Connecticut Answered Our Petition. Here Is What It Said, and What Comes Next.
Connecticut's new data broker law, Public Act 26-64, requires the state to build a system by 1 July 2028 that lets a resident ask every registered data broker to delete their information in one request. The law says that system must let a consumer "determine the status" of the request. It does not say what that status should rest on.
On 7 October 2026, Sirveil petitioned the Department of Consumer Protection under Conn. Gen. Stat. § 4-174, which lets any interested person ask a state agency to write a rule and requires the agency to answer in writing within 30 days. We explained how that process works in Anyone Can Ask a State Agency to Write a Rule, and the research behind our request in Who Verifies the Status?
Our petition asked for a standard: a status should show who reported it, and a deletion should be marked verified only when the record includes some evidence from outside the broker that was asked to delete. The full petition and the Department's full decision are reproduced at the end of this post.
What the Department said
The Department answered on 27 October 2026, inside its 30 days, and declined to begin rulemaking now. Its reasons were practical. Broker registration begins on 1 January 2027, and the deletion system is in early planning: the Department says it is researching other states' programs, collecting information and reviewing its technical options. Until it chooses a design, it does not know which regulations it will need. It added that enforcement against a broker that misreports a deletion is already governed by the state's administrative procedure law, Chapter 54.
The Department also said that if it decides regulations are needed, it will publish notice and take public comment, and that new petitions are welcome at any time.
Our view
We think that is a fair answer to a question asked early, and a useful one: the Department's position is now in writing, with its reasons.
Two points are worth adding. First, our question is about what a consumer sees on the status screen, which is a design question. Connecticut may contract out the system under Sec. 5(e) of the Act, so the answer can be written into the system's specifications whether or not a regulation follows. Second, the Department is studying other states, and California offers a live example: registered brokers there have been processing deletion requests through DROP since August 2026, and consumers now see a status word for each broker. We documented what each of those words covers in Your DROP Status, Decoded.
Sirveil asked on 7 October to receive notice of any Department rulemaking under this Act, and we will comment when one opens.
Why we do this
Sirveil helps people find out whether their information is still listed on the sites that publish it. Each state building a deletion system is deciding what "done" will mean for the people who use it. We would rather contribute to that answer on the record, state by state, than explain the gap to customers afterward.
The case the other way
Writing rules before a system exists can lock in assumptions that turn out to be wrong, and the Department has a registration deadline to meet first. Agencies also reasonably prefer to see how other states' systems perform before committing to a standard. Those are good reasons to wait, and the right time to raise the question again is when the Department describes its design.
Source document 1: Sirveil's petition (emailed 7 October 2026)
Reproduced as submitted to the Department of Consumer Protection Legal Division; only the street address is omitted.
PETITION FOR THE PROMULGATION OF REGULATIONS, pursuant to Conn. Gen. Stat. § 4-174
To: Commissioner of Consumer Protection, State of Connecticut
Re: Regulations under Public Act 26-64, Sec. 9, implementing Secs. 2–8 — evidentiary standard for the accessible deletion mechanism program
Petitioner: Ben Tobin, Founder and Chief Executive Officer, Sirveil, Inc., San Jose, California (street address omitted here)
Date: 1 October 2026
1. Petitioner and interest
Sirveil, Inc. operates a service that determines, for a named individual and a named website, whether that individual's information is publicly indexed at a given moment, returning the source page, the matching text and the time of retrieval.
Petitioner has a specific and direct interest in the regulations sought:
(a) Sirveil is a prospective registrant. Sec. 2 requires registration by any person meeting the definition of a data broker who sells or licenses brokered personal data in this state on or after 1 January 2027. Petitioner requires clarity on whether the Department reads the definition to reach a read-only verification service that does not sell or license personal data, because that reading determines whether Petitioner must register and pay the fee under Sec. 2.
(b) Sec. 5(e) authorizes the Commissioner to "enter into a contract with one or more public or private entities ... (3) to administer a multistate accessible deletion mechanism program." Petitioner is a prospective contractor and has a direct interest in the evidentiary standard such a contract would require.
(c) Petitioner has a commercial interest in the subject matter and discloses it. Petitioner gives public comment on the record before the California Privacy Protection Agency under the same disclosure.
