How HB 380 Changes Delaware Privacy Compliance in 2027

Introduction

Delaware’s privacy landscape is about to shift significantly. Governor Matt Meyer signed HB 380 on September 2, 2026, setting the stage for a sweeping overhaul of the state’s data privacy framework. If you serve Delaware consumers through a Shopify store or any online business, the January 1, 2027 effective date demands your attention now.

HB 380 does not replace the Personal Data Privacy Act-it substantially rewrites it. The amendments target the gaps that made the original 2023 DPDPA less protective than newer state privacy laws, particularly around data sensitivity, automated decisions, and third-party data flows. The Delaware Department of Justice enforces the DPDPA and can remediate violations, meaning the Attorney General’s office handles enforcement rather than private lawsuits.

The changes align Delaware more closely with states like Connecticut and New Jersey. For multi-state e-commerce businesses, this creates an overlapping compliance landscape where the DPDPA interacts with frameworks like the Fair Credit Reporting Act, GLBA, and EU-style laws such as GDPR.

Here is a concise comparison of where things stand:

Element	DPDPA Before HB 380	DPDPA After HB 380 (January 1, 2027)
Standard threshold	35,000 consumers	10,000 consumers
Revenue-based threshold	10,000 consumers + 20% revenue from data sale	5,000 consumers + 20% revenue from data sale
Data protection assessment trigger	100,000 consumers	50,000 consumers
Sensitive data scope	Limited categories	Neural data, financial credentials, immigration status, pregnancy, government IDs, inferences
GLBA exemption	Broad entity-level	Narrow-specified financial institutions only

January 1, 2027, acts as the operational deadline for controllers and processors. Treat 2026 as the readiness year.

Pandectes GDPR ComplianceThe most popular & reviewed GDPR app for Shopify★★★★★ 5/5 · 3,000+ reviews · Built for ShopifyInstall free on Shopify

Who Is Now Covered?

HB 380 lowers the consumer applicability threshold to 10,000 Delaware consumers, down from 35,000. The sale-based threshold drops to 5,000 consumers for data sales where those sales generate more than 20% of gross revenue. Delaware claims this is the lowest threshold in the nation for triggering a state privacy law’s obligations.

“Consumer” here means Delaware residents acting in an individual or household context. A Shopify store with 12,000 Delaware shipping addresses in its 2026 order data now falls squarely under the law in 2027. Even niche subscription services or data-light SaaS operators previously assuming they were outside Delaware’s scope should re-evaluate. Organizations outside the DPDPA should reassess their applicability immediately.

Key scope details to keep in mind:

• Businesses must assess coverage based on the preceding calendar year’s data volumes, so 2026 metrics determine whether DPDPA applies from January 1, 2027.
• Third parties acquiring personal data from controllers are now subject to DPDPA provisions, even if they don’t independently meet numeric thresholds. Parties acquiring personal data from Delaware controllers-ad networks, analytics providers, affiliate platforms-are in scope.
• The threshold calculation excludes data processed solely to complete payment transactions, so raw payment processing volume alone won’t push you over the line.

Narrowed Exemptions and Sector-Specific Carve-Outs

The GLBA exemption is narrowed to specific financial institutions-those “principally engaged in financial activities” such as banks, credit unions, savings associations, insurers, and broker-dealers. Previously, any entity or affiliate subject to Title V of GLBA enjoyed broad entity-level exemptions. That blanket coverage is gone.

Many companies adjacent to financial services-fintech vendors, data brokers, lead-gen platforms, AI analytics providers-may no longer be fully exempt and must treat their Delaware personal data privacy obligations seriously. If your company is an affiliate of a financial institution but not itself principally engaged in financial activities, you need a Delaware-specific assessment.

Here is what changed:

• Previously: Broad GLBA language covered most affiliates of specified financial institutions.
• Now: Only entities principally engaged in financial activities receive entity-level relief. Others must check activity-level or data-level exemptions for each processing purpose.

