Connecticut’s AI legislation – Part 3: AI subscriptions and social media

Introduction

In our third and final update on the Connecticut Artificial Intelligence Responsibility and Transparency (CART) Act, we will examine the law’s AI subscription requirements and social media rules.  Our Part I update focused on the portions of the CART Act related to automated employment-related decision technology (AEDT) and companion chatbots, while our Part II update addressed the Act’s frontier models and synthetic content transparency provisions.

Despite ongoing discussion at the federal level of preempting at least some state AI laws, states continue to adopt regulatory frameworks to address perceived risks in the AI space at a significant pace.  The Connecticut legislature went from zero to 60 by stitching together in a single bill what likely would have been six distinct bills in most states. Indeed, when Connecticut Governor Ned Lamont signed the Connecticut Artificial Intelligence Responsibility and Transparency (CART) Act into law on May 27, 2026, it became the nation’s most comprehensive state AI law to date.  Notably, Colorado replaced the Colorado AI Act (CAIA), which was previously the most comprehensive state AI law, with the decidedly narrower regulatory framework in the Colorado Automated Decision-Making Technology Act (ADMTA) the same month (see DPW update). 

The breadth of the CART Act stems from its coverage of multiple AI applications and use cases, including AEDT, AI companion chatbots, frontier AI models, synthetic content transparency, AI subscription products and social media.  Connecticut is not the first state to regulate these areas; companion chatbots and frontier models, for instance, have been a significant driver of recent state legislation in California, New York and beyond (see DPW updates here, here and here).  As a result, Connecticut was able to borrow extensively from existing state regulatory frameworks in developing its own comprehensive legislation. 

AI subscriptions

Applicability 

Although other states have laws addressing consumer transparency and auto-renewals, the CART Act appears to be the first state law targeting subscription-based AI offerings.  Effective October 1, 2026, the Act imposes disclosure requirements on “subscription-based providers,” defined as a person doing business in Connecticut who provides, or offers to provide, an AI technology to a consumer pursuant to a subscription. 

Requirements

Under the Act, no subscription-based provider may enter into or renew a subscription, or collect any fee from a consumer, unless it has first disclosed in writing the subscription’s key terms and conditions, and the consumer has accepted those terms and conditions in writing.  A provider’s disclosure must include material information sufficient to enable a reasonable consumer to decide whether to purchase the subscription.  At minimum, the provider must disclose any quantitative or qualitative limitations it may impose and whether it has discretion to limit or eliminate the consumer’s access to, or reduce the quantity or quality of, any functionality of the AI technology.  Similarly, at renewal, the subscription-based provider must also disclose any limitations that are new or modified from the initial term, and any new or modified discretion it may exercise regarding access to, or the quality of, the technology.

Enforcement

Like the AEDT, companion chatbot and synthetic content transparency provisions, the Connecticut Attorney General has exclusive authority to enforce violations of the AI subscription provisions as unfair and deceptive trade practices under the Connecticut Unfair Trade Practices Act.

Social media

Applicability

Like California’s Protecting Our Kids from Social Media Addiction Act and New York’s SAFE for Kids Act, the CART Act addresses access, default settings, parental controls, and disclosures for digital platforms utilizing algorithmic recommendation systems.  Effective January 1, 2028, the CART Act imposes various requirements on “covered operators” of “covered platforms,” defined as any website, online service, application or social media platform that, as a significant part of the services offered, recommends, selects or prioritizes for display text, images or videos generated or shared by users.

The CART Act excludes federal, state and municipal governments as well as platforms that primarily facilitate the sale of goods and those used solely for educational purposes. By comparison, California excludes services whose user interactions are limited to commercial transactions or consumer reviews, and services that operate a feed primarily for cloud storage.  New York’s statute contains no comparable categorical platform exclusions, although its implementing regulations exempt online platforms with fewer than 5 million monthly active users or fewer than 20,000 monthly active minor users (unless the platform’s primary user base is minors).

Requirements – Algorithmic recommendations

Covered operators of covered platforms are prohibited from delivering personalized, algorithmic content recommendations (i.e., recommendations based, in whole or in part, on information associated with the user or the user’s device) unless the operator (i) uses “commercially reasonable and technically feasible methods” to determine that the user is not a minor; or (ii) obtains verifiable parental or guardian consent.  Similar to the regulatory frameworks in California and New York, the Act permits certain less-personalized recommendations, including those based on:

• Information that is not persistently associated with the user or the user’s device and is unrelated to the user’s previous interactions with user-generated media;
• User-selected privacy or accessibility settings;
• Technical information concerning the user’s device;
• The user’s express and unambiguous request to display, block, prioritize or deprioritize specific content;
• Direct and private communications;
• Specific search inquiries;
• Preexisting content sequences from the same source, such as an author, creator or poster; and
• A recommendation, selection or prioritization that is necessary to comply with the social media provisions or implementing regulations.

