On this page
Delaware HB 380 takes effect January 1, 2027: signed September 2, 2026, it lowers the Delaware Personal Data Privacy Act's main threshold from 35,000 to 10,000 consumers and adds health treatment, status and inferences to the law's definition of sensitive data, which a business may process only with the consumer's consent (bill page; engrossed bill). It also requires contracts with, and due diligence on, third parties “to whom personal data is disclosed, including in a sale of personal data or for targeted advertising” (engrossed bill). Curve Compliance strips PHI before data reaches an ad platform and signs a BAA on every plan.
Book a call. Have Delaware patients or visitors? Curve Compliance sends conversions to ad platforms server-side with a fixed list of fields, and its consent management holds back tracking until each visitor's choice allows it. Curve's team does the setup, typically live in about a week. Book a call with Curve.
What changes on January 1, 2027
The bill page lists HB 380 as “Signed 9/2/26” (Delaware General Assembly), and the act says: “This Act is effective January 1, 2027” (engrossed bill). The Delaware Code already shows each changed section in two versions, one effective until January 1, 2027 and one effective from that date (Delaware Code, Chapter 12D). The changes that matter most for health marketing:
| Topic | Until December 31, 2026 | From January 1, 2027 |
|---|---|---|
| Main threshold | Personal data of at least 35,000 consumers | At least 10,000 consumers, not counting data used only to complete a payment |
| Data-sale threshold | At least 10,000 consumers and more than 20% of revenue from selling data | At least 5,000 consumers and more than 20% of revenue from selling data |
| Health in sensitive data | Mental or physical health condition or diagnosis | Condition, diagnosis, treatment or status, plus inferences that reveal them |
| Processing sensitive data | Consumer consent | Consent, and processing that is reasonably necessary and proportionate |
| Third parties | No third-party contract or due diligence duty in § 12D-106 | Binding contracts, reasonable due diligence and a new § 12D-107A on third-party duties |
Each row compares the two versions of the Delaware Code (Delaware Code). The new text comes from HB 380's inserted language (engrossed bill).
Who it applies to
From 2027, the law reaches “persons that conduct business in this State or persons that produce products or services that are targeted to residents of this State” that, in the preceding calendar year, “Controlled or processed the personal data of not less than 10,000 consumers, excluding personal data controlled or processed solely for the purpose of completing a payment transaction,” or 5,000 consumers with more than 20% of gross revenue from selling personal data (Delaware Code § 12D-103). HB 380 also adds a new line to that list: “Third parties who acquire personal data from a controller” (engrossed bill).
A telehealth brand outside Delaware that markets to Delaware residents can meet the test. So can a regional clinic group whose website, forms and booking tools collect data from 10,000 Delaware residents in a year.
Health data as sensitive data, including inferences
HB 380 rewrites the health part of the sensitive data definition to cover “condition, diagnosis, treatment, or status” and adds that sensitive data “includes inferences made based on personal data, alone or in combination with other data, that are used to reveal or identify any of the following” (engrossed bill). In the 2027 text, the list starts with data that reveals or identifies “mental or physical health condition, diagnosis, treatment, or status (including pregnancy)” (Delaware Code § 12D-102).
For a clinic website, the inference language is the part to read twice. A tag that records a visit to a weight loss, fertility or addiction treatment page sends the page address with the visit, and that combination can be the kind of inference the definition describes. Separately, the law already lets consumers opt out of “Targeted advertising,” which it defines as ads “selected based on personal data obtained or inferred from that consumer's activities over time and across nonaffiliated Internet websites or online applications to predict such consumer's preferences or interests” (Delaware Code).
Consent plus "reasonably necessary and proportionate"
Under HB 380, a controller may not process sensitive data unless “The consumer consents to the processing of sensitive data” and “The processing of sensitive data is reasonably necessary and proportionate to the disclosed purposes for processing sensitive data” (engrossed bill). The law defines consent as “a clear affirmative act signifying a consumer's freely given, specific, informed and unambiguous agreement” (Delaware Code). A visitor who closes a banner has not done that.
Delaware already requires controllers to honor opt-out preference signals: “Not later than January 1, 2026, allowing a consumer to opt out of any processing of the consumer's personal data for the purposes of targeted advertising, or any sale of such personal data, through an opt-out preference signal” (Delaware Code § 12D-106).
Vendor contracts and due diligence
HB 380 adds two duties for controllers. First, “Enter into binding contractual agreements with third parties to whom personal data is disclosed, including in a sale of personal data or for targeted advertising,” with terms that limit purposes and bind the third party to the chapter. Second, “Conduct reasonable due diligence, either by the controller or through a designated assessor, of third parties to whom the controller discloses personal data, including the sale of personal data and targeted advertising.” The bill sets a floor: “Reasonable due diligence involves, at a minimum, assessing the third party through the use of questionnaires and review of relevant documents of the third party.” It adds: “Additional reasonable measures must be undertaken in a manner that is commensurate with the sensitivity of the data disclosed by the controller to the processor or third party” (engrossed bill).
A new § 12D-107A puts duties on the other side: “A third party must provide necessary information for the controller or the controller's designated assessor to assess the third party” (Delaware Code § 12D-107A). For a clinic, every pixel, tag manager, analytics script and ad platform that receives visitor data is a candidate for that questionnaire.
