Delaware is among approximately 20 states pushing data privacy laws forward, with newlyenacted expansionsto its2023 Personal Data Privacy Act.
The laws passed during the legislative session, got a ceremonial signing in Gov. Matt Meyer’s office Wednesday. Meyer said the legislation, “creates the broadest data protections in the country.”
Both bills are sponsored by State Rep. Krista Griffith (D- Fairfax). One of them, HB 380, lowers the threshold of which companies must comply with data privacy laws, from those that control or possess data of 35 thousandDelaware consumers down to 10 thousand. And if a company makes more than 20% of its revenue from selling consumer data, the threshold is five thousand.
Delaware is one of the country’s smallest states by population. State laws of data privacy vary, but its threshold is smaller than nearby states like New Jersey and Vermont.
Griffith said companies can’t sell sensitive consumer data, unless the consumer specifically requests it, or it's necessary for the company’s service.
“If your data is going to be sold, you have to be told clearly and conspicuously what data is being disclosed, why, and to whom,” Griffith said.
To process sensitive data, companies need consumer consent.
Griffith’s law expands the definition of sensitive data to include inferences companies make from personal data to draw conclusions about a consumer's race, nationality, sexual orientation, ethnicity, and physical and mental health.
They also allow consumers to opt out of profiling done to automate legally significant decisions for companies, such as loan applications.
Meyer and Griffith noted the challenges of getting the original Personal Data Privacy Act and HB 380 passed. From the first time it was introduced, Griffith said it took two sessions to get the PDPA passed.
“We were in an uphill battle,” Griffith said. “Dozens and dozens of big tech companies...used so many resources to fight us.”
It passed in 2023, the PDPA took effect in 2025.
“So, three years later, we're here because the act needs to be strengthened,” she said. “More and more data is being sold on the open highways of information.”
The Public Integrity Reporting System counts 94 lobbying instances connected to HB 380 during session. For another, HB 381, it counted more than 30 instances. Many of these were for Google, Meta, TikTok, Verizon, and Comcast.
These companies and other data brokers, made hundreds of billions of dollars off selling user data and advertising that relies on the information in 2025.
Attorney General Kathy Jennings said HB 381 makes reporting requirements stricter for when companies experience a data breach. They must notify the Delaware Dept. of Justice within 60 days, regardless of the company's confirmation of Delaware consumers who were affected.
Jennings said the reporting requirements are, “swifter and more comprehensive.” And this helps her office respond, “so that we can protect consumers from those data breaches as well.”
According to a 2023 FBI cyber crimes report, Delaware is one of the top three states for victims of a cyber-attack per capita. DOJ’s Fraud and Consumer Protection Division director Owen Lefkun said better protecting data can address that.
“That ties directly into the pathway to cyber scams,” he said. “Because the reason cyberscamshappen is identity theft, and identity theft happens because people's data is out there through data breaches and otherwise.”
HB 380 takes effect in 2027. HB 381 takes effect upon enactment.
