Delaware privacy law will more strictly regulate the sale of sensitive personal data, among numerous other consumer-friendly amendments to the state’s existing privacy law.
Wilmington, CT – Consumer Reports was on hand to celebrate today’s signing of HB 380 into law by Governor Matt Meyer. The new privacy law builds on the Delaware Personal Data Privacy Act, a 2025 comprehensive privacy law that extended baseline privacy rights to consumers. This law introduces new privacy protections for Delaware residents such by banning the sale of consumers’ sensitive personal information unless strictly necessary to provide the requested product or service.
The bill would also extend to Delaware consumers important new protections along a number of important areas, including:
- Expanding consumers’ rights around the use of profiling;
- Improving key terms like “sensitive data”;
- Expanding the number of businesses covered under the law;
- Expanding the right to access to include inferences that companies have made about consumers; and
- Allowing consumers to request the list of third parties to which businesses have sold their personal information.
The law goes into effect on January 1, 2027.
“These important updates to the Delaware Personal Data Privacy Act will help protect consumers from numerous harms to their safety, autonomy, and finances. One particular highlight is the bill’s treatment of sensitive data, whereby covered businesses are now prohibited from selling such data unless the sale is strictly necessary to provide the requested product or service. In our view, that is rarely going to be the case, so this law should significantly reduce the amount of consumer sensitive data automatically being shared with dozens of unknown third parties,” said Matt Schwartz, senior policy analyst at Consumer Reports
“We congratulate Representative Griffith, Governor Meyer, and the entire legislature for making these critical improvements to the state’s privacy framework,” he added.
Delaware joins Connecticut, Maryland, New Jersey, Oregon, and Virginia in creating default protections for certain categories of sensitive data that do not rely on consumers making opt-in or opt-out choices. The California legislature also recently approved a bill to ban the sale of sensitive information, which awaits action from the Governor. Massachusetts is also actively considering a similar ban.
Contact: cyrus.rassool@consumer.org