HIPAA and other exemptions
The 2027 version of § 12D-103 keeps a data-level HIPAA exemption: the chapter does not apply to “Protected health information under HIPAA.” HB 380 adds health items to the data list, including “Information created for purposes of the Federal Health Care Quality Improvement Act of 1986 and related regulations,” information derived from PHI and “deidentified as provided under 45 C.F.R. § 164.514,” and information in a “Limited Data Set as described under 45 CFR § 164.514(e)” used in the manner that rule specifies (engrossed bill; Delaware Code § 12D-103). See the HIPAA limited data set.
The entity exemptions in § 12D-103(b) list government bodies and certain insurance, banking and securities organizations. They do not name HIPAA covered entities or business associates (Delaware Code § 12D-103). So the question for a clinic is which of its data is PHI and which is not, such as website data about visitors who never become patients. Where that line falls depends on your facts, so talk to your counsel. For Oklahoma and Louisiana, see Oklahoma and Louisiana privacy laws 2027.
Enforcement
“The Department of Justice has enforcement authority over this chapter,” a violation “shall be enforced solely by the Department of Justice,” and nothing in the chapter provides “the basis for, or be subject to, a private right of action” (Delaware Code § 12D-111). Since January 1, 2026, the Department may weigh factors such as the number of violations and “The substantial likelihood of injury to the public” in deciding whether to offer a chance to cure (Delaware Code § 12D-111).
What a clinic site should check before January 1
- Count Delaware consumers. Estimate how many Delaware residents your site, forms and booking tools collect data from in a year, against the 10,000 line (Delaware Code § 12D-103).
- List what fires on health pages. Curve's free website scan lists the pixels and trackers on a page. Start with treatment, condition and booking pages.
- Hold tags until consent. Tags that could reveal a condition or treatment should wait for a clear affirmative act, and opt-out signals should be honored.
- Paper every third party. Sort vendors into third parties, such as ad platforms used for targeted advertising, and processors that act only on your behalf. Third parties need a contract with the terms HB 380 lists and due diligence that includes questionnaires and document review; processors need the contract § 12D-107 describes (Delaware Code).
- Update the privacy notice. From 2027, consumers can ask for a list of the third parties that received their data, with limited exceptions (Delaware Code § 12D-104).
For the full list of 2027 dates, see the 2027 healthcare marketing compliance calendar, and for other states, the state health privacy laws reference table. This month's other changes are in health marketing compliance news for November 2026.
How Curve Compliance helps
Curve's consent management has a row for every US state, and you can switch any state between opt-in and opt-out. It holds back tracking and ad forwarding until each visitor's choice allows it, honors Global Privacy Control in every region, and records every accept, decline, change and withdrawal in an append-only audit log you can export as CSV.
Conversions go to Meta, Google Ads, TikTok, Microsoft Advertising and LinkedIn server-side. Curve checks every event for PHI-like patterns and strips PHI before data reaches an ad platform, each platform receives only a fixed list of fields, events can use neutral names, and contact identifiers are off by default on Meta, Google Ads and TikTok. For your due diligence file, Curve's security page sets out what Curve gives a security review: SOC 2 Type II, a BAA on every plan, server-side delivery with a fixed list of fields, PHI stripped before data reaches an ad platform, and Event Logs that show what Curve sent and what each platform accepted. Curve's team does the setup, typically live in about a week.
Sources, checked November 2, 2026: Delaware General Assembly, HB 380 bill page; HB 380 as amended by House Amendment 2, engrossed PDF; Delaware Code, Title 6, Chapter 12D.
Frequently Asked Questions
When does Delaware HB 380 take effect?
January 1, 2027. The governor signed it on September 2, 2026, and the act says “This Act is effective January 1, 2027” (bill page; engrossed bill).
Does Delaware's privacy law apply to my practice?
It can, if you do business in Delaware or target Delaware residents and processed personal data of at least 10,000 consumers in the prior year, from 2027 (Delaware Code § 12D-103). Your PHI is exempt, but other data may not be.
Is health data sensitive data under Delaware law?
Yes. From 2027 it includes data that reveals or identifies a “mental or physical health condition, diagnosis, treatment, or status (including pregnancy)” (Delaware Code § 12D-102).
Do inferences from website visits count as health data in Delaware?
They can. HB 380 adds “inferences made based on personal data, alone or in combination with other data, that are used to reveal or identify” sensitive categories, including health (engrossed bill).
What vendor due diligence does HB 380 require?
Reasonable due diligence of third parties that receive personal data, which “involves, at a minimum, assessing the third party through the use of questionnaires and review of relevant documents of the third party” (engrossed bill).
Does HIPAA exempt a clinic from Delaware's law?
Delaware exempts “Protected health information under HIPAA,” not HIPAA covered entities as such (Delaware Code § 12D-103). Data that is not PHI can still fall under the law.
Who enforces Delaware's privacy law?
The Department of Justice, solely, and the chapter gives no private right of action (Delaware Code § 12D-111).
Talk to Curve Compliance
Book a call. Getting ready for Delaware's 2027 rules? Curve Compliance holds tags until each visitor's choice allows them, sends conversions server-side with a fixed list of fields and signs a BAA on every plan. Curve's team does the setup, typically live in about a week. Book a call with Curve.