Is Delaware Lowering Its Privacy Law's Consumer Threshold in 2027?

Yes. Delaware Governor Matt Meyer signed House Bill 380 on September 2, 2026, which lowers the Delaware Personal Data Privacy Act's base applicability threshold from 35,000 consumers to 10,000 consumers, effective January 1, 2027.

Old Threshold vs. New Threshold

Under the original 2023 version of the law, a business only had to comply if it controlled or processed the personal data of at least 35,000 Delaware consumers in a calendar year — a relatively high bar reflecting the state's small population. HB 380 cuts that base threshold to 10,000 consumers, meaning a much smaller business operating in or targeting Delaware residents will fall into scope once the amendment takes effect.

The Revenue-Sale Prong Also Dropped

Delaware's law has always included a second, lower threshold for businesses that derive a significant share of revenue from selling personal data. Under the original statute, that prong applied to businesses processing data of at least 10,000 consumers while earning 20% or more of gross revenue from data sales. HB 380 lowers that count to 5,000 consumers, tightening the net specifically around businesses whose model leans on selling consumer data.

Why Delaware Did This

Legal analyses of the amendment describe Delaware as positioning itself as one of the stricter state privacy regimes, closing a gap where its original 35,000-consumer threshold let more Delaware-facing businesses avoid the law entirely compared with peer states that set lower bars. One tracker covering the bill's passage frames the change as a deliberate move to substantially expand the law's practical reach starting in 2027.

What Changes for Marketers Specifically

• More mid-size businesses in scope: A business that reasonably concluded it was below Delaware's threshold in 2025 or 2026 should re-run that calculation against the new 10,000-consumer number before 2027.
• Lead-gen and data-broker-adjacent models face the tightest squeeze: The drop to 5,000 consumers on the revenue-sale prong specifically targets businesses that monetize data sales, a category that includes some marketing and lead-generation operations.
• Third parties receiving data may also be covered: At least one legal summary of the amendment notes it reaches third parties that acquire personal data from a controller, without a numeric threshold of their own — worth confirming with counsel if your business receives, rather than only collects, consumer data.

The Clock Is Already Running

With the amendment signed and an effective date of January 1, 2027, businesses have roughly a quarter to assess whether they newly fall into scope and to build out the operational pieces — privacy notices, data subject request handling, and risk assessments — that Delaware's law already requires of covered businesses today.

Bottom Line

Re-check your Delaware consumer counts against the new 10,000-consumer threshold now, not in December 2026 — the amendment takes effect January 1, 2027, and there's no indication of an extended grace period beyond that date.

Sources: Delaware HB 380 (signed September 2, 2026); IAPP, "Delaware Enacts HB 380: Key Updates to the Delaware Personal Data Privacy Act" (iapp.org); McDonald Hopkins, "Delaware Raises the Bar: Significant Amendments to Its Personal Data Privacy Act" (mcdonaldhopkins.com); National Law Review, "Delaware Expands State Privacy Law" (natlawreview.com).