AI Use, Data Protection Considerations, AI Legislation, and Recommended Caution and Supervision Surrounding the Application of AI

Executive summary

Delaware’s laws and governance continue to evolve with the ever-changing landscape of data privacy concerns, developments in artificial intelligence (AI), and the emergence of various other new technologies. The Delaware Personal Data Privacy Act’s (DPDPA) recent amendments emphasise how strongly Delaware government officials view the importance of these issues, as Delaware’s governor stated in a press release following his signing of the amendments that they “create[ed] the broadest data protections in the country, covering more Delawareans than any similar law in America.”

More technology-related legislation could be on the way. A subcommittee of Delaware’s AI Commission is currently refining ideas on generative and agentic AI to become potential draft legislation and regulatory guidance. At the same time, Delaware courts are threatening Rule 11 sanctions in an attempt to curb the dangerous pairing of an over-reliance on AI and the lack of sufficient human verification and oversight procedures. Navigating this technological terrain can prove difficult, especially with more change and development on the horizon.

Delaware’s expansion of consumer privacy laws

In September 2026, Delaware governor Matt Meyer signed two data privacy bills expanding the scope of Delaware’s consumer privacy law. House Bill 380, effective 1 January 2027, amended the DPDPA by significantly lowering the thresholds for the applicability of the Act, creating requirements regarding profiling, automated decision-making, and controller reports, imposing obligations on third parties that receive personal data, implementing new requirements regarding data assessments and impact assessments, and expanding the definition of sensitive data. House Bill 381, effective 2 September 2026, clarified when businesses must provide notice of computer security breaches to the Delaware Attorney General. Together, these bills impose more complex consumer privacy law obligations on a far greater number of companies conducting business in Delaware.

Lower applicability thresholds

Prior to the amendment, the DPDPA applied to any person conducting business in Delaware that annually controls or processes the personal data of at least 35,000 consumers (ie, subject to narrow exceptions, residents of Delaware), or if the person derives more than 20% of their gross revenue from the sale of personal data, the applicable threshold was at least 10,000 consumers. House Bill 380 reduced those thresholds to 10,000 consumers for general applicability and 5,000 consumers for revenue-based applicability. Governor Meyer remarked upon signing House Bill 380 that it “set the lowest threshold in the nation, stating that any company handling the data of just 10,000 consumers falls under” the DPDPA.

House Bill 380 also lowered the threshold for when controllers of consumer data must complete and keep records of data protection assessments and impact assessments, which are discussed further below. Now, any controller that processes the data of at least 50,000 consumers, down from the previous threshold of 100,000 consumers, must conduct and document a data protection assessment for each of the controller’s activities that presents a heightened risk of harm to a consumer and an impact assessment if a controller engages in profiling in furtherance of automated decisions that produce legal or similarly significant effects concerning a consumer.

Profiling, automated decision-making, and controller reports

As amended by House Bill 380, the DPDPA prohibits controllers from processing personal data or engaging in profiling in violation of the laws of Delaware and federal laws that prohibit unlawful discrimination. If a controller is subject to any claim for a violation of such laws, any evidence, or lack thereof, regarding a controller’s proactive anti-bias testing or similar proactive efforts to avoid processing personal data unlawfully will be relevant to the prosecution of that claim and any available defences. Therefore, controllers desiring to protect themselves from any claims of unlawful profiling will likely conduct anti-bias testing or make similar proactive efforts and preserve any documentation related to the quality, recency, scope, results, and response to the results of any such testing or similar efforts.

The amended DPDPA now provides that any controllers that disclose a “report” to any third parties for use in connection with any decision that produces legal or similarly significant effects concerning a Delaware resident must enter into a contractual agreement with the third party, provide the Delaware resident with certain information upon request, and allow the Delaware resident the opportunity to correct any incorrect personal data. A “report” in this context is defined as any written, oral, or other communication of any personal data, including recommendations, summaries, or automated decisions based on personal data or profiling. That definition, while not yet interpreted by Delaware courts in this capacity, seemingly includes any communication from AI and developing automation technologies.

The DPDPA also requires that the contractual agreement between the controller and third party:

• provide notice to the Delaware resident of any “adverse action” that is based in whole or in part on any information contained in the report;
• provide a description of the personal data relied upon in making the “adverse action”;
• include a statement that the Delaware resident may obtain the relevant information from the controller;
• include appropriate contact information for the controller; and
• include a statement that the Delaware resident may request that the third party, where technically feasible, perform a human review of the “adverse action” concerning the Delaware resident, unless providing the opportunity for review is not in the best interest of the Delaware resident, including instances in which any delay might pose a risk to their life or safety. An “adverse action” in this context broadly includes, but is not limited to, any denial, cancellation, unfavourable change, increase in charge, exclusion of benefit, or similar effect on the interests of a Delaware resident. Controllers and third parties seeking to ensure compliance with the DPDPA’s contractual requirements while protecting their own interests will likely seek the advice of independent legal counsel.

