Mark D. Metrey

On July 8, 2025, Connecticut Attorney General William Tong announced the state’s first public enforcement action under the Connecticut Data Privacy Act (CTDPA) against TicketNetwork, Inc. (TicketNetwork). The enforcement action comes after the Attorney General issued a cure notice to TicketNetwork on November 9, 2023, identifying several deficiencies under the CTDPA, such as a largely unreadable privacy policy, missing disclosures regarding data rights, and nonfunctional mechanisms for access, correction, and deletion. TicketNetwork allegedly failed to cure these deficiencies within the prescribed 60-day time period under the CTDPA.

The Attorney General also alleged that TicketNetwork mispresented that it had resolved the noted deficiencies and failed to timely respond to follow-up communications from the Attorney General’s office regarding the matter.

As part of the agreement, TicketNetwork must:

• Comply with the requirements of the CTDPA;
• Maintain metrics on rights requests and submit regular compliance reports to the Attorney General’s office; and
• Pay a $85,000 fine.

Finally, as noted by the Attorney General, the CTDPA’s cure period expired on January 1, 2025, and the office has now transitioned from warnings to active enforcement of the state privacy law.