Health-related exemptions also narrowed. HIPAA-protected data remains excluded in HIPAA-covered-entity contexts, but wellness apps, direct-to-consumer health tracking, and fitness platforms outside HIPAA now face the full scope of the expanded sensitive data definition. E-commerce merchants should not assume that payment processing or fraud-prevention relationships automatically put all their processing under GLBA; a consumer report or credit check arrangement does not exempt all personal data maintained by the merchant.

Expanded Definition of Sensitive Data and Stricter Consent

The expanded definition of sensitive data is central to how HB 380 changes Delaware privacy compliance. The law expands sensitive data categories well beyond the original list. The definition of sensitive data now includes neural data, detailed health information including pregnancy status, immigration status, national origin, financial account login credentials (including any access code, password, or credential that would allow access to a consumer’s financial account), and government-issued identification numbers such as Social Security numbers, passports, and driver’s license numbers not publicly required. Inferences that reveal or identify any of these attributes are also classified as sensitive.

HB 380 requires consent before processing sensitive data. This consent must be explicit, informed, and documented. Processing sensitive data must be proportionate to its purpose, meaning controllers cannot collect or use more sensitive information than is reasonably necessary and proportionate to the service the consumer affirmatively requests.

For online retailers and app-based businesses, this expanded definition means certain loyalty programs, financing options (BNPL applications collecting financial data), or wellness quizzes may now involve sensitive data processing. If your service collects sensitive information that falls into any new category, you must map sensitive data processing across your operations and ensure your existing consent workflows, whether GDPR-style banners or preference centers, distinguish between generic consent and sensitive data consent.

Selling Sensitive Data: Notice, Separate Consent, and Five-Year Evidence

HB 380 treats selling sensitive data as a distinct activity from merely processing it. Selling sensitive data is generally prohibited unless specific conditions are met: the controller must provide clear and conspicuous notice before selling sensitive data, and that conspicuous notice identifying the specific sensitive data categories, the sale purpose, and the types or names of third-party recipients must be delivered to the consumer before any transfer occurs.

Controllers must obtain consent specifically tied to personal data sales-not just general processing permission. This means your consent interfaces need two separate signals where relevant: one for permission to process sensitive data, and one for permission to sell it. Consent records for sensitive data must be retained for five years, with details including purpose, recipient, and timestamp.

Practical considerations:

• The Delaware Department of Justice can request these consent records during investigations or as part of data protection assessments. Having audit-ready exports is essential.
• Controllers must retain consent records for five years from the date of collection, which means building systems that persist well beyond standard data retention cycles.
• A consent management platform like Pandectes can log granular consent events, including sensitive data sales and “Do Not Sell” signals, store them for multi-year periods, and export evidence for audits or AG requests.

Teen Privacy and the Requirement for a Separate Consent Path

HB 380 requires a distinct and separate consent path for processing and selling personal data of consumers aged 13–18 for targeted advertising, sales, or profiling with legal or similarly significant effects. Minors aged 13 to 17 require affirmative consent for targeted advertising or profiling for major decisions. Consumers aged 13–18 need parental consent for targeted advertising under HB 380’s framework, and controllers who have actual knowledge or willful disregard of teen status cannot rely on generic banners.

These rules affect targeted advertising setups, look-alike audiences, remarketing programs, and cross-device tracking that rely on consumer data from younger users. For a Shopify fashion retailer with teen customers, this means designing a separate consent experience-for example, an age-aware preference center or checkout flow that blocks targeted advertising pixels until teen-specific consent is obtained.

A platform like Pandectes can help segment consent preferences by age bracket and enforce different rules for teen personas across tags and pixels, ensuring that ad scripts and analytics tools do not fire for minors without proper authorization.

Profiling, Automated Decision-Making, and Data Protection Assessments

HB 380 sharpens rules around profiling and automated decisions producing legal or similarly significant effects. Controllers processing 50,000 consumers must document a DPIA (data protection impact assessment) when their profiling creates outcomes in housing, credit, insurance, employment, health care, or access to essential goods and services.

