Cybersecurity Policy Report, NetChoice Urges Veto of Bill to Expand Delaware’s Privacy Law, (Jul 16, 2026)

By Carrie DeLeon

NetChoice LLC sent a letter this week to Delaware Gov. Matt Meyer (D.) urging him to veto a bill that would expand the state’s data privacy law, arguing that enacting the measure would make Delaware a “regulatory outlier.”

“NetChoice supported Delaware’s original approach to consumer privacy, which tracked the multistate consensus framework already adopted by more than twenty states. That framework strikes a careful balance: it protects consumers while preserving the online advertising, e-commerce, and content-personalization ecosystem that allows digital businesses to reach customers efficiently. HB 380 abandons that balance. It saddles internet businesses with the single most restrictive and Delaware-specific data regime in the country, and it does so through an amendment that was introduced, passed by voice vote, and pushed through final passage in a matter of weeks, without meaningful engagement with the online businesses it will most affect,” writes Amy Bos, NetChoice’s vice president–government affairs.

HB 380, which recently cleared the Legislature and has been sent to Gov. Meyer for his signature, seeks to amend the Delaware Personal Data Privacy Act to expand consumer rights, lower applicability thresholds, strengthen protections for sensitive data, and require stricter contracts and due diligence for data-sharing. The bill would lower the applicability threshold, making the law apply to entities that process the personal data of at least 10,000 consumers (down from 35,000) or 5,000 consumers if more than 20% of gross revenue is derived from selling personal data and includes third parties acquiring personal data. The bill would also expand definitions of sensitive data to include neural data, financial account information, and government-issued IDs and clarify that biometric data collected without consent was not considered publicly available information.

NetChoice points out that Delaware’s current privacy law is aligned with laws adopted by more than 20 other states, which lets online businesses run a single national compliance program instead of 50 separate ones. HB 380 “breaks that alignment across nearly every major provision in the bill—its sensitive-data rules, its contracting mandates, and its treatment of automated decisions all diverge from what every other state requires, several with no parallel anywhere in the country,” according to NetChoice.

“That is a real cost, not just a compliance inconvenience. Companies deciding where to locate engineering or data-operations jobs, or which state’s consumers to prioritize for new digital products and features, will treat a Delaware-only regime as a genuine disincentive—all without a clear, corresponding gain in consumer protection beyond what Delaware's existing law, and federal protections like the Fair Credit Reporting Act, already provide,” Ms. Bos writes in the Tuesday letter.

NetChoice therefore urges a veto of HB 380 and is calling for “a more deliberate process, with input from the online businesses this bill would most affect, to produce workable updates that keep Delaware aligned with the national consensus.”

News: StateLegislation DataPrivacy