Delaware Cut Its Privacy Threshold to 10,000 People. Nonprofits Get No General Exemption. Here Is What Changes January 1 for AI on Donor Data.

1. What changes for nonprofits on January 1, 2027?

Beginning January 1, 2027, Delaware’s comprehensive privacy law generally applies to organizations, including most nonprofits, that conduct business in Delaware or target Delaware residents and, during the preceding calendar year, controlled or processed personal data about at least 10,000 Delaware consumers, excluding data processed solely to complete payment transactions. That is down from 35,000 today. Governor Matt Meyer signed House Bill 380 on September 2, 2026, as the IAPP and others have reported, and the Governor’s office called it the lowest threshold in the nation, a comparison with the general volume thresholds in other state comprehensive privacy laws.

Delaware House Bill 380 amends the Delaware Personal Data Privacy Act so that, from January 1, 2027, it generally applies to organizations, including most nonprofits, that do business in or target Delaware and processed personal data of at least 10,000 Delaware consumers in the prior year. It treats sensitive inferences as sensitive data and expands AI profiling rights.

For a small nonprofit, the threshold is the headline, but the AI provisions are where the work sits. The amended text, already published in the Delaware Code at Title 6, Chapter 12D with “Effective Jan. 1, 2027” labels, rewrites five things that touch how you use AI on supporter and client data.

• Sensitive data now “includes inferences made based on personal data” that are used to reveal categories such as religious beliefs, health status or national origin, and it adds financial account credentials, government issued identification numbers and neural data (Section 12D-102(33)).
• The profiling opt out drops the word “solely,” so it reaches profiling in furtherance of “automated decisions,” not only fully automated ones (Section 12D-104(a)(6)c).
• Controllers with 50,000 or more Delaware consumers must assess specified heightened risk processing, down from a 100,000 consumer trigger, and profiling used for automated decisions with significant effects carries additional prescribed impact assessment content (Section 12D-108).
• Every covered controller must sign specific contracts with, and perform documented due diligence on, any third party that receives personal data (Section 12D-106(a)(10) and (11)).
• Third parties that acquire personal data from a controller are a separate coverage route with no consumer count attached, subject to the same Delaware business or targeting connection and the statutory exclusions (Section 12D-103(a)(3)).

The bill passed the House 30 to 9 on May 21, 2026 and the Senate 15 to 6 on June 16, 2026, according to the legislature’s bill page. One detail will trip up anyone reading quickly. The bill’s synopsis describes a 15,000 consumer threshold, but the operative bill text and the codified statute both read 10,000. The statute controls.

2. Does Delaware’s privacy law apply to my nonprofit?

Yes, if you conduct business in Delaware or target Delaware residents and crossed 10,000 Delaware consumers in the previous calendar year, because Delaware has no general nonprofit exemption. The Delaware Department of Justice states on its privacy portal for businesses that the law applies to both for profit and nonprofit businesses. The only nonprofit entity exemption in Section 12D-103(b) is for a nonprofit “dedicated exclusively to preventing and addressing insurance crime.”

Most states took the opposite path. Connecticut, for example, still lists “nonprofit organization” among the entities its core privacy provisions do not reach, in the version that Public Act 25-113 put in place on July 1, 2026. Delaware’s own definition of nonprofit, which matters for the carve outs below, covers organizations exempt under Sections 501(c)(3), (c)(4), (c)(6) and (c)(12) of the Internal Revenue Code.

How small is 10,000?

Delaware had 1,059,952 residents on July 1, 2025, according to Census Bureau QuickFacts. The new threshold is therefore fewer than 1 in 100 Delawareans. A regional food bank, a hospital foundation, a land trust with an active newsletter, or a national advocacy group with a modest Delaware footprint can each clear it without trying.

