For years, California has been treated as the benchmark for U.S. consumer privacy law.

That reputation makes sense. The California Consumer Privacy Act, later expanded by the California Privacy Rights Act, created a dedicated privacy regulator, mandatory Global Privacy Control recognition, detailed regulations, sensitive-data rights, automated decisionmaking requirements, cybersecurity audit obligations for certain businesses, and an increasingly active enforcement program.

But companies using California as their maximum-compliance baseline may now have a problem.

Delaware is moving beyond California in several important areas.

On September 2, 2026, Delaware Governor Matt Meyer signed House Bill 380, substantially strengthening the Delaware Personal Data Privacy Act. The amendments take effect January 1, 2027. Delaware described the package as creating some of the broadest consumer privacy protections in the United States.

That claim deserves attention.

The important point is not that Delaware has suddenly replaced California in every category. It has not. California still has its own highly developed regulatory regime, a dedicated privacy agency, the Delete Act, mandatory recognition of opt-out preference signals, extensive regulations and a significant enforcement record.

The more interesting development is that Delaware has adopted requirements that are, in several respects, more restrictive than California’s.

That distinction matters for privacy teams, advertising platforms, publishers, retailers, healthcare organizations, data brokers and companies operating consent management platforms.

A compliance program built entirely around the question:

“Are we CCPA compliant?”

may no longer be asking the right question.

The emerging question is:

“Are we compliant with the most restrictive obligation applicable to this particular processing activity?”

Increasingly, the answer may come from Delaware.

Delaware dramatically lowers the threshold for coverage

One of the clearest differences between California and Delaware is simply how easy it is for an organization to become subject to the law.

California’s CCPA generally applies to for-profit businesses doing business in California that meet at least one statutory threshold. The current indexed revenue threshold is $26.625 million. The statute also covers businesses that buy, sell or share the personal information of 100,000 or more California residents or households, or derive at least 50% of annual revenue from selling or sharing consumers’ personal information.

Delaware goes much lower.

Beginning January 1, 2027, the Delaware statute applies to organizations conducting business in Delaware or targeting Delaware residents that processed the personal data of at least 10,000 consumers during the previous calendar year.

Alternatively, an organization can qualify if it processes the data of at least 5,000 consumers and derives more than 20% of gross revenue from selling personal data.

The amended statute also separately brings within its scope certain third parties that acquire personal data from controllers.

That is a significant difference.

A company could be far too small to meet California’s CCPA applicability thresholds and still comfortably fall under Delaware.

Consider an online business with:

• $8 million in annual revenue;
• 25,000 Delaware users;
• no meaningful revenue from selling personal information.

It may fall outside the CCPA’s principal business thresholds.

It can nevertheless be covered by Delaware.

The result is that Delaware’s law potentially reaches much deeper into the small and mid-sized business market.

For privacy practitioners accustomed to treating California as the starting point for U.S. privacy compliance, that requires a change in thinking.

Delaware applies to nonprofits

California’s CCPA is fundamentally directed at qualifying for-profit businesses, although certain relationships with covered businesses can bring other entities into portions of the statutory framework.

Delaware is different.

The Delaware Department of Justice expressly says the DPDPA applies to both for-profit and nonprofit businesses.

That can materially expand the compliance universe.

Universities, associations, foundations and other nonprofit organizations cannot assume that the traditional commercial-business framing of the CCPA protects them from state comprehensive privacy law.

Delaware’s statute also expressly excludes state governmental bodies while making clear that institutions of higher education are not covered by that governmental exclusion.

For certain organizations, that alone makes Delaware more consequential than California.

Sensitive Data: Delaware Starts With Consent

The most important difference may involve sensitive personal data.

California gives consumers a right to limit certain uses and disclosures of sensitive personal information.

The California Privacy Protection Agency explains that consumers can direct businesses to restrict sensitive personal information to certain statutorily permitted purposes. Businesses using sensitive information beyond those purposes generally must provide a mechanism such as a “Limit the Use of My Sensitive Personal Information” link or an appropriate alternative.

That framework is fundamentally different from Delaware’s.

Delaware generally requires affirmative consent before processing sensitive data.

The Delaware Department of Justice states the rule plainly:

Businesses collecting sensitive information must obtain affirmative consent.

It also says consumers must be able to withdraw that consent as easily as they provided it.

That changes the compliance architecture.

