Recent developments in Delaware, California, and Texas highlight a common theme that privacy compliance risk is becoming more operational and technical and more likely to arise from practices that may once have appeared routine. (1) Delaware has expanded the reach and substantive requirements of its comprehensive privacy law; (2) California continues its focus on data brokers by bringing a Delete Act action against a data broker; and (3) the Texas Attorney General has warned businesses about a surge in CIPA website tracking demand letters.
Delaware Broadens the DPDPA
On September 2, 2026, Delaware Governor Matt Meyer signed House Bill 380, which materially amends the Delaware Personal Data Privacy Act (“DPDPA”). Most changes become effective January 1, 2027.