Third-party obligations

The amended DPDPA now also imposes obligations on third parties. Most importantly, third parties that receive personal data from a controller or processor without having a contractual agreement with the same may not further process any personal data that it receives. In other words, a contractual agreement is now required on both sides of the controller and third-party relationship.

Once that agreement is in place, third parties have an obligation to comply with the terms of that agreement, provide necessary information to enable the controller to conduct and document data protection assessments, and provide necessary information for the controller or the controller’s designated assessor to assess the third party consistent with its due diligence obligations. Third parties that independently meet the applicability thresholds described above must further comply with all provisions of the DPDPA.

Data protection assessments and impact assessments

Any controller that processes the data of at least 50,000 consumers must conduct and document a data protection assessment for each of the controller’s activities that presents a heightened risk of harm to a consumer. Processing that presents a heightened risk of harm includes, but is not limited to, processing personal data for the purposes of targeted advertising, selling personal data, and processing personal data for the purposes of profiling that presents a reasonably foreseeable risk of any of the following:

• unfair or deceptive treatment of, or unlawful disparate impact on, consumers;
• financial, physical, or reputational injury to consumers;
• a physical or other intrusion upon the solitude or seclusion, or the private affairs or concerns, of consumers, where such intrusion would be offensive to a reasonable person; or
• other substantial injury to consumers.

Determining whether profiling presents a reasonably foreseeable risk of the injuries listed above is a fact-intensive matter. Businesses processing personal data for profiling purposes will likely want to err on the side of caution by regularly conducting personal data assessments. The DPDPA empowers the Delaware Attorney General to request the disclosure of such assessments when conducting relevant investigations and to evaluate such assessments for compliance purposes.

In addition to the DPDPA’s previously-established obligations on data protection assessments, House Bill 380’s amendments now require that controllers conduct a separate impact assessment if the controller engages in profiling in furtherance of automated decisions that produce legal or similarly significant effects concerning a consumer. To the extent reasonably known by or available to the controller, the impact assessment must include the following:

• a statement by the controller disclosing the purpose, intended use cases, deployment context of, and benefits afforded by, such profiling;
• an analysis of whether, and, if so, how the controller’s profiling presents a heightened risk of harm to a consumer and the steps that have been taken to mitigate that risk;
• a description of the main categories of personal data processed as inputs for the purposes of profiling and the outputs the profiling produces;
• an overview of the main categories of personal data the controller used to customise profiling, if any;
• any metrics used to evaluate the performance and known limitations of profiling;
• a description of any transparency measures taken concerning the use of profiling; and
• a description of the post-deployment monitoring and user safeguards concerning profiling.

To effectively protect consumer privacy rights and ensure compliance in case of a request and evaluation of these assessments from the Delaware Attorney General’s office, companies conducting business in Delaware will likely need to conduct accurate and honest self-evaluations of the organisation’s data practices and seek buy-in from key organisational stakeholders, such as the heads of any legal, compliance, and information technology (IT) departments.

Expanded definition of sensitive data

The DPDPA prohibits controllers from processing sensitive data concerning a consumer unless the consumer consents and the processing is reasonably necessary and proportionate to the purposes the controller disclosed. House Bill 380 expanded the definition of sensitive data to include “inferences” made based on personal data, alone or in combination with other data, that are used to reveal or identify any of the following:

• racial, national, or ethnic origin;
• religious beliefs;
• mental or physical health condition, diagnosis, treatment, or status (including pregnancy);
• sex life;
• sexual orientation;
• treatment or status as transgender or non-binary;
• citizenship status; or
• immigration status.

That expansion means that controllers can no longer rely on “inferences”, or predictions based on information from non-sensitive data, without also abiding by the obligations regarding sensitive data in the DPDPA.

One such obligation under the amended DPDPA is to not disclose sensitive data in a sale unless:

• the disclosure is strictly necessary to provide or maintain a product or service affirmatively requested by the consumer to whom the sensitive data pertains;
• the controller provides a clear and conspicuous notice of the sale of personal data before the sale;
• the controller obtains the consumer’s consent;
• the controller maintains a record of the consumer’s consent for a period of five years; and
• the record of consent is provided with any data protection assessment requested by the Delaware Attorney General.