California often works conceptually like this:

Sensitive data collected or used
        ↓
Consumer receives disclosure
        ↓
Consumer may exercise a right to limit

Delaware is closer to:

Sensitive data identified
        ↓
Has valid consent been obtained?
     ↙        ↘
   NO          YES
   ↓            ↓
DO NOT       PROCESS
PROCESS

That is not a minor wording difference.

It moves the default from a form of permissible processing subject to consumer control toward permission before processing.

For technology companies, advertising platforms and websites, that can require completely different implementation logic.

Delaware’s definition of sensitive data is also expanding

House Bill 380 expanded the categories receiving heightened treatment.

According to Delaware’s official announcement, the amended statute adds protections around categories including:

• national origin;
• citizenship and immigration status;
• pregnancy and treatment status;
• transgender or nonbinary status;
• neural data;
• financial-account credentials;
• government-issued identification numbers.

Delaware also specifically addresses inferences used to reveal or identify sensitive characteristics.

The inference provision deserves particular attention.

Privacy programs traditionally focus on data that an organization directly collects.

For example:

Religion = Jewish
Health condition = diabetes
Sexual orientation = gay
Immigration status = visa holder

Modern advertising and AI systems often do not need a consumer to provide those fields explicitly.

A company might infer them from:

websites visited
+
purchases
+
search terms
+
location
+
content engagement
+
demographics
+
machine-learning models

Delaware’s approach recognizes that inferred sensitive information can present the same privacy concerns as directly collected sensitive information.

That matters for adtech, data brokers, AI platforms and profiling systems.

Selling Sensitive Data Becomes Much Harder

The 2026 amendments impose an especially demanding framework around sales involving sensitive personal information.

The final amendments require clear and conspicuous notice before the sale of sensitive data. That notice must identify the specific categories of sensitive information involved, explain the purpose of the disclosure and identify the third parties receiving the data.

The controller must then obtain the consumer’s consent.

It must also maintain a record of that consent for five years.

This moves well beyond a generic:

“We may share information with advertising partners.”

The operational requirement becomes something closer to:

What sensitive data?
↓
Why is it being sold?
↓
Who is receiving it?
↓
Did the consumer affirmatively agree?
↓
Can we prove that agreement?
↓
Can we still prove it five years later?

That is a much heavier compliance burden.

It also creates an evidentiary obligation.

A company cannot merely argue that consent probably existed.

It should be able to produce the consent record.

Consent records become compliance evidence

This is where privacy technology becomes important.

If Delaware requires consent records to be retained for five years in certain sensitive-data sales, the system needs to preserve information such as:

consumer/session identifier
timestamp
consent language presented
categories of data covered
purpose
recipient/third party
consent action
policy version
CMP version
withdrawal status

That looks less like a traditional cookie banner and more like a transaction ledger.

A company should be able to answer:

Who consented to what, when, under which disclosure, and to which recipient?

That is a much higher standard than simply recording:

marketing = true

Delaware raises the age for heightened advertising protection to 18

California has long been notable for requiring opt-in authorization for the sale or sharing of personal information belonging to consumers known to be under 16.

For children under 13, the parent or guardian provides authorization. Consumers between 13 and 16 can generally opt in themselves under the CCPA framework.

Delaware goes further.

The Delaware Department of Justice says controllers must obtain opt-in consent before selling personal data or processing it for targeted advertising when the consumer is under 18.

The amended statutory text similarly applies the requirement where a controller has actual knowledge or willfully disregards that a consumer is at least 13 but younger than 18.

That difference matters enormously to publishers, gaming platforms, streaming companies, social media services and advertising platforms.

California’s special protection ends at 16 for this purpose.

Delaware extends it through age 17.

For a national business, maintaining entirely separate advertising logic for:

California 16+
Delaware 18+

may make little operational sense.

Companies may eventually decide that 18 is the safer national threshold.

That is how a relatively small state can influence national product design.

Targeted Advertising Is Directly Regulated

The Delaware statute gives consumers the ability to opt out of processing for targeted advertising.

But for minors under 18, Delaware effectively changes targeted advertising into an opt-in activity when the statutory knowledge standard is met.

That has consequences for the entire advertising stack.

Consider:

Visitor
↓
Website
↓
CMP
↓
Google Tag Manager
↓
Advertising pixel
↓
DSP
↓
Audience building
↓
Retargeting

If the visitor is a Delaware minor and the business knows or willfully disregards that fact, simply providing a “Do Not Sell or Share” mechanism after the advertising technology fires may not satisfy the requirement.

The architecture needs to prevent the processing until the required consent exists.

That brings Delaware privacy compliance directly into consent-management engineering.

