What Delaware’s new privacy law means for residents and businesses

On September 11, 2023, Delaware became the 13th state to enact a comprehensive consumer data privacy law, with an effective date of January 1, 2025.

The Delaware Personal Data Privacy Act (DPDPA) is, like all legislation, freely available to read online. But it’s not an easy read. Academic explainers have fewer numbered sections but are dense and complicated.

Simply put, under the new law, businesses are required to be transparent about their personal data practices and obtain consent from Delaware residents before they collect and use sensitive personal data.

By and large, people in the US want data privacy, with 72% of US adults supporting more regulation on how consumer data is collected and used, according to Pew Research. And yet the same percentage, 72%, said they don’t fully understand data privacy laws.

In an effort to make the DPDPA easier to understand, the State of Delaware and Attorney General Kathy Jennings launched a Delaware Personal Privacy Portal this week to help residents learn how the law will impact them as consumers, parents or business owners.

As a Delaware resident and consumer who has questions about DPDPA myself, I decided to explore the portal.

A walkthrough of the data privacy portals

The layout is extremely straightforward. From the main portal, you can go to an area specifically for consumers, one for parents and one for business owners.

I started with the consumer portal. I don’t know what I expected, maybe a direct way to opt out of sharing my personal data, like the National Do Not Call Registry for telemarketing calls. There are some action links in the resources section at the bottom of every page, but, at this point, it’s not super interactive. That may change, as it notes that it will be updated as January 1 approaches.

What the portal does provide is information, presented in an easy-to-understand way. It shows examples of personal data, like name, address and email, and sensitive personal data like health information and immigration status.

Maximum privacy and a minimum amount of sharing your data requires personal responsibility, though. The portal lays out what steps you can take with the acronym “LOCKED”:

L – Limit the use and sharing of sensitive information collected about you

O – Opt-Out of the sale or targeted advertising

C – Correct inaccurate information

K – Know what personal information is collected and how its used and shared

E – Equal and fair treatment when your personal information is used

D – Delete personal information collected about you

Each part of the acronym is explained with bullet points informing residents of their rights. You have the right to refuse consent to sharing your data, to know how a company is using your data and opting out should be easy.

You also have the right to ask for your data to be deleted from a company’s database, and you can’t be discriminated against for exercising these rights.

Below that are the resources, where you can, among other things, file a complaint, report a breach or learn about common scams. It includes a link to a nice collection of consumer protection videos.

The business owner portal is a bit more involved and complicated, as expected, since the business owner’s end is the one that is responsible for compliance.

If you run a small business and think you won’t be big enough to worry about compliance, it’s worth noting that Delaware has the lowest consumer data threshold among states with data privacy laws.

Businesses that control or process the personal data of just 35,000 Delaware residents (that threshold drops to 10,000 if the business earns 20% or more of their gross revenue from selling personal data) are bound to DPDPA. By contrast, most states with a data privacy law have a minimum threshold of 100,000 or higher.

The parent’s portal explains that children are covered by DPDPA, but the section for the most part is a placeholder that will be added to.

Consumers may not notice a day-to-day change

So, did I leave with questions? A few.

Mainly, I wonder if consumers will notice much change on January 1. Will there be more popup consent forms or other compliance tools, or will things look pretty much like they do now — which, to be fair, already includes a lot of consent popups. We’ll see in six months.

Until then, I look forward to seeing how the portal evolves.