How the Delaware Personal Data Privacy Act will impact you

Last week, Delaware’s Gov. John Carney signed HB154 into law, to be effective Jan. 1, 2025. With this law, Delaware becomes one of a dozen states that have data privacy laws on the books, including Virginia, Connecticut and California. 

Known as the Delaware Personal Data Privacy Act, the legislation will give Delawareans the right to control the use of their private data in the following ways:

• If a “controller” — a person or entity that has collected consumer data — is processing your personal data, you have a right to access it in an easily usable and portable format, correct inaccuracies and delete it.
• If your personal data had been disclosed to third parties, you may obtain a list of the categories of third parties.
• You may opt out of targeted advertising, the sale of personal data and decision profiling.

Anyone doing business in Delaware who processes the data of 35,000 or more consumers (10,000 if they make 20% or more of their income from selling data) will have to make it easy for Delawareans to make requests and opt out. They have 45 days to comply. 

There are exceptions, including some state entities (but not colleges and universities), financial institutions and nonprofits that exclusively work to prevent insurance crime. The law also doesn’t apply to information protected under The Health Insurance Portability and Accountability Act (HIPAA), nor information shared with an employer, contractor agreements or some crime data.

Between now and January 2025, when the Delaware Personal Data Privacy Act goes into effect (no later than July 2024), the Department of Justice will conduct public outreach to educate consumers and businesses about the law. 

In the meantime, you can opt out of cookie tracking through your browser’s settings or by choosing which cookies you want on a website’s cookie consent pop-up.