Delaware Just Lowered the Bar for Privacy Law — 10,000 Customers Could Trigger It

If your business has an email list of 10,000 people, a customer database from a few good years of sales, or a loyalty program with more members than a small town, you may have just become subject to the toughest consumer privacy law in the United States — even if you've never set foot in Delaware.

On September 2, 2026, Delaware Governor Matt Meyer signed two bills that rewrite the state's Delaware Personal Data Privacy Act, dropping the compliance threshold from 35,000 Delaware consumers down to just 10,000. If your business earns more than 20% of its revenue from selling personal data, the bar drops even lower, to 5,000 consumers. According to the governor's office, that's the lowest threshold of any privacy law in the country.

Why 10,000 Is a Number Small Businesses Should Pay Attention To

Most state privacy laws were written with large corporations in mind. California's law, for comparison, generally only applies to businesses with at least $26.6 million in annual revenue or those handling data on 100,000-plus consumers. Delaware's old threshold of 35,000 already put more small and mid-sized companies in scope than most states. Cutting that number to 10,000 pulls in a much wider slice of Main Street: regional e-commerce sellers, subscription box companies, local service franchises, marketing agencies, and any business running a customer loyalty or rewards program.

Here's the part that catches owners off guard: these laws typically don't care where your company is headquartered. If you do business in Delaware or offer products and services targeted to Delaware residents, and you cross the consumer threshold, you're generally in scope — regardless of whether your storefront, warehouse, or headquarters sits in Ohio, Texas, or California.

What the New Law Actually Requires

The legislation, primarily contained in House Bill 380, focuses heavily on how sensitive personal data gets handled. Under the updated law, businesses cannot sell sensitive data unless doing so is strictly necessary to provide the product or service the customer actually requested — and even then, only with clear notice and the consumer's consent.

The law also expands protections around automated decision-making. If your business uses software or algorithms to help decide who gets approved for financing, who gets hired, or who qualifies for a lease or apartment, Delaware consumers now have a stronger right to opt out of having those decisions made about them in an automated way, and a right to understand how the decision was reached.

Consumer advocacy groups, including Consumer Reports, publicly praised the signing, framing it as a direct response to heavy lobbying from large technology companies that pushed to keep thresholds high and protections narrow. State officials involved in the bill's passage specifically called out that lobbying pressure when describing why they felt a stronger law was necessary.

The Compliance Clock: January 1, 2027

Businesses have a runway before enforcement begins. The law takes effect January 1, 2027, which gives owners roughly four months from today to figure out whether they're covered and, if so, to get their house in order. Four months sounds like a long time until you consider what's actually involved: a full inventory of what personal data you collect, where it's stored, who you share it with, and whether any of it qualifies as "sensitive" under the law (think health information, precise geolocation, racial or ethnic origin, or data about minors).

A Practical Starting Checklist

• Count how many unique Delaware residents' personal data you actually hold or process — not your total customer count nationally, just the Delaware slice.
• Identify whether any of that data is "sensitive" under the law's definition, and whether you're currently selling or sharing it with third parties like ad networks or data brokers.
• Review your privacy policy and update consent flows so sensitive data isn't sold without explicit, informed opt-in.
• Map out any automated decision-making tools you use in hiring, lending, or tenant screening, and build a process for consumers to opt out or request an explanation.
• Loop in a business attorney or compliance consultant if you're anywhere close to the 10,000-consumer line — the cost of a review is far lower than the cost of a violation.

Part of a Bigger Pattern

Delaware isn't acting alone. States including Connecticut have also been tightening their privacy thresholds this year, and momentum is building nationally toward lower bars and broader coverage rather than higher ones. For a small business, that means privacy compliance is quickly shifting from "something big tech worries about" to a standard cost of doing business, similar to sales tax or workers' comp insurance. If your business is still operating without a written privacy policy, or hasn't looked at one since before 2024, this is a reasonable moment to fix that. It's also worth having a clean handle on your basic business structure and financial recordkeeping before layering in new compliance obligations — a solid LLC formation foundation and clean profit and loss statement practices make it far easier to track exactly what data flows through which parts of your business.

What to Watch Next

Expect other states to reference Delaware's new threshold as a benchmark in their own upcoming legislative sessions. Privacy law in the U.S. remains a patchwork — there's still no single federal standard — which means a business selling into multiple states may eventually need to comply with several different thresholds and rules simultaneously. For now, the most useful thing an owner can do is figure out, concretely, how many Delaware residents are in their customer file. If that number is anywhere near five figures, it's worth getting ahead of January 1 rather than finding out the hard way after it arrives.

Photo by Conny Schneider on Unsplash