Delaware is imposing stronger third-party contractual controls

Another important part of HB 380 concerns data disclosed to outside organizations.

The legislation requires controllers to enter into binding agreements with third parties receiving personal data, including recipients involved in sales and targeted advertising.

The statutory language requires those contracts to specify limited and defined purposes for the data and obligate the third party to provide the same level of privacy protection required under Delaware law.

The legislation also introduces broader third-party due-diligence obligations. Delaware’s official bill synopsis specifically describes HB 380 as adding contracting and due diligence requirements when businesses sell or disclose personal data.

That matters because privacy compliance has historically focused heavily on processor agreements.

The difficult ecosystem often exists farther downstream:

Business
↓
Advertising platform
↓
Data partner
↓
Measurement provider
↓
Audience provider
↓
Additional recipient

Delaware’s direction is clear.

Sending data to someone else is not the end of the controller’s responsibility.

The organization needs to understand where data is going and place enforceable restrictions around the recipient.

Delaware could make vendor due diligence much more important

A company should increasingly be able to answer:

• Who receives our customers’ data?
• What exact categories do they receive?
• Why do they receive it?
• Are they a processor or independent third party?
• Can they use the information for their own purposes?
• Can they build profiles from it?
• Can they disclose it again?
• Does the contract restrict secondary use?
• Does the recipient provide Delaware-equivalent protections?
• Do we periodically verify compliance?

That is far more sophisticated than maintaining a spreadsheet titled “vendors.”

It requires actual data mapping.

Delaware also narrows the financial-services escape hatch

Privacy statutes often contain exemptions connected to the Gramm-Leach-Bliley Act.

The scope of those exemptions varies significantly among states.

HB 380 changes Delaware’s treatment of GLBA-covered organizations and data.

The official bill synopsis says Delaware will exempt data regulated by the GLBA while limiting broader entity-level exemptions to specified banks, insurers and their affiliates.

That distinction is important.

An entity-level exemption effectively says:

This organization is regulated elsewhere,
so this privacy statute generally does not apply.

A data-level exemption says:

This particular GLBA-regulated data may be exempt,
but other information processed by the organization
can still fall under the privacy statute.

The second approach creates substantially more compliance work.

Financial organizations cannot necessarily conclude that everything they collect is outside the Delaware law merely because some of their operations are governed by GLBA.

Automated Decisions Become Another Area of Consumer Control

Delaware’s 2026 legislation also expands protections involving automated decisions.

The state’s announcement specifically identifies decisions affecting areas such as:

• loans;
• housing;
• employment.

Consumers receive additional ability to opt out when covered data is used in automated decisionmaking producing significant effects.

California is also regulating automated decisionmaking.

The California Privacy Protection Agency adopted regulations in 2025 addressing automated decisionmaking technology, risk assessments and cybersecurity audits, with the regulations becoming effective January 1, 2026.

This is therefore not an area where Delaware simply has a requirement and California does not.

The broader point is that both jurisdictions are increasingly treating privacy regulation as something much larger than cookies and privacy notices.

The regulatory perimeter now includes:

data collection
+
profiling
+
AI
+
automated decisions
+
advertising
+
sensitive data
+
vendor management

California is still stricter in important areas

Calling Delaware “more restrictive than California” requires some qualification.

California remains unusually demanding in several areas.

California requires covered businesses to recognize applicable opt-out preference signals such as Global Privacy Control. The California Attorney General has actively enforced that requirement.

California also now has extensive regulations covering risk assessments, cybersecurity audits and automated decisionmaking.

Its Delete Act created the state-operated Delete Request and Opt-Out Platform, or DROP. Beginning August 1, 2026, registered data brokers must retrieve and process consumer deletion requests through that system at least every 45 days.

California also has something Delaware does not: the California Privacy Protection Agency.

CalPrivacy is a dedicated regulatory agency with rulemaking and enforcement authority.

And California enforcement is no longer theoretical.

In February 2026, for example, California announced a $2.75 million settlement with Disney over allegations that the company failed to fully effectuate consumers’ opt-out requests across devices and services.

So this should not become a simplistic:

Delaware is tougher; California no longer matters.

The correct conclusion is more interesting.

Delaware and California are becoming strict in different ways

California’s model is heavily developed around:

consumer rights
regulations
opt-out signals
regulatory enforcement
data brokers
risk assessments
cybersecurity obligations

Delaware is increasingly aggressive around:

broad applicability
low coverage thresholds
sensitive-data consent
minor protections
targeted advertising
third-party transfers
vendor contracts
data minimization

A business can therefore satisfy a requirement in one state and still fail another state’s standard.

