Recent developments in Delaware, California, and Texas highlight a common theme that privacy compliance risk is becoming more operational and technical and more likely to arise from practices that may once have appeared routine. (1) Delaware has expanded the reach and substantive requirements of its comprehensive privacy law; (2) California continues its focus on data brokers by bringing a Delete Act action against a data broker; and (3) the Texas Attorney General has warned businesses about a surge in CIPA website tracking demand letters.
Delaware Broadens the DPDPA
On September 2, 2026, Delaware Governor Matt Meyer signed House Bill 380, which materially amends the Delaware Personal Data Privacy Act (“DPDPA”). Most changes become effective January 1, 2027.
Broadened Thresholds. More businesses may fall within the DPDPA’s scope. Beginning January 1, 2027, the law will generally apply to persons that conduct business in Delaware or produce products or services targeted to Delaware residents and that:
- Control or process the personal data of at least 10,000 Delaware consumers, which is a reduction from 35,000 Delaware consumers; or
- Control or process the personal data of at least 5,000 Delaware consumers and derive more than 20% of gross revenue from the sale of personal data.
New Contracting Requirements. HB 380 also adds requirements for contracts between controllers and third parties when personal data is disclosed, including in a sale of personal data or for targeted advertising. Those agreements must address, among other things:
- The limited and specified purposes for which the personal data may be sold or disclosed.
- The third party’s obligation to comply with the DPDPA and provide the same level of privacy protection as the controller.
- The third party’s duty to notify the controller if it can no longer meet its obligations.
- The controller’s ability to take reasonable and appropriate steps to stop and remediate unauthorized use of personal data.
Businesses should assess whether their existing vendor, advertising technology, data sharing, affiliate, and commercial partner agreements support these obligations. A generic “comply with applicable law” clause may not be sufficient.
Expanded Sensitive Data Definition and Assessment Requirements. The amendments also broaden the definition of sensitive data and reduce the data protection assessment threshold from 100,000 to 50,000 consumers. Additions to the sensitive data definition include national origin, neural data, certain financial account and account access information, government issued identification numbers, and broader health related information.
CCPA Data Broker Focus
On August 11, 2026, the California Privacy Protection Agency (CPPA) announced an order against data broker LocateSmarter LLC. The order requires payment of $116,490 and changes to the data broker’s practices. According to this announcement, it is the CPPA’s first enforcement action against a data broker under the CCPA and its first action arising under both the CCPA and California’s Delete Act. The enforcement action illustrates that low consumer request volume is not a reliable metric for enforcement risk. The CPPA emphasized in this announcement that the penalty was imposed even though only a “mere handful” of consumers submitted opt-out requests.
Texas Flags CIPA Demand Letters
On September 17, 2026, Texas Attorney General Ken Paxton issued a consumer alert that warned Texas businesses and nonprofit organizations about a surge in demand letters alleging violations of the California Invasion of Privacy Act (CIPA). The letters target the use of common website technologies, including cookies, pixels, analytics tools, and search bars, and may identify those tools as unlawful “wiretapping” under California law.
The Texas AG cautioned that some of these letters may exaggerate or misrepresent potential legal exposure. According to the alert, the letters may include website screenshots and draft complaints, while demanding payment to avoid litigation. The AG advised recipients not to respond directly or make payment without first consulting qualified counsel. The Texas alert is an important acknowledgment of the volume and potentially abusive nature of these CIPA related demands. But it should not be read to mean that all website tracking claims lack merit or that organizations can disregard a demand letter without a review.
The Texas AG recommends that affected organizations consult counsel, review their use of pixels, cookies, analytics tools, and similar technologies, and monitor legal developments. Organizations that believe a demand is fraudulent, abusive, or deceptive may report it to the Texas Attorney General’s Consumer Protection Division.
Takeaways:
These developments point to three compliance priorities:
- Delaware: Reassess DPDPA applicability before the lowered thresholds and other HB 380 amendments take effect on January 1, 2027. Update third-party data sharing contracts and data protection assessment processes.
- California: Assess data broker registration, consumer rights intake, data minimization, and DROP requirements. Recent actions show that the CPPA will pursue technical compliance failures even where consumer demand appears limited.
- Website tracking: Maintain an accurate inventory of cookies, pixels, analytics, chat, session replay, and similar technologies and understand the data each tool captures and transmits.
We will continue to monitor these developments. If you have questions about how privacy, AI, or related laws impact your organization, Taft’s Privacy, Security & AI attorneys are available to assist. As always, please sign up to receive emails of our latest posts here on Privacy and Data Security Insights, and follow us on LinkedIn for the latest in privacy, security, and artificial intelligence legal news.