Properly obtaining and preserving records of consent will be important supporting evidence during any evaluation of compliance that the Delaware Attorney General may perform.

Delaware’s legislative, regulatory, and judicial response to emerging AI technology and associated risks

All branches of the Delaware government are actively addressing how AI and other emerging technologies will impact governance and legal issues facing the state. Following the Delaware General Assembly’s passage of various AI-related legislation, Delaware’s AI Commission of high-ranking executive, legislative, and judicial officers, among others, is working to develop regulatory guidance. Meanwhile, Delaware courts have implemented interim policies on generative AI use while using Rule 11 sanctions to curb Delaware attorneys and law firms from failing to do the same and from filing legal documents containing AI hallucinations.

Legislative and regulatory efforts

The Delaware General Assembly passed legislation in 2024 creating an AI Commission tasked with conducting an inventory of all generative and agentic AI usage within Delaware’s executive, legislative, and judicial agencies, identifying high risk areas, and making recommendations on AI utilisation and safety. In 2025, the AI Commission increased its membership pursuant to additional legislation, held four official meetings, and established three subcommittees (the AI Models Subcommittee, the AI Training Subcommittee, and the Agentic AI Regulatory Sandbox Subcommittee).

The Agentic AI Regulatory Sandbox Subcommittee was formed in response to the passage of a joint resolution by the Delaware General Assembly directing the AI Commission to work in collaboration with the Delaware Secretary of State to create a regulatory sandbox framework for the testing of innovative and novel technologies that utilise agentic artificial intelligence. The joint resolution posited that the development of agentic AI for use in the field of corporate governance presents many potential benefits for automating tasks and increasing efficiencies, but also raises legal and ethical questions related to corporate governance and the Delaware General Corporation Law.

The AI Commission’s annual report noted that the Agentic AI Regulatory Sandbox Subcommittee is currently refining ideas into potential draft legislation. As is the case with many regulatory sandboxes established in other states and nations, it is anticipated that any framework contemplated in future legislation and set up by regulators in Delaware will allow companies to test its generative and agentic AI products, services, and technologies while being exempt from the legal risk of certain regulations under the supervision of Delaware regulators.

Judicial efforts and response to improper AI usage

Delaware courts currently operate under an interim policy allowing the use of generative AI by judicial officers and court personnel. The Delaware Supreme Court approved and ordered the interim policy in 2024 following a recommendation from the Delaware Commission on Law and Technology. The interim policy states that judicial officers and court personnel are responsible for ensuring the accuracy of all work products, must use caution when relying on the output of generative AI, may not use generative AI to delegate their decision-making functions, and must only use generative AI in compliance with applicable laws and other judicial branch policies.

Recent litigation in the Delaware Court of Chancery highlights that Delaware courts expect practitioners and their law firms to establish and abide by similar policies. In July 2026, a Vice Chancellor of the Court of Chancery ordered a prominent Delaware attorney and their law firm to show cause why they should not be sanctioned under Delaware Court of Chancery Rule 11 for submitting a brief with AI hallucinated legal propositions and failing to sufficiently correct the misrepresentations of law after they were brought to the Court’s attention. Delaware Court of Chancery Rule 11(b), which mirrors Federal Rule of Civil Procedure 11(b), states that when a document is filed with the Court, an attorney certifies that to the best of their knowledge, information, and belief, formed after an inquiry reasonable under the circumstances, the legal contentions therein are warranted by existing law.

The Vice Chancellor directed the attorney to submit an affidavit addressing how and when generative AI tools were used in drafting the brief, describing the cite-checking process and whether attorneys verified the cited text, and providing an explanation of the remedial steps taken to correct the flawed legal propositions. The Delaware law firm was similarly directed to have a representative submit an affidavit addressing the firm’s written policies and restrictions regarding the use of generative AI by attorneys and staff, describing how the firm’s policies and restrictions were communicated to the attorney and staff involved in that matter, listing the internal safeguards and training programmes the firm has implemented to ensure court filings are accurate, and showing “exceptional circumstances,” if any exist, demonstrating why the law firm should not be held jointly responsible for any Rule 11 violations committed by the attorney.

Delaware state courts are not alone in expecting counsel to exercise caution and care when using AI. During a recent panel regarding legal education, AI, and emerging technologies, it was noted that certain judicial members of the District of Delaware bench have significant concerns regarding the use of AI, including regarding its impact on confidentiality and privilege issues. Attorneys located or practicing in Delaware should therefore ensure that extensive policies, guidelines, and restrictions have been implemented at their firms and that they are thoroughly verifying any filings and diligently protecting confidential client information.