The Opt-Out Versus Opt-In Difference Is the Most Important

For many businesses, this is the core issue.

Consider sensitive information.

A traditional U.S. privacy architecture often assumes:

COLLECT
↓
DISCLOSE
↓
ALLOW OPT OUT

Delaware increasingly requires:

DISCLOSE
↓
OBTAIN CONSENT
↓
COLLECT / PROCESS

Those systems are fundamentally different.

An opt-out system assumes processing may begin unless the consumer objects.

An opt-in system assumes certain processing may not begin until authorization exists.

That changes:

• CMP configuration;
• tag-manager configuration;
• API behavior;
• pixel firing;
• mobile SDK initialization;
• server-side data flows;
• database processing;
• advertising audiences;
• AI and profiling systems.

That is why Delaware deserves much more attention than its population might suggest.

California Compliance May No Longer Be a Safe National Baseline

For years, companies frequently adopted a simple national strategy:

Build for California and we will probably satisfy everyone else.

That approach is becoming dangerous.

A California-centered system might permit a business to collect certain sensitive information and give consumers a subsequent right to limit its use.

Delaware may require consent before that processing occurs.

California’s heightened opt-in framework for sale or sharing focuses on consumers under 16.

Delaware’s targeted-advertising and sale protections extend to consumers under 18.

California principally regulates qualifying for-profit businesses.

Delaware covers nonprofits.

California uses considerably higher applicability thresholds.

Delaware reaches businesses processing as few as 10,000 consumers in the general threshold and potentially 5,000 under its revenue-from-sales threshold.

The safe national baseline is therefore becoming a combination of the strongest provisions across multiple states.

The Website Compliance Implications

For websites, this creates an immediate operational problem.

Suppose a Delaware visitor lands on a website that uses:

Meta Pixel
Google advertising tags
TikTok Pixel
session replay
audience enrichment
identity resolution
location tracking
health-interest profiling

The site cannot rely entirely on the logic developed for California.

It needs to determine:

Where is the visitor?
↓
What data are we collecting?
↓
Is any of it sensitive?
↓
How old is the user?
↓
What purpose are we processing it for?
↓
Are we selling or using it for targeted advertising?
↓
Does Delaware require consent?
↓
Has that consent actually been obtained?

Only then should the applicable technology operate.

This is exactly why modern CMPs increasingly require jurisdiction-aware behavior.

A Delaware visitor may need a different consent experience

A sophisticated implementation might behave something like:

CALIFORNIA VISITOR
------------------
Necessary → allowed
Analytics → context dependent
Advertising → allow subject to opt-out architecture
Sale/share → honor GPC and opt-out
Sensitive PI → provide applicable limitation controls
Under 16 → opt-in for applicable sale/share


DELAWARE VISITOR
----------------
Necessary → allowed
Sensitive-data processing → require affirmative consent
Targeted advertising → opt-out generally
Sale → opt-out generally
Under 18 targeted advertising → opt-in
Under 18 sale → opt-in
Sensitive-data sale → disclosure + consent + consent record

That should not be treated as definitive configuration advice for every company because exemptions, processing purposes and business models differ.

It does illustrate the architectural issue.

One national banner with identical behavior in all 50 states may no longer be sufficient.

GPC and Universal Consent Become More Important, Not Less

As state privacy requirements diverge, consumers cannot realistically be expected to configure preferences independently on thousands of websites.

That increases the importance of standardized preference signals.

California already requires businesses to recognize qualifying opt-out preference signals such as Global Privacy Control.

The broader direction of state privacy legislation makes universal preference management increasingly attractive.

A modern privacy architecture should be capable of ingesting:

GPC signal
IAB TCF signal
GPP signal
CMP preferences
account preferences
mobile-app preferences
server-side consent state

and reconciling them against jurisdiction-specific requirements.

The problem is no longer simply:

“Did somebody click Accept?”

It is:

“What processing is legally permitted for this consumer, in this jurisdiction, for this purpose, at this moment?”

Delaware also strengthens the case for real consent logs

The five-year consent-record requirement associated with certain sensitive-data sales makes logging particularly important.

Imagine receiving an Attorney General inquiry four years after an advertising campaign.

The company may need to establish:

Consumer consented
Date: March 14, 2027
Disclosure version: 4.2
Sensitive category: precise geolocation
Purpose: advertising measurement
Recipient: Vendor X
Consent status: affirmative
Withdrawal: none at transaction time

A screenshot of the company’s current privacy policy will not answer that question.

