Delaware Broadens Privacy Law, Adds AI Opt-Out Right
Amendments to the Delaware Personal Data Privacy Act, effective January 1, 2027, add a right to opt out of automated decision-making and significantly lower the law's applicability thresholds.
Delaware has amended its Personal Data Privacy Act, introducing significant new obligations for businesses. The amendments, effective January 1, 2027, create a consumer right to opt out of automated decision-making that produces legal or similarly significant effects, a category covering financial services, housing, insurance, employment, and healthcare. This change reflects a growing regulatory focus on the use of AI and profiling.
Counsel should advise clients that the law’s scope has been substantially broadened. The applicability threshold has been lowered from 35,000 to just 10,000 consumers, and exemptions for financial institutions and employee data have been narrowed. The definition of sensitive data is also expanded to include immigration status, nonbinary or transgender status, and neural data, with new consent and notice requirements for its sale. Businesses that acquire personal data from other controllers are now also subject to the law, regardless of consumer count. Companies previously outside the law's reach must now re-evaluate their obligations and prepare for compliance.