Delaware Personal Data Privacy Act Now in Effect

The Delaware Personal Data Privacy Act, passed in 2023, went into effect at the beginning of this new year, granting Delawareans new personal data privacy rights.

“Businesses collect Delawareans’ personal data every day,” said Attorney General KathyJennings. “Unfortunately, some businesses engage in deception or unfair practices by selling or sharing that data with other companies without consumers’ knowledge. This law not only gives Delawareans new rights to control their data, but also gives my office important tools to enforce consumers’ data privacy and security.”

Some of the new consumer rights include:

• Opt-In: Businesses must obtain consent from Delaware consumers to use or share their sensitive data, such as race or ethnic origin, religion, health conditions, sexual orientation, gender identity, precise location, or biometric data.
• Opt-Out: Consumers may opt-out of the sale of their personal information, targeted advertising, and some types of automated decision making.
• Access and Deletion: Upon request and subject to certain limitations, businesses must provide consumers with the personal data the business has collected about them and permit corrections or deletions of personal data.
• Non-Discrimination: Businesses are prohibited from using personal data to unlawfully discriminate against a consumer.

The law also provides new privacy rights for children under the age of 18. Businesses must obtain consent to sell personal data or to use targeted advertising for children aged 13 to 17. For children under 13, businesses must obtain a parent’s consent to use a child’s personal data for any reason.

The Personal Data Privacy Act also requires businesses to post plain language disclosures of their data collection and data sharing practices and to provide information about how consumers can exercise data privacy rights.

The new law defines “personal data” as any data that is linked to a personal identifier like a name, address, phone number, email, or mobile device identifier.

People who wish to find out more about their data privacy rights or submit a complaint about a business’s data privacy practices can visit privacy.delaware.gov.