Delaware Personal Data Privacy Act (6 Del. C. ch. 12D; 84 Del. Laws c. 197), as amended by HB 380 (85 Del. Laws c. 463): profiling opt-out, profiling assessments and adverse-action duties

Summary

Delaware's comprehensive consumer privacy law (HB 154 of 2023) took effect on January 1, 2025. It applies to persons doing business in Delaware or targeting its residents that control or process personal data of at least 35,000 consumers (excluding payment-only data), or of 10,000 consumers while deriving more than 20 percent of gross revenue from selling personal data. Consumers may opt out of profiling in furtherance of solely automated decisions with legal or similarly significant effects. Controllers that process data of 100,000 or more consumers must document data protection assessments for profiling that presents a reasonably foreseeable risk of unfair or deceptive treatment, unlawful disparate impact, or financial, physical or reputational injury. HB 380, signed on September 2, 2026, and effective January 1, 2027, lowers the thresholds to 10,000 and 5,000 consumers, extends the opt-out to profiling in furtherance of automated decisions (not only solely automated ones), adds a right to learn whether data is processed for such profiling, requires an impact assessment for that profiling by controllers processing data of 50,000 or more consumers, and requires controllers that disclose reports used in significant decisions to bind recipients to give adverse-action notices, a description of the data relied on and, where feasible, human review. It bars profiling that violates anti-discrimination law and makes evidence of anti-bias testing relevant to claims and defenses. It replaces the entity-level Gramm-Leach-Bliley exemption with exemptions for banks, insurers and securities firms, while keeping the GLBA data exemption. The Department of Justice enforces; there is no private right of action.

Key dates

1. September 11, 2023Enacted
2. October 16, 2026Checked against sources
3. October 21, 2026Checked against sources

Developments are added when the record is reviewed. Next review: January 15, 2027.

Evidence

Each passage is quoted from its source. The quoted passages are re-checked against the live pages every month.

1. If this Act is enacted before or on January 1, 2024, this Act takes effect on January 1, 2025.

   Supports: Effective date

   Approved September 11, 2023

   Supports: Approval date

   Laws of Delaware, Volume 84, Chapter 197 (House Bill No. 154) Delaware General Assembly Primary source

2. This chapter shall be known and may be cited as the “Delaware Personal Data Privacy Act.”

   Supports: Name

   c. Profiling in furtherance of solely-automated decisions that produce legal or similarly significant effects concerning the consumer.

   Supports: Profiling opt-out (current text)

   Controlled or processed the personal data of not less than 35,000 consumers, excluding personal data controlled or processed solely for the purpose of completing a payment transaction.

   Supports: Current threshold

   The processing of personal data for the purposes of profiling, where such profiling presents a reasonably foreseeable risk of any of the following: a. Unfair or deceptive treatment of, or unlawful disparate impact on, consumers.

   Supports: Assessment duty for risky profiling

   Controlled or processed the personal data of not less than 10,000 consumers, excluding personal data controlled or processed solely for the purpose of completing a payment transaction.

   Supports: Threshold from January 1, 2027

   Conduct and document, on a regular basis, an impact assessment if a controller engages in profiling in furtherance of automated decisions that produce legal or similarly significant effects concerning a consumer.

   Supports: Profiling impact assessment from 2027

   Include a statement that the resident may request the third party, where technically feasible, perform a human review of the adverse action concerning the resident

   Supports: Adverse-action human review from 2027

   Not process personal data or engage in profiling in violation of the laws of this State and federal laws that prohibit unlawful discrimination.

   Supports: Anti-discrimination duty from 2027

   Nothing in this chapter shall be construed as providing the basis for, or be subject to, a private right of action for violations of said sections or any other law.

   Supports: No private right of action

   Delaware Code, Title 6, Chapter 12D, Delaware Personal Data Privacy Act Delaware Code Online (Delaware General Assembly, Division of Research) Primary source

3. Signed 9/2/26

   Supports: HB 380 signed

   This Act amends the Delaware Personal Data Privacy Act (DPDPA), Chapter 12D of Title 6, originally enacted in 2023

   Supports: HB 380 amends the DPDPA

   Effective Date: 1/1/27

   Supports: HB 380 effective date

   House Bill 380 (153rd General Assembly), bill detail Delaware General Assembly Primary source

4. House Bill 380 lowers the threshold for Delaware’s Personal Data Privacy Act, applying the law to businesses that control or process the personal data of at least 10,000 consumers

   Supports: Signing reported; final threshold

   Meyer signs two bills expanding data privacy protections in Delaware WDEL Reporting or analysis