DelawareHB 380153rd General Assembly (2024–2026)House

AN ACT TO AMEND TITLE 6 OF THE DELAWARE CODE RELATING TO PERSONAL DATA PRIVACY.

Sponsored By: Krista Griffith (Democratic)

Signed by Governor

Personalized for You

How does this bill affect your finances?

Personalize government policy and PRIA will tell you what this bill means for your household, plus every other piece of legislation we track. PRIA reads each provision against your financial profile to show you exactly what matters to your wallet.

Free to download

Bill Overview

Analyzed Economic Effects

9 provisions identified: 8 benefits, 0 costs, 1 mixed.

Consent protects teens and sensitive-data sales

Businesses need consent for targeted advertising, data sales, and covered major-decision profiling involving consumers ages 13–17. This applies when a business knows or willfully ignores the consumer's age. For consumers of any age, selling sensitive data requires consent obtained through clear, conspicuous notice of the sale.

Delaware consumers get clearer privacy choices

You can request your personal data and inferences, including information about profiling used for major automated decisions. You can also request third-party recipient names, subject to limits for pseudonymous data and trade secrets. If compiling your recipient list takes unreasonable effort, the business must identify all third parties it shares personal data with. You can opt out of targeted advertising, data sales, and profiling used for decisions with legal or similarly serious effects. Clear privacy notices must identify the business, give a contact method, and explain your rights and opt-out tools. Businesses may require an existing account, but cannot require a new one. Access responses cannot expose Social Security, government ID, account, health insurance, or medical ID numbers, passwords, security questions or answers, or biometric data. Instead, businesses can specifically describe the kinds of protected information they hold.

Residents can challenge harmful data-based decisions

Reports include data summaries, recommendations, profiling, and automated decisions used for major decisions about Delaware residents. These decisions can affect loans, housing, insurance, education, jobs, health care, criminal justice, or essential goods and services. Contracts for shared reports must require notice of harmful actions, such as denial, cancellation, higher charges, or lost benefits. Notices must describe the data used and explain how to request underlying data and feasible human review. Within 30 days of your request, the business must provide specified personal data, profiling sources, and report recipients from the past 24 months. It must also let you correct wrong information. Human review need not be offered when it is not in your best interest, including when delay risks life or safety.

Delaware Justice Department enforces privacy protections

Privacy-law violations count as unlawful practices under Delaware's unfair trade practices law. The Delaware Department of Justice has sole enforcement authority. Beginning January 1, 2026, it can consider the law's listed factors when deciding whether to offer a chance to fix an alleged violation.

More Delaware businesses must protect privacy

These privacy changes take effect January 1, 2027. Coverage includes businesses operating in Delaware or targeting Delaware residents. The main threshold falls from 35,000 to 10,000 consumers whose data was processed in the prior calendar year. A separate threshold falls from 10,000 to 5,000 consumers when data sales provide more than 20% of gross revenue. Data used only to complete payments does not count. Coverage also reaches certain third-party data recipients. Exemptions cover specified insurance, banking, credit-union, savings, investment, and federally regulated entities. Routine employment data is generally exempt, though some profiling and report rules still apply.

Risky consumer-data uses require regular reviews

The threshold for regular data-protection reviews falls from 100,000 to 50,000 consumers processed in the prior year. Payment-only data does not count. Reviews cover risky uses such as targeted advertising, data sales, sensitive-data processing, and specified profiling. Businesses using profiling for major automated decisions must also document impact reviews, without a stated 50,000-consumer threshold. Those reviews cover purposes, context, data inputs and outputs, performance, risks, transparency, and safeguards after deployment. The Attorney General can obtain assessments during investigations; they generally remain confidential unless used in enforcement.

Shared consumer data gets stronger safeguards

Businesses must use binding contracts for processors and third parties receiving personal data, including sales and targeted-advertising disclosures. Contracts must limit uses, require equal or stronger privacy protections, and allow monitoring and action to fix problems. Recipients must report when they cannot meet their duties and cooperate with reviews. Businesses must check compliance through reasonable reviews, with stronger checks for more sensitive data. Third parties without a required contract cannot further use the data; those meeting the processing thresholds must follow the full law. Sharing de-identified or pseudonymous data still requires oversight, narrow-use contracts, and steps to address breaches. Those checks must consider whether identifying someone again would reveal sensitive information.

Stronger limits protect Delaware personal data

Sensitive-data protections expand to cover revealing inferences, neural data, financial-account access details, and certain nonpublic government ID numbers. Protected traits include race, religion, health and pregnancy, sexuality, gender status, and citizenship or immigration status. Identifiable biometric data collected without consent does not become exempt public information merely because it appears in widely distributed media. Businesses must keep data use reasonably necessary and proportionate to stated purposes and maintain reasonable security safeguards. Additional purposes require consent unless the processing meets the law's necessity and proportionality limits. Sensitive-data processing requires consent and must also meet those limits. Businesses that know or willfully ignore that someone is a child must first obtain parent or guardian consent. Data use and profiling must comply with anti-discrimination laws; businesses also cannot punish consumers for exercising privacy rights. Consumers can revoke consent, and the affected processing must stop as soon as practical, within 15 days.

Privacy exemptions require proof, liability stays limited

Businesses claiming a processing exemption must prove it applies and meet necessity, proportionality, purpose limits, and security requirements. A business sharing data avoids liability solely for a recipient's violation only without actual knowledge and after reasonable diligence and contract oversight. A compliant recipient is not liable for the sharing business's independent misconduct. These rules strengthen exemption checks while limiting responsibility for another party's violations.

Sponsors & Cosponsors

Sponsor

Krista Griffith
Democratic • House

Cosponsors

Alonna Berry
Democratic • House
Stephanie T. Bolden
Democratic • House
Frank Burns
Democratic • House
William Bush
Democratic • House
William J. Carson
Democratic • House
Nnamdi O. Chukwuocha
Democratic • House
Franklin D. Cooke
Democratic • House
Daniel Cruce
Democratic • Senate
Mara Gorman
Democratic • House
Stephanie L. Hansen
Democratic • Senate
Kerri Evelyn Harris
Democratic • House
Debra Heffernan
Democratic • House
Kyra L. Hoffner
Democratic • Senate
Russell Huxtable
Democratic • Senate
Kendra Johnson
Democratic • House
Larry Lambert
Democratic • House
S. Elizabeth Lockman
Democratic • Senate
Sean M. Lynn
Democratic • House
Melissa Minor-Brown
Democratic • House
Eric Morrison
Democratic • House
DeShanna U Neal
Democratic • House
Edward S. Osienski
Democratic • House
Sophie Phillips
Democratic • House
Marie Pinkney
Democratic • Senate
Nicole Poore
Democratic • Senate
Cyndie Romer
Democratic • House
Melanie Ross Levin
Democratic • House
Ray Seigfried
Democratic • Senate
David P. Sokola
Democratic • Senate
Laura V. Sturgeon
Democratic • Senate
Bryan Townsend
Democratic • Senate
John "Jack" Walsh
Democratic • Senate

Roll Call Votes

All Roll Calls

Yes: 45 • No: 15

Senate vote • 6/16/2026

Passed (SM required)

Yes: 15 • No: 6

House vote • 5/21/2026