Delaware Data Privacy Act Extends Rights to Consumers, Children

The Delaware Personal Data Privacy Act that went into effect earlier this month blocks businesses from targeting ads based on consumers data, requiring consumers to provide personal information, and discriminating against consumers based on their personal data.

Approved by state legislature in 2023, the law defines personal data as “any information that is linked or reasonably linkable to an identified or identifiable individual” including a name, address, phone number, email, or mobile device identifier.

“Businesses collect Delawareans personal data every day,” said Attorney General Kathy Jennings in a statement on Jan. 6. “This law not only gives Delawareans new rights to control their data, but also gives my office important tools to enforce consumers’ data privacy and safety,” the attorney general said.

Some of the specific rights provided to consumers include:

• Opt-in: Businesses must obtain permission from Delawareans to use or share sensitive data including information about ethnic origins, religion, sexual orientation, gender identity, precise location, and biometric data.
• Opt-out: Consumers can opt-out of the sale of their personal information, targeted advertising, and some types of automated decision making.
• Access and Deletion: Upon request and subject to limitations, businesses must provide consumers with the personal data the business has collected about them and permit corrections or deletions of the data.
• Non-Discrimination: Businesses are prohibited from using personal data to unlawfully discriminate against a Delaware consumer.

The law also offers new protection to children under the age of 18. The protections require businesses to get consent from children aged 13 to 17 in order to sell their personal data or to use targeted advertising.

For children under the age of 13, the law requires a business to obtain parents’ consent to use the child’s personal data.

“With the Delaware Personal Data Privacy Act now in effect, Delawareans – and most importantly, our children are armed with stronger privacy protections and more control over their online data,” said state Rep. Krista Griffith, lead sponsor of the law.

The act also requires businesses to post “plain language disclosures” of their data collection and sharing policies. The Delaware Department of Justice is responsible for ensuring businesses comply with the provisions of the act.

“I applaud Attorney General Jennings and her team for their commitment to personal liberties and public safety, and for their collaboration with legislators in crafting privacy laws that empower individual Delawareans to determine what kind of data usage works best for them and their families,” said state Sen. Bryan Townsend, who sponsored the bill in the upper chamber of the state’s legislature.