AI Governance
Data Centers
Drones
Climate
Privacy
2026 Maine Senate
Bob Dylan
Delaware Consumer Privacy Law
Coverage from The National Law Review, National Law Review, and others
Delaware’s Personal Data Privacy Act sets rules for businesses that process residents’ personal data, and House Bill 380 expands and revises those requirements effective January 1, 2027.
The amendments lower coverage thresholds, narrow some exemptions, broaden the definition of sensitive data, and add protections around profiling and significant automated decisions. They also require controllers to assess risks and govern third-party data recipients through due diligence and binding contracts, making data sharing, targeted advertising, and sensitive-data handling important compliance dimensions.
If you read one thing
It gives a clear overview of HB 380’s expanded coverage, consumer protections, and third-party obligations.
Best explainer
Its ad-tech and diligence focus explains how the amendments affect sensitive data, profiling, and third-party data sharing.
The evidence
It adds detail on profiling-related rights and automated-decision duties that receive less emphasis in the broader overviews.
Broader applicability and coverage
HB 380 lowers the DPDPA’s general coverage threshold from 35,000 to 10,000 consumers and its data-sale threshold from 10,000 to 5,000. It also extends obligations to certain third parties receiving personal data; most changes take effect January 1, 2027.
Stronger sensitive-data safeguards
The amendments expand sensitive-data categories and require consent and purpose-limited processing, while restricting sensitive-data sales. The assessment threshold also falls from 100,000 to 50,000 consumers, extending assessment duties to more processing.
Tighter controls on third-party data sharing
Controllers must conduct due diligence and use binding contracts when personal data is disclosed to third parties, including for sales and targeted advertising. Contracts must limit permitted uses, require equivalent privacy protections, and provide for compliance notice and remediation.
Expanded profiling and decision protections
Consumers gain more specific access and disclosure rights concerning inferences, profiling, significant decisions, and data recipients. HB 380 also adds assessment, notice, and consent requirements for specified profiling and automated-decision uses.
January 1, 2027
effective date
“Governor Matt Meyer signed the bill into law on September 2, 2026. The amendments take effect January 1, 2027.”
10,000 consumers
general applicability threshold after amendment
“The general applicability threshold falls from processing the personal data of at least 35,000 consumers annually to 10,000 consumers. The revenue-based sales threshold falls from 10,000 consumers to 5,000. A new trigger makes any third party that acquires personal data from a controller independently subject to the DPDPA, without a minimum volume threshold.”
100,000 consumers
data-protection-assessment threshold before amendment
“The amendments broaden the definition of sensitive data, including national origin, neural data, certain financial account and access information, government-issued identification numbers, and broader health-related information. They also lower the threshold for data protection assessments from 100,000 to 50,000 consumers.”
5,000 consumers
alternative applicability threshold
“The amendments lower the general applicability threshold from 35,000 to 10,000 Delaware consumers whose personal data a business controls or processes. The law also applies to businesses that control or process the personal data of at least 5,000 Delaware consumers and derive more than 20% of gross revenue from selling personal data.”
$116,490 USD
payment required from LocateSmarter LLC
“On August 11, 2026, the California Privacy Protection Agency (CPPA) announced an order against data broker LocateSmarter LLC. The order requires $116,490 in payment and changes to the broker’s practices.”
The new article repeats the previously established Delaware HB 380 changes; its additional California privacy laws do not materially change this Delaware-focused Topic.
Previously
Delaware HB 380 broadens the reach of the state’s Personal Data Privacy Act, lowering coverage thresholds and extending obligations to more businesses and third parties that receive personal data. The amendments also expand sensitive-data protections and consumer rights while adding requirements for assessments, vendor due diligence, contracts, and certain profiling practices; they take effect January 1, 2027. One report also describes HB 381, which revises breach-notification procedures, including notice to the Attorney General.
The update specifies that HB 380 covers certain consequential automated decisions and adds the bills’ signing date and HB 381’s immediate effective date.
The story now includes compliance developments beyond Delaware: California ordered a data broker to pay a penalty and change its practices, while Texas warned organizations about website-tracking demand letters.