Cybersecurity Policy Report, Governor Signs Delaware Bill to Expand State’s Privacy Law, (Sep 3, 2026)
Organizations Mentioned:NetChoice, LLC
Delaware Gov. Matt Meyer (D.) has signed into law a bill to expand the state’s privacy law to ban the sale of sensitive data. The new law becomes effective Jan. 1, 2027.
HB 380 places strict requirements on the sale of sensitive data, expands consumer rights, lowers applicability thresholds, and requires stricter contracts and due diligence for data-sharing.
According to the new law, sensitive data could be sold in Delaware only if the sale was “strictly necessary to provide a product or service a consumer affirmatively requests and the consumer consents to the sale after receiving clear and conspicuous notice of the category of data being sold, the purpose, and the party to whom it will be sold.” The law also expands the definition of sensitive data to include neural data, financial account information, and government-issued IDs and clarifies that biometric data collected without consent was not considered publicly available information.
The new law also lowers the applicability threshold, making the law apply to entities that process the personal data of at least 10,000 consumers (down from 35,000) or 5,000 consumers if more than 20% of gross revenue is derived from selling personal data and includes third parties acquiring personal data.
“As technology advances and personal data becomes more valuable, we need to raise the guardrails that protect Delawareans. [HB 380] modernizes Delaware’s data privacy protections to keep pace with AI, require your consent if a company wants to sell your sensitive data, and help ensure that your data stays yours,” Attorney General Kathy Jennings (D.) said in a statement.
Rep. Krista Griffith (D.), sponsor of the bill (H.B. 380, Reg Sess.), said the new law was intended to “strengthen transparency and accountability requirements when sensitive information is exposed.”
The Electronic Privacy Information Center (EPIC) said the new law would provide “more robust protections for Delawareans’ personal data.”
“EPIC is grateful for the ongoing leadership of Rep. Griffith in sponsoring this bill and ensuring the state’s privacy law evolves to address privacy risks,” Kara Williams, counsel for EPIC counsel, said in a statement. “This bill takes a significant step forward in protecting Delawareans’ privacy by placing strict limits on the sale of their most sensitive personal information. EPIC is thrilled to see Delaware join the growing number of states placing strict limitations on the sale of sensitive data.”
NetChoice LLC opposed the measure and had called on the governor to veto the bill, arguing that enacting the measure would make Delaware a “regulatory outlier.”
“NetChoice supported Delaware’s original approach to consumer privacy, which tracked the multistate consensus framework already adopted by more than twenty states. That framework strikes a careful balance: it protects consumers while preserving the online advertising, e-commerce, and content-personalization ecosystem that allows digital businesses to reach customers efficiently. HB 380 abandons that balance. It saddles internet businesses with the single most restrictive and Delaware-specific data regime in the country, and it does so through an amendment that was introduced, passed by voice vote, and pushed through final passage in a matter of weeks, without meaningful engagement with the online businesses it will most affect,” said Amy Bos, NetChoice’s vice president–government affairs.
News: StateLegislation DataPrivacy