NetChoice urges Delaware Governor Meyer to veto HB 380. This bill abandons a balanced, multi-state framework to create a highly restrictive, state-specific regulatory outlier. By enacting overly broad definitions of sensitive data and pulling routine business operations and ordinary HR tools into its scope, the bill saddles online businesses with costly and unprecedented compliance mandates.
NetChoice Veto Request Letter to Gov. Meyer on Delaware HB 380, An Act Relating to Personal Data Privacy
July 14, 2026
The Honorable Matt Meyer
Office of the Governor
Tatnall Building
150 Martin Luther King Jr. Blvd South
Dover, DE 19901
Dear Governor Meyer:
On behalf of NetChoice, a trade association of leading online businesses that promotes the values of free enterprise and free expression on the internet, we write to respectfully urge you to veto House Bill 380 as amended by House Amendment 2.
Our members depend on the ability to responsibly collect, analyze, and share data to deliver the free and low-cost digital services, personalized experiences, and advertising that consumers rely on every day, including in Delaware.
NetChoice supported Delaware’s original approach to consumer privacy, which tracked the multistate consensus framework already adopted by more than twenty states. That framework strikes a careful balance: it protects consumers while preserving the online advertising, e-commerce, and content-personalization ecosystem that allows digital businesses to reach customers efficiently. HB 380 abandons that balance. It saddles internet businesses with the single most restrictive and Delaware-specific data regime in the country, and it does so through an amendment that was introduced, passed by voice vote, and pushed through final passage in a matter of weeks, without meaningful engagement with the online businesses it will most affect.
HB 380 Would Make Delaware a Regulatory Outlier
Delaware’s current privacy law is aligned with the consensus adopted by more than twenty other states, which lets online businesses run a single national compliance program instead of fifty separate ones. HB 380 breaks that alignment across nearly every major provision in the bill – its sensitive-data rules, its contracting mandates, and its treatment of automated decisions all diverge from what every other state requires, several with no parallel anywhere in the country. The result is a Delaware-only compliance regime: online businesses would need to build systems, contracts, and consent flows specific to this one state, layered on top of the programs they already run everywhere else.
That is a real cost, not just a compliance inconvenience. Companies deciding where to locate engineering or data-operations jobs, or which state’s consumers to prioritize for new digital products and features, will treat a Delaware-only regime as a genuine disincentive – all without a clear, corresponding gain in consumer protection beyond what Delaware’s existing law, and federal protections like the Fair Credit Reporting Act, already provide.
Sweeping New Definitions Would Capture Routine Online Data and Everyday Business Decisions
Much of HB 380’s reach comes not from new prohibitions but from quietly rewritten definitions. “Sensitive data” is expanded to include inferences “used to reveal or identify” any other data point that is itself sensitive – a second-order standard found in no other state. Because nearly any browsing, purchase, or app-usage history could theoretically be used to infer something about a person’s health, beliefs, or background, this would sweep routine e-commerce and analytics data into a category requiring opt-in consent by default. Even Colorado, the only state that reaches inferences at all, limits the concept to inferences that directly identify a sensitive attribute – not this open-ended chain of inference HB 380 creates.
The bill also deletes “solely” from the automated-decision standard and extends opt-out rights to any decision with legal effect made by any entity, not just the controller. An algorithm that personalizes marketplace search results, screens a transaction for fraud before a human reviews it, or helps a streaming service hold onto a free-tier subscriber is a preliminary, human-supervised process today. Under HB 380, each would face the same disclosure and opt-out burden as a fully automated decision, removing any incentive to keep a person in the loop. And by redefining “resident” to include any natural person residing in Delaware rather than limiting key provisions to “consumers,” HB 380 pulls employee data into a law that, in every other state, is built for customers – sweeping in scheduling software, background-check vendors, and ordinary HR tools that were never meant to be regulated this way.
New Contracting and Diligence Mandates Would Impose Costs No Other State Requires
HB 380 requires a binding contract and formal due diligence before any online business discloses data to a third party – including an ad exchange, a publisher network, or any other independent recipient acting as its own controller, not merely a vendor processing data on the company’s behalf. No other state extends contracting and diligence obligations this far. A smaller online seller with no leverage over a national ad platform will not be able to negotiate bespoke terms; it will simply lose access to targeted advertising that larger, out-of-state competitors can still use elsewhere. The bill compounds this by stripping the “reasonableness” limit on processor information requests, so vendor agreements that today are largely uniform across states would need Delaware-specific rewrites – and by conditioning any sale of sensitive data on a “strictly necessary” standard, used in only one other state, that sits in direct tension with the consent requirement layered on top of it.
These are sweeping changes to move through in a hurry. NetChoice respectfully urges you to veto House Bill 380 as amended and allow a more deliberate process, with input from the online businesses this bill would most affect, to produce workable updates that keep Delaware aligned with the national consensus.
Sincerely,
Amy Bos
Vice President of Government Affairs, NetChoice (The views of NetChoice expressed here do not necessarily represent the views of all NetChoice members.)
NetChoice is a trade association that works to make the internet safe for free enterprise and free expression.