Additionally, covered operators may not withhold or degrade a product, service or feature, or reduce its quality or increase its price because personalized recommendations are restricted, unless otherwise necessary to comply with the Act.

Requirements – Default, minor settings

As noted above, the CART Act also requires certain default settings and parental controls for minors accessing covered platforms delivering personalized, algorithmic recommendations.  Beginning January 1, 2028, covered operators may not send minors any notification concerning personalized recommendations before 8 a.m. or after 9 p.m. absent verifiable parental or guardian consent.  Further, unless verifiable parental or guardian consent is obtained, operators must apply default settings that:

• Block covered notifications outside the permitted hours; 
• Limit minors’ access to any portion of the covered platform that personalizes content to one hour per day; 
• Prevent users who are not connected to a minor from viewing or responding to the minor’s content or exchanging messages with the minor; and 
• Prevent the minor from accessing, viewing or receiving sensitive content, meaning content that the operator deems to violate its community standards or similar guidelines.  

Operators must also maintain a mechanism through which a verified parent or guardian can specify different hours for blocking notifications, impose a different daily limit on covered personalized recommendation features, or restrict interactions with users who are not connected to the minor.  

While the CART Act leverages the regulatory frameworks in California and New York, there are notable differences among the statutes.  California, for example, requires operators to provide similar parental controls to adjust default settings whereas New York does not require default settings.

Requirements – Disclosures and warnings

Finally, the CART Act requires certain disclosures and warnings with respect to covered platforms. Beginning March 1, 2028, and annually thereafter, operators of covered platforms must publicly disclose information for the preceding calendar year in the form prescribed by the Connecticut Attorney General.  The disclosure must include the total annual number of the platform’s Connecticut users; the portion of those users for whom parental consent was obtained; the portion for whom the statutory default settings were or were not enabled; and average daily usage, broken down by user age and hour of day.  California’s Protecting Our Kids from Social Media Addiction Act similarly requires annual disclosure of some but not all of these metrics. 

Connecticut is unique among the three statutes in requiring covered platforms, beginning January 1, 2028, to display to minors a prescribed Surgeon General warning – with specific color, size, duration and frequency requirements – stating that “social media is associated with significant mental health harms and has not been proven safe for young users,” among other things.  For each day a user accesses the platform, this warning must appear on the first access for at least 30 seconds, cover 75% of the screen, and may not be dismissed or shortened.  After three hours’ use within a day, and immediately after each additional hour, it must appear again for at least 10 seconds and cover 25% of the screen, subject to dismissal through a conspicuous “X” option.

Enforcement

Violations of the social media provisions are deemed unfair or deceptive trade practices under the Connecticut Unfair Trade Practices Act (CUPTA).  The full range of CUTPA remedies are available for violations of the social media provisions.  Accordingly, a private right of action is available to recover actual damages, and courts may award punitive damages, costs, reasonable attorneys’ fees and injunctive relief.

Other provisions

Beyond the key provisions discussed in our Part I update and Part II update, the CART Act includes several other measures concerning AI education; education, workforce and economic development; research, governance and healthcare innovation:

• The Act establishes the Connecticut AI Academy; expands computer science and AI education and workforce development programs; promotes collaboration among higher education institutions and industry; provides AI resources for small businesses; and incorporates emerging technologies into state economic-development planning.  It also requires a study and comprehensive strategy addressing AI’s impact on Connecticut’s workforce. 
• The Act requires a plan for an AI regulatory sandbox and permits legislative leaders to request scientific fellows to serve as liaisons on specified AI initiatives, which may include developing a plan for state- provided high-performance computing services for Connecticut businesses and researchers.  
• Within available appropriations, the Office of the Comptroller may serve on the steering committee for a competition intended to foster the use of AI to improve health equity and health outcomes.  The scientific fellows described above may also evaluate the benefits of a statewide research collaborative among healthcare providers to advance analytics, ethical and trustworthy AI, and hands-on workforce education while protecting patient privacy.
• The Act establishes a working group to make recommendations concerning AI testbeds, risk assessments, trade secret protections and laws governing independent verification organizations.  The working group must also develop proposals to create a technology court and propose legislation to regulate general purpose AI models and synthetic content.

Key takeaways

• Companies that offer subscription-based AI technologies should review and update their customer onboarding and renewal disclosures in advance of the October 1, 2026 compliance deadline.
• Companies that operate “covered platforms” should evaluate whether existing or planned compliance programs address the Act’s multi-pronged social media requirements.