2. Substance of the request
Petitioner requests that the Commissioner adopt regulations under Sec. 9 addressing the evidentiary standard by which compliance with the deletion obligations of Sec. 5(c) is established.
3. The problem
Sec. 5(a)(1)(B)(ii) requires the mechanism to permit a consumer to determine the status of the consumer's deletion request. The Act does not define what evidence establishes that status, and the distinction is decisive.
If "status" means the state of the request — transmitted, received, marked processed — then the mechanism reports what the data broker says it did. The entity whose compliance is at issue supplies the sole evidence of compliance. A broker may report processing in complete good faith, and the consumer's information may remain publicly available at that broker, and nothing in the mechanism as described would reveal the difference.
This is not a hypothetical failure mode. It is the ordinary result of a system in which the control and the measurement of the control are operated by the same party.
The Act already anticipates external assessment: Sec. 5(d)(1) requires each registered data broker to retain an independent auditor and submit an audit report not later than 1 July 2031 and triennially thereafter, and Sec. 5(c)(1) requires brokers to access the mechanism at least every 45 days from 1 October 2028. Those provisions are substantially weakened if the evidence they rest on originates entirely inside the audited entity.
4. Text of the regulation proposed
Petitioner proposes the addition of a section substantially as follows:
Sec. [__]-1. Evidentiary standard for deletion-request status.
(a) For purposes of Sec. 5(a)(1)(B)(ii) of Public Act 26-64, the status of a consumer deletion request shall be recorded as one of three states: (1) processed and verified, (2) processed and not verified, or (3) indeterminate.
(b) A request may be recorded as processed and verified only where the record includes at least one item of evidence not generated by the data broker to which the request was directed. Such evidence shall consist of a dated observation of a publicly accessible source, and shall identify the source observed, the content observed or its absence, and the date and time of observation.
(c) Where the identifiers submitted are insufficient to distinguish the consumer from another individual, the status shall be recorded as indeterminate. No provision of this section shall be construed to require or permit the recording of a verified status where the underlying determination is uncertain.
(d) Records created under subsection (b) shall be retained in a form sufficient to permit the observation to be repeated and compared at a later date.
(e) Nothing in this section requires the Commissioner, a data broker, or a consumer to procure any particular product or service. Observations under subsection (b) may be performed by the Commissioner, by an entity contracted under Sec. 5(e), by a consumer's authorized agent, or by any other person.
5. Statutory authority
Public Act 26-64, Sec. 9 — "The Commissioner of Consumer Protection may adopt regulations, in accordance with the provisions of chapter 54 of the general statutes, to implement the provisions of sections 2 to 8, inclusive, of this act." The regulation proposed implements Sec. 5(a)(1)(B)(ii) and supports Secs. 5(c) and 5(d).
6. Why now rather than later
The mechanism must be established by 1 July 2028 and the account funding it under Sec. 8 is already ring-fenced. An evidentiary standard specified before the mechanism is procured costs essentially nothing. The same standard retrofitted after a contract is let is expensive or impossible. Petitioner respectfully suggests this is the least costly moment in the Act's life to decide the question.
7. Note on subsection (e)
Petitioner sells a service capable of producing the evidence described in subsection (b) and has drafted that subsection so that it confers no advantage on Petitioner. If the Department considers any part of the proposed text to favour a particular provider, Petitioner would welcome that being struck rather than defended.
Source document 2: the Department's decision (27 October 2026)
Reproduced from the signed decision the Department of Consumer Protection Legal Division emailed to Sirveil on 27 October 2026. Formatting adapted for the web; text unchanged.
IN RE: PETITION FOR REGULATION
SUBMITTED BY: Ben Tobin
REGARDING: Data Broker Deletion Mechanism Standards
DATE: October 27, 2026
DENIAL OF PETITION FOR REGULATION
I. PROCEDURAL HISTORY
On October 7, 2026, the Department of Consumer Protection (hereinafter, "DCP") received a formal Petition for Regulation submitted by Ben Tobin via electronic mail (hereinafter, "Petition" and "Petitioner," respectively) pursuant to Connecticut General Statutes § 4-174 and Regulations of Connecticut State Agencies § 21a-9-10. The Petitioner requests that DCP adopt regulations concerning the consumer data broker deletion program created by Public Act 26-64, specifically the evidentiary standard required for data brokers to demonstrate compliance with consumer-generated data deletion requests.
