues in the digital space. To learn more about her services and insights, visit her law firm website at The Goodman Law Firm.
© 2025 TGLF, A.P.C.