Neither will:

“Our CMP was installed.”

Consent must increasingly be treated as auditable data.

Data mapping becomes unavoidable

The Delaware amendments also expose another weakness in many privacy programs.

Companies cannot obtain meaningful consent for sensitive information if they do not know they are processing sensitive information.

They cannot disclose third-party recipients if they do not know who receives the information.

They cannot honor targeted-advertising rights if they cannot identify which technologies perform targeted advertising.

They cannot perform vendor due diligence if they cannot identify the vendors.

The compliance sequence therefore becomes:

DISCOVER
↓
CLASSIFY
↓
MAP
↓
DETERMINE LEGAL REQUIREMENT
↓
OBTAIN / APPLY PREFERENCE
↓
ENFORCE
↓
LOG
↓
CONTINUOUSLY MONITOR

That is why static privacy policies are increasingly inadequate as the core of a privacy program.

Delaware’s small population should not cause companies to ignore it

There is an understandable tendency to prioritize states by market size.

California has nearly 40 million residents.

Delaware has roughly one million.

But regulatory influence does not always correspond to population.

Delaware occupies an unusual position in American corporate law. Huge numbers of U.S. corporations are organized there, although incorporation by itself does not necessarily make the DPDPA applicable to every processing operation.

More importantly, businesses rarely build their entire technical architecture for a single small state.

If Delaware requires a stronger consent mechanism, a company has several choices:

1. Detect Delaware residents and create Delaware-specific behavior.

2. Extend Delaware's protections to a larger group of users.

3. Apply the strongest rule nationally.

At some point, option three becomes easier than maintaining dozens of state-specific configurations.

That is the mechanism by which stricter state laws can create de facto national standards.

The Emerging U.S. Privacy Standard Is No Longer California

It may be more accurate to say there is no single state baseline anymore.

The effective U.S. privacy standard is becoming an amalgamation of requirements.

A company might take:

California
→ GPC and extensive opt-out infrastructure

Delaware
→ sensitive-data opt-in and broader coverage

Other states
→ universal opt-out mechanisms, health-data rules,
minor protections or other specialized requirements

and build a national program around the most restrictive applicable obligations.

This is harder than simply copying a California privacy notice.

But it is where U.S. privacy law is going.

What Businesses Should Do Before January 1, 2027

Organizations that process Delaware residents’ information should begin with the data itself.

Identify what personal information is collected.

Then identify whether any of it falls into Delaware’s sensitive categories.

Map every third party receiving the data.

Determine which transfers qualify as sales.

Identify processing used for targeted advertising.

Review automated decision systems.

Determine whether minors may use the service.

Review vendor contracts.

Determine whether existing consent mechanisms can support Delaware’s affirmative-consent requirements.

Then test whether the technical systems actually honor those choices.

For websites, that includes confirming that advertising pixels, image requests, SDKs, APIs and server-side tracking do not begin prohibited processing before the necessary consent exists.

The distinction between policy and technology is becoming increasingly difficult to maintain.

Privacy law is now directly regulating software behavior.

California Is Still California. But Delaware Can No Longer Be Treated as a Secondary State.

California remains one of the most sophisticated and consequential privacy jurisdictions in the United States.

Its privacy agency, enforcement activity, regulations, GPC requirements, Delete Act and detailed compliance obligations ensure that California will remain central to any national privacy program.

But the assumption that CCPA compliance automatically represents the strongest U.S. privacy posture is becoming outdated.

Delaware’s 2026 amendments create meaningful differences:

Lower applicability thresholds.

Coverage of nonprofits.

Affirmative consent for sensitive-data processing.

Expanded categories of sensitive information.

Specific consent requirements around sensitive-data sales.

Five-year consent records in applicable sensitive-data sales.

Under-18 opt-in protections for targeted advertising and sales.

Stronger requirements governing third-party disclosures.

Additional controls involving automated decisionmaking.

Those are not cosmetic differences.

They change when businesses can collect information, when technology can activate, when advertising can begin and what companies must be able to prove afterward.

That is why privacy professionals are beginning to pay unusually close attention to Delaware.

The next generation of U.S. privacy compliance may not be built around one state’s law.

It may instead require businesses to take California’s enforcement and opt-out infrastructure, Delaware’s consent requirements, and the strongest provisions emerging elsewhere and combine them into one technical privacy framework.

For businesses that still think privacy compliance means adding a California privacy notice and a “Do Not Sell or Share” link, Delaware should be a warning.

The state privacy race has moved well beyond California.