Pursuant to Connecticut General Statutes § 4-174, DCP must either initiate regulation-making proceedings or deny the petition in writing within thirty days of receiving the petition. This Denial is executed and issued within that mandated statutory timeframe and constitutes DCP's final decision.
II. LEGAL FRAMEWORK
DCP is an administrative agency created by Conn. Gen. Stat. § 21a-1 and oversees the licensing, operation and enforcement of numerous industries. Public Act 26-64 assigned DCP a new area of regulation: data broker registration and the creation of a consumer data deletion mechanism. Specifically, DCP is charged with registering data brokers that sell the data of Connecticut consumers by January 1, 2027. Thereafter, the Department is to create a system by which Connecticut consumers may request that registered data brokers delete their personal information; the data broker must thereafter confirm deletion. The data deletion mechanism must be available by July 1, 2028. Public Act 26-64 Sec. 9 states DCP permissively "may adopt regulations" to implement these new programs. No regulations have yet been promulgated.
Petitioner argues that Public Act 26-64 "does not define what evidence establishes [the] status" of the consumer's deletion request. See Petition dated 10/7/26. Petitioner seems concerned that the audit provisions of the Act are insufficient to evaluate whether the data broker complied with the deletion request because the data broker is supplying the information being audited. Petitioner asks DCP to establish regulations to define the status of the deletion request and the information required to verify the status of deletion request.
III. RATIONALE AND REASONS FOR DENIAL
Pursuant to Conn. Gen. Stat. § 4-174, the Agency hereby DENIES the Petitioner's request to initiate regulation-making proceedings in its entirety as elaborated below.
First, DCP denies the request based on administrative infeasibility. The first benchmark for implementation of Public Act 26-64 is registration of data brokers by January 1, 2027. DCP is presently focused on instituting the new registration process. DCP is in the beginning stages of planning the data broker deletion mechanism, which is not required to be live until July 1, 2028. DCP is researching other states with similar programs, collecting information, and reviewing our technical options. The concerns raised by Petitioner may be nulled by the format of the data-deletion mechanism DCP chooses to implement. Because DCP has not yet finalized plans for the data broker deletion system, it does not know yet what regulations will be required. Therefore, DCP cannot commence a regulatory codification process within the statutorily required thirty-day timeframe for Conn. Gen. Stats. § 4-174 in response to the Petition.
Second, DCP alternatively denies the Petition based on the adequacy of existing statutes and regulations. To the extent the Petition raises questions of how DCP will administratively enforce Public Act 26-64, such as where a data broker misrepresents that it has deleted a consumer's personal data through the deletion mechanism, that process is governed by Connecticut General Statutes Chapter 54, its corresponding regulations, and well-settled case law concerning administrative enforcement.
IV. CONCLUSION
The Petition for Regulation dated October 7, 2026 concerning the data broker deletion mechanism standards is herein DENIED. Please note, however, that in the event DCP decides it requires regulations to implement Public Act 26-64, it will publish its intended notice of rulemaking on the Connecticut e-Regulations System and follow the established process for passing regulations. That process includes a period of public commenting during which Petitioner may raise concerns. Lastly, the Department reminds the Petitioner that new petitions for regulation may be submitted at any time, including after the Department publishes any regulations, and statutory changes may be suggested to state legislators in advance of new legislative sessions.
So submitted,
M. Caitlin S. Anderson, Esq. Chief of Legal and Regulatory Affairs Department of Consumer Protection
Sources, read 27 October 2026: Public Act 26-64 (Conn. 2026), Secs. 5 and 9 (cga.ct.gov); Conn. Gen. Stat. § 4-174 (cga.ct.gov); Department of Consumer Protection, Denial of Petition for Regulation, 27 October 2026 (reproduced above).
Follow Sirveil on LinkedIn: https://www.linkedin.com/company/133457181 · Follow @Sirveil_AI on X.
Disclosure: Sirveil builds privacy verification tools, so we have a commercial interest in this subject.
Sirveil for business: sirveil.ai/for-business
NONE OF THIS CONSTITUTES LEGAL ADVICE.