These data protection assessments must cover:

• Purpose and deployment context of the profiling
• Categories of consumer data used, and personal data relied upon for decisions
• Expected benefits vs. foreseeable harms (controllers must assess foreseeable harms in profiling DPIAs)
• Risk mitigation measures and technical and organizational measures in place
• Mechanisms for human review where appropriate-consumers can request human review of automated decisions
• Post-deployment monitoring and safeguards
• Transparency measures and de-identification practices

Profiling tied to automated decisions requires ongoing evidence of compliance-not just a one-time assessment. Proactive anti-bias testing matters for profiling claims, and a lack of anti-bias testing documentation and evidence can weigh against organizations if enforcement actions occur.

For e-commerce, common automated decisions include fraud screening, dynamic pricing, credit or BNPL eligibility checks, and offer personalization. Businesses using AI-driven tools should align their profiling documentation with Delaware requirements while leveraging work they may already be doing for GDPR or CCPA-style privacy laws.

Third-Party Relationships, Contracts, and Due Diligence

HB 380 requires more precise management of third parties, data processors, adtech vendors, analytics tools, and any parties that receive consumer data. Third parties acquiring personal data now face DPDPA obligations directly, regardless of whether they meet the numeric thresholds independently.

Contracts with third parties must specify limited purposes for data use and include DPDPA-level protections, security measures, audit or oversight rights, and notification obligations for data breach or misuse. Controllers must disclose personal data only under these contractual constraints, and the contracts should address de-identified or pseudonymous data to prevent re-identification.

Controllers must conduct due diligence on third-party data recipients before onboarding them. This reasonable diligence process includes questionnaires, review of relevant documents and policies, assessment of technical and organizational measures, and ongoing oversight scaled to data sensitivity. You need to identify relevant recipients of consumer data and maintain up-to-date sharing inventories because Delaware consumers can now request a list of third parties disclosing their data-including named third-party recipients, not just categories.

A centralized consent and cookie scanning tool like Pandectes can automatically discover tags, pixels, and third-party scripts on your Shopify store and feed this into third-party disclosure data, third-party governance workflows, and consumer disclosures.

Expanded Consumer Rights and Visibility Into Data Flows

Beyond the original DPDPA, HB 380 gives consumers expanded rights: confirmation of processing, access to personal data (including inferences), correction, deletion, portability, and opt-out of targeted advertising, sale of personal data, and profiling producing legal or similarly significant effects.

The most notable new right: consumers can request a list of named third parties receiving their data, not just categories. If listing every single party is unreasonably difficult, controllers may provide a broader category-based list-but “unreasonably difficult” is a high bar. This means your consumer’s data flows must be documented, current, and accessible.

Controllers must provide clear, user-friendly opt-out mechanisms on websites and mobile apps, including links that function across web, mobile, and connected devices. Businesses must update privacy notices to accurately reflect their data practices, using product- and service-specific language, not generic boilerplate.

Organizations should integrate Delaware-specific rights handling into existing global privacy operations, tying access and deletion workflows with vendor notifications to ensure that when a consumer opts out, downstream third-party data usage stops.

Conclusion

Delaware’s HB 380 marks a significant evolution in privacy compliance, setting a new standard for businesses operating in the state starting January 1, 2027. By lowering applicability thresholds, expanding the definition of sensitive data, and introducing stricter consent and third-party due diligence requirements, the law demands a thorough reassessment of data practices. For Shopify stores and e-commerce businesses, this means updating consent mechanisms, managing sensitive data with greater care, and ensuring transparency in third-party disclosures.

With consumers gaining greater visibility into how their personal data is used and sold, and with enhanced protections for minors and profiling activities, HB 380 aligns Delaware with the most comprehensive consumer privacy laws in the U.S. Preparing now, mapping data flows, revising contracts, and implementing robust consent and preference experiences will be crucial to achieving compliance and maintaining consumer trust.

Leveraging tools like Pandectes can simplify these complex requirements, helping businesses stay ahead of evolving privacy standards while delivering seamless, compliant consumer experiences. Embracing these changes not only ensures legal compliance but also demonstrates a commitment to respecting consumer privacy in an increasingly data-driven world.