Delaware Makes A Dozen States With A Comprehensive Privacy Law

On June 30, the Delaware legislature passed the Personal Data Privacy Act ("the Act"). The Act now moves to the Delaware Governor's desk for consideration and, if signed into law, will make Delaware the seventh state this year to pass comprehensive privacy legislation (joining Oregon, Iowa, Indiana, Montana, Tennessee, and Texas) and the twelfth state overall with a comprehensive privacy law.

The Delaware Act is similar to the privacy laws passed in Colorado, Connecticut and Oregon in terms of having stronger privacy protections for consumers (compared to the laws that have passed in states like Utah, for example). Like the laws in Colorado and Connecticut, the Act requires opt-in processing for sensitive data, explicitly prohibits consent obtained through dark patterns, requires recognition of opt-out preference signals, and creates an opt-out requirement for profiling in furtherance of solely automated decisions that produce legal or similarly significant effects