Technology (Consumer Data Protection)

This House Substitute for House Bill No. 453 prohibits surveillance-based price discrimination by forbidding the use of automated decision systems to set individualized consumer prices based on personal data, metadata, or proxy data, such as device identifiers and digital behavioral patterns, used to infer a consumer's socioeconomic status or urgency of purchase. While the Act establishes safe harbors for discounts based on lawful, objective criteria (e.g., military, student, or senior status), it ensures that rewards and loyalty programs are not used to circumvent these protections by requiring that such discounts remain uniform across membership and are not individualized through algorithmic profiling. This Substitute differs from the original bill by adding a definition of electronic shelving labels and provides language that protects loyalty programs. It also carves out financial services and credit to align with federal regulations, changes the language used for location-based data, discounts for service interruptions, removes the term “risk-relevant data”, and provides a safe harbor provision with an opportunity to cure and a sunset date. Finally, this Substitute also includes a severability clause and an effective date of January 1, 2027.

This Act amends the Delaware Personal Data Privacy Act (DPDPA), Chapter 12D of Title 6, originally enacted in 2023, to more closely align the DPDPA with similar consumer data protection laws enacted in other states. This Act amends the applicability threshold of the DPDPA to entities who process the personal data of not less than 15,000 consumers, which on a population percentage basis closely aligns to thresholds in Connecticut and New Jersey. This Act amends Gramm-Leach-Bliley Act (GLBA) applicability exemptions, adopting approaches to financial data in similar laws in Connecticut, Montana, and Oregon, by exempting all data regulated by GLBA while limiting entity-level exemptions specifically to banks and insurers and their respective affiliates. This Act introduces contracting and due diligence requirements where businesses sell or disclose personal data to third parties and also harmonizes several DPDPA business requirements and consumer rights with personal data privacy laws in other states. This Act also makes technical changes to existing law to conform to the standards of the Delaware Legislative Drafting Manual.