Connecticut Attorney General William Tong issued a press release on July 8 that announced a settlement with TicketNetwork for violations of the Connecticut Data Privacy Act (CTDPA). Under the terms of the settlement, TicketNetwork has agreed to comply with the requirements of the CTDPA, maintain metrics for consumer rights requests received under the CTDPA, provide a report of these metrics to the Attorney General, and pay $85,000.
According to the state, the Office of the Attorney General first sent a CTDPA “cure notice” to TicketNetwork on November 9, 2023—four months after the law took effect, flagging deficiencies in the company’s privacy notice and giving the company the chance to come into compliance without penalty.
“In particular, the company’s privacy notice was largely unreadable, missing key data rights, and contained rights mechanisms that were misconfigured or inoperable,” the state had found. Under the CTDPA’s cure period, TicketNetwork had 60 days— until January 8, 2024— to resolve each deficiency. TicketNetwork did not resolve these deficiencies well beyond the cure period.
“The Connecticut Data Privacy Act gives consumers powerful baseline rights, including the right to access, correct, and delete personal data stored and collected by businesses, and the right to opt-out of the sale of personal data and targeted advertising. Covered businesses must maintain clear privacy notices that describe these rights. This law has now been in effect for two years. There is no excuse for continued non-compliance, and we are prepared to use the full weight of our enforcement authority to protect consumer privacy,” said Attorney General Tong.
The CTDPA took effect on July 1, 2023. The CTDPA provides several new rights for consumers and requires covered businesses to maintain a privacy notice that clearly describes what rights Connecticut consumers have under the law and how consumers may exercise their rights.
For more information about the CTDPA, visit the Attorney General’s FAQ page here. For more information about the Privacy team’s enforcement efforts, read the published enforcement reports here and here.