When the cashier says, "If you enter your phone number, you'll earn points," I find myself entering my number without thinking. If I can get a free coffee after buying ten, how can I resist?

However, the phone numbers and emails collected this way could become a responsibility for local store owners starting next year. This is about the Delaware Personal Data Privacy Act.

This law was signed in September 2023 and will take effect on January 1, 2025. Many people might have thought it was only relevant for large companies until now.

That makes sense. Until this year, the threshold was set at businesses handling personal data of over 35,000 Delaware consumers.

Businesses that earn more than 20% of their revenue from selling personal data were subject to the law starting at 10,000 consumers.

However, starting January 1, 2027, the threshold will drop from 35,000 to 10,000, and from 10,000 to 5,000. I was taken aback while reading the original text of the law. The general threshold has fallen to less than a third of what it was.

Additionally, third parties receiving personal data from other businesses will also be included under this law.

However, the statement that "small businesses are included" is only partially true. Not every local corner store will be affected. If you don't reach 10,000 consumers and aren't in the data-selling business, you won't be subject to this law next year.

So how do you count? The legal wording states "preceding calendar year," meaning the count for 2027 will be based on this year's numbers, so waiting until next year to count will be too late.

You also need to consider who counts as a consumer. Here, a consumer is defined as a Delaware resident, and those moving for work or business purposes are excluded.

Information processed solely for payment purposes is also excluded. Just because a customer swipes their card once doesn't mean they count towards the total.

The real issue comes next. The law defines personal data as any information that can be linked or is linked to a specific individual. If you've been collecting membership data, online orders, text coupon lists, or email newsletters for years, it might be worth counting.

There are no loopholes for small revenue. The original text does not mention any exemptions based on size or revenue. The only criterion is the number of people.

Nonprofit organizations also do not have a general exemption. The Attorney General's office has stated that both for-profit and nonprofit entities are subject to this law, so if you have a large membership list, you need to be aware.

There are some exemptions. Banks, credit unions, insurance companies, and some securities firms and investment advisors are exempt, as are patient health information covered by HIPAA.

What can consumers do? They can check their information, correct inaccuracies, request deletions, and obtain copies. They can also request a list of third parties that have received their information.

For targeted advertising, the sale of personal data, and automated profiling used for significant decisions, consumers can opt-out.

Companies must respond within 45 days, and if necessary, they can extend this period by another 45 days. Consumers can request this information once a year for free, and if denied, the company must respond in writing within 60 days.

The scope of sensitive information is also expanding. Social security numbers, passport numbers, driver's license numbers, credit card numbers, and account login information are included.

There is also mention of neural data, or brain signal data. I doubt reading my mind would yield anything more than lunch menu ideas.

There are also provisions for minors aged 13 to under 18. If a business knows a minor's age or deliberately ignores it, they must obtain consent for targeted advertising and profiling.

Here are the obligations for business owners. They must clearly state in their privacy notice what information they collect, why they collect it, and with whom they share it. They must also enter into contracts with those to whom they transfer information and conduct due diligence, such as reviewing surveys and documents.

The threshold for conducting a data protection assessment for high-risk processing will also drop from 100,000 consumers to 50,000.

What happens if you violate the law? The cure period, which allowed for correcting mistakes, ended at the end of 2025, and starting this year, the Department of Justice will determine whether to grant correction opportunities based on various circumstances.

Consumers cannot directly sue based on this law; enforcement is solely the responsibility of the state Attorney General. However, violations are treated as illegal acts under consumer fraud laws, and if a court finds intentional violations, fines of up to $10,000 per violation may be imposed.

I welcome this amendment. When information leaks, victims can be harmed based on the size of the store. I believe that those who are more vulnerable need this kind of protection first.

I also have complaints. Earlier this month, I checked the Attorney General's office guidance page, but I couldn't find any information about the changes coming in 2027. If the threshold is lowered, it's the government's responsibility to explain it in a way that small business owners can understand.

If it were up to me, I would do it in this order: gather scattered customer lists, eliminate duplicates, and count only Delaware residents.

I would boldly delete any lists that are no longer in use. If the information doesn't exist, it can't leak.

If I think I might be affected, I would revise the privacy notice and create an email address for deletion requests. Since the conditions vary, it's best to confirm the final decision with a lawyer.

If customers have issues, they can fill out the Submit Privacy Complaint form on the Attorney General's office website, and inquiries can be sent to [email protected].

Do you enter your phone number at the checkout, or do you not? Please cast your vote in the comments. I still find myself crumbling in front of a cup of coffee.