You unbox a new smart speaker or a connected toy for your child, peel off the plastic, and plug it in. Before the device even finishes its first boot sequence, you are usually tapping through a series of “I agree” prompts on a smartphone app—a digital ritual performed on autopilot. By July 1, 2026, that experience in Connecticut will look fundamentally different.
Connecticut Public Act 25-44, signed into law on June 3, 2025, makes the state the first in the U.S. to mandate that manufacturers disclose the presence of cameras and microphones before a consumer even activates their device. The legislation applies to a broad range of internet-connected home appliances, televisions, and toys equipped with cameras or microphones. According to a 2026 survey by Reviews.org, 45% of people already believe their smart home devices are listening or watching without their knowledge, while 65% express concern about the role of AI assistants like Alexa, Gemini, ChatGPT, and Siri in their daily lives.
Under these new rules, providers must prominently display a disclaimer detailing the device’s ability to transmit recordable audio and video to the manufacturer or third parties. Most significantly, the law requires that consumers be given the option to decline the activation of these cameras and microphones during the initial setup process. Furthermore, the law prohibits companies from using or selling recordings for targeted advertising unless the consumer explicitly opts in, and it mandates that manufacturers implement reasonable security measures to protect any personally identifying information they collect.
The legal teeth behind these requirements are sharp. Violations are classified as per se violations of the Connecticut Unfair Trade Practices Act (CUTPA). This is a crucial distinction; it means the state does not need to prove that a company engaged in deceptive practices to secure a penalty. The mere failure to comply with these specific disclosure and opt-out requirements is enough to trigger enforcement. The Connecticut Attorney General can levy civil penalties of up to $5,000 per willful violation, with fines reaching $25,000 for violating a court restraining order.
Connecticut Attorney General William Tong emphasized the scope of this authority in a statement regarding the bill’s passage: “I am extremely grateful to the House for passing SB3 and for empowering my office with new means of protecting Connecticut residents from illegal and predatory business practices.”
While this puts Connecticut at the forefront of consumer privacy, the state’s approach is distinct from existing regulations elsewhere. California’s SB-327, enacted in 2020, focuses on requiring reasonable security features for connected devices, while Oregon’s HB 2395 covers consumer IoT devices but lacks the specific pre-activation disclosure and opt-out mandates found in the Connecticut statute. Colorado, by contrast, currently has no IoT-specific legislation.
The industry now faces the logistical challenge of redesigning setup flows and privacy interfaces to accommodate user choice. Robert Langer, a senior counsel at Wiggin and Dana who has analyzed the implications of PA 25-44, notes that the compliance burden is significant. His firm is advising clients on how to navigate the specific requirements of the new CUTPA landscape for connected devices, highlighting that manufacturers must now integrate these privacy disclosures directly into the user experience rather than burying them in lengthy terms of service.
Even with these protections, the law carries a notable limitation: it relies entirely on the Attorney General for enforcement. There is no private right of action, meaning individual consumers cannot sue manufacturers directly for these specific tech violations. This leaves the burden of policing the industry solely on the state’s regulatory office, rather than empowering the people the law is meant to protect.
For now, the 55% of consumers who—according to the 2026 Reviews.org survey—have already taken the initiative to adjust privacy settings on their connected devices are ahead of the curve. As the July 2026 deadline passes into enforcement, the rest of the market will be forced to catch up, turning the “I agree” button into a more informed choice.