PRESS RELEASE: EPIC Commends Delaware for Strengthening Privacy Law, Strictly Protecting Sensitive Data

Updates

September 2, 2026

WILMINGTON, DE — Today, Delaware Governor Matt Meyer signed a law to strengthen the state’s privacy law and provide more robust protections for Delawareans’ personal data.

The bill, H.B. 380, amends the Delaware Personal Data Privacy Act in several key ways, including:

Placing strict requirements on the sale of sensitive data;
Expanding the law’s coverage to apply to more businesses;
Giving consumers additional rights if their personal data is used to profile them and make consequential decision about them; and
Narrowing an overbroad exemption for financial institutions.

“EPIC is grateful for the ongoing leadership of Rep. Griffith in sponsoring this bill and ensuring the state’s privacy law evolves to address privacy risks,” said EPIC Counsel Kara Williams. “This bill takes a significant step forward in protecting Delawareans’ privacy by placing strict limits on the sale of their most sensitive personal information. EPIC is thrilled to see Delaware join the growing number of states placing strict limitations on the sale of sensitive data.”

Maryland, California, New Jersey, Oregon, Connecticut, and Virginia have all recently banned the sale of sensitive data, and Delaware’s new requirements prohibit the sale of sensitive data in nearly all situations. Under the new requirements, sensitive data can only be sold in Delaware if the sale is strictly necessary to provide a product or service a consumer affirmatively requests and the consumer consents to the sale after receiving clear and conspicuous notice of the category of data being sold, the purpose, and the party to whom it will be sold.

EPIC commends Rep. Krista Griffith in particular for championing this issue and thanks the many other Delaware policymakers that contributed to this bill becoming law in the state.

EPIC testified in support of this bill in both the House and the Senate and was grateful to be invited to attend the bill signing ceremony along with our partners at Consumer Reports.

Please contact [email protected] with requests for further comment.

###

ABOUT EPIC

The Electronic Privacy Information Center (EPIC) was established in 1994 to protect privacy, freedom of expression, and democratic values in the information age. Our mission is to secure the fundamental right to privacy in the digital age for all people through advocacy, research, and litigation.

Support Our Work

EPIC's work is funded by the support of individuals like you, who allow us to continue to protect privacy, open government, and democratic values in the information age.

Donate

Facts Only

* Delaware Governor Matt Meyer signed H.B. 380 on September 2, 2026.
* The bill amends the Delaware Personal Data Privacy Act.
* The amendments include placing strict requirements on the sale of sensitive data.
* The law expands coverage to apply to more businesses.
* Consumers receive additional rights when personal data is used for profiling and consequential decisions.
* An overbroad exemption for financial institutions was narrowed.
* Sensitive data can only be sold in Delaware if a consumer affirmatively requests it and consents after receiving clear notice of the sale details.
* Maryland, California, New Jersey, Oregon, Connecticut, and Virginia have banned the sale of sensitive data.

Executive Summary

Delaware Governor Matt Meyer signed House Bill 380, which amends the state's Personal Data Privacy Act to strengthen privacy protections for personal data. The bill introduces several key changes, including placing strict requirements on the sale of sensitive data and expanding the law's coverage to more businesses. It grants consumers additional rights concerning the use of their data for profiling and consequential decision-making. Furthermore, the legislation narrows an exemption previously held by financial institutions regarding data sales. EPIC commented that the bill represents a significant step forward in protecting Delawareans’ privacy by limiting the sale of sensitive personal information. The new requirements dictate that sensitive data can only be sold if the consumer affirmatively requests it and consents after receiving clear notice of the data category, purpose, and recipient.

Full Take

The narrative positions Delaware’s action as an alignment with a broader trend among states banning or restricting the sale of sensitive data, suggesting that protecting privacy is becoming a necessary, collective standard rather than a localized regulation. The emphasis on consumer consent and clear notice establishes a procedural foundation for data exchange, shifting the burden onto entities to justify the transfer rather than allowing it by default. The significance lies in establishing a legal framework where sensitive data transactions require explicit justification tied directly to user autonomy. A pattern emerges where advocacy groups emphasize specific legislative wins, leveraging public recognition (EPIC commendation) to build momentum for systemic change across jurisdictions. The implication is that privacy protection transitions from being an optional policy choice to a mandatory condition for engaging in commercial activity. What mechanisms exist to ensure consistent enforcement and understanding of "sensitive data" definitions across these varied state laws? How does the increased regulatory burden on sales interact with the established economic incentives for data aggregation and monetization?

Sentinel — Human

Confidence

The text reads like a formally issued press release from an advocacy group supporting specific legislative action, exhibiting the structure and references typical of real organizational communication rather than pure synthetic generation.

Signals Detected

Moderate sentence length variance; professional tone consistent with press release format.

High fluency and clear focus on presenting a singular advocacy position (EPIC's support).

Uses direct quotes and references to specific legislative action and organizational endorsements, suggesting real-world communication.

Specific details (law number, dates, names, state comparisons) are presented as facts within a formal announcement structure.

Human Indicators

The inclusion of specific external entities (EPIC, Rep. Griffith, Consumer Reports) and the context provided by an organizational press release suggest grounding in actual advocacy activities.

The tone balances legal/policy language with direct expression of gratitude, which often features in human-written advocacy communications.