On July 8, Connecticut Attorney General William Tong (“CT AG”) announced an $85,000 settlement with TicketNetwork, Inc., following an investigation into alleged violations of the Connecticut Data Privacy Act (CTDPA).1 In this first-of-its-kind enforcement action, the settlement required TicketNetwork to enhanceits privacy notice by altering formatting and styling to make it easier to understand, maintain metrics for consumer rights requests and provide those metrics to the CT AG’s Office, and pay a penalty of $85,000. This action is the first taken under the CTDPA, and highlights continued state-led enforcement of privacy laws.
On November 9, 2023, the Office of the CT AG issued a CTDPA “cure notice” to TicketNetwork, identifying several deficiencies in its privacy notice. As outlined in the notice, TicketNetwork’s privacy policy was “largely unreadable,” omitted key data rights disclosures required under the CTDPA, and contained misconfigured or inoperable rights exercise mechanisms. Under the CTDPA’s cure period, TicketNetwork had 60 days to resolve each deficiency. However, according to CT AG, TicketNetwork did not resolve these deficiencies until well beyond the cure period.
The TicketNetwork enforcement action comes as part of a “privacy notice sweep,” in which more than two dozen cure notices were sent by the CT AG’s office to companies covered under the CTDPA. According to CT AG, TicketNetwork was the only entity that failed to respond in a timely manner to correspondence from the CT AG, and also the only entity which repeatedly misrepresented their progress toward correcting identified deficiencies.
The enforcement action shows continued privacy enforcement scrutiny by CT AG. The findings of non-compliance by CT AG can also be used as a basis for other complaints by private plaintiffs under consumer privacy laws, wiretapping laws, or common law.
Covered businesses should consider the following steps to mitigate enforcement risk:
- Assess (internally or with the assistance of a third-party) existing privacy notices to ensure they clearly and accurately describe all consumer data rights under the CTDPA and other state privacy laws.
- Proactively test consumer rights request mechanisms to verify responsiveness.
- Implement internal monitoring and reporting systems to track and document consumer rights requests on an ongoing basis.
- Respond in a prompt and accurate manner to all requests from the a state attorney general’s office.
[1] https://portal.ct.gov/ag/press-releases/2025-press-releases/attorney-general-tong-announces-settlement-with-ticketnetwork