Count unique people, not database rows. One supporter who appears in your CRM, your newsletter platform, your gala registration tool and your program database is one consumer, not four, so deduplicate across systems and document how you did it. Then count every kind of relationship, not only donors. Event registrants, newsletter subscribers, petition signers, webinar attendees, program participants and identifiable website visitors all count as consumers if they are Delaware residents acting in an individual or household context. One statutory exclusion helps: data processed “solely for the purpose of completing a payment transaction” does not count toward the threshold. A one time online gift processor record that you never use again may fall outside the count, but a donor you add to your CRM and solicit again does not. Publicly available information and properly deidentified data fall outside the definition of personal data, so they do not count either.

The calendar trap

Section 12D-103(a) looks back to “the preceding calendar year.” Coverage on January 1, 2027 is decided by what you held during 2026, which is already nine months gone. Deleting data now does not undo the fact that you processed it earlier in 2026. You can still correct inflated counts, identify legitimate exclusions, reduce ongoing collection and stop risky processing, which lowers your exposure even if it does not change whether you crossed the threshold.

The victim services carve out

Section 12D-103(c)(13) excludes personal data of victims of or witnesses to child abuse, domestic violence, human trafficking, sexual assault, violent felonies or stalking when a nonprofit that serves those people collects it. That is a data level exclusion, not an organization level one. A domestic violence shelter’s client records are out, but the same shelter’s donor file, gala list and email subscribers are fully in.

3. Which other state privacy laws already cover nonprofits?

At least four other states apply their comprehensive privacy laws to nonprofits that cross their thresholds: Maryland, Colorado, Oregon and Minnesota. Each reached that result differently, and each draws the AI profiling line in a slightly different place. The table compares the provisions a small nonprofit is most likely to hit, as of October 2026.

Sources for the table are the statutes and regulator pages linked through this article: the Maryland Attorney General’s privacy page, the Colorado Attorney General’s Colorado Privacy Act page, the Oregon Department of Justice FAQ for nonprofits, and Minnesota Statutes section 325M.14. Thresholds in every state are counted per state. Ten thousand Delawareans and 35,000 Marylanders are separate tests, and crossing one does not pull you into the other. The table is a starting point, not a complete exemption analysis. “No general nonprofit exemption” does not mean every nonprofit is covered, because entity and data level exclusions still apply.

Minnesota is the clearest example. Section 325M.12 excludes “a small business, as defined by the United States Small Business Administration,” although such a business remains subject to Section 325M.17. The SBA rule at 13 CFR 121.105 describes a small business concern as “a business entity organized for profit,” so whether that exclusion can reach a nonprofit is doubtful. Minnesota nonprofits should review that question and the other exclusions with counsel rather than relying on the numbers alone.

Maryland deserves its own warning. Section 14-4707 of its law bars a controller from selling sensitive data at all, and allows collecting or processing it only where that is “strictly necessary” to provide a product or service the consumer requested. That is a tighter standard than the consent model most states use. A Maryland covered nonprofit that runs a model to infer which supporters are likely to have a particular health condition faces a hard question about whether that inference is strictly necessary for anything the supporter asked for.

4. Why does AI change the risk for donor data?

AI changes the risk because privacy laws regulate purposes and outputs, and AI tools quietly create new purposes and new outputs from data you collected for something else. The amended Delaware law says a controller may not process personal data “for any additional purpose that is not reasonably necessary and proportionate to the disclosed purposes” given at collection, unless the consumer consents (Section 12D-106(a)(2)).

Consider what that means in practice. A donor gave her email address to receive a newsletter. A development associate exports the file, pastes it into a chatbot, and asks the model to predict which subscribers have the capacity for a major gift. The data is the same. The purpose is new, and it was never disclosed.

The sector data suggests this is already happening at scale. The 2026 State of Nonprofit AI report from NTEN and The Bridgespan Group surveyed 917 nonprofit staff and executives between late April and mid June 2026. As summarized by Nonprofit Quarterly, 98 percent of respondents reported using AI in some capacity and 45 percent reported using it at least daily. These are survey responses from individual staff and executives, not a census of every nonprofit.

The governance numbers are the problem. Only 40 percent of executives reported written guidance on what data can be used with AI tools, and only 38 percent reported guidance on responsible use. Fifty three percent of respondents report shadow use outside organizational guidance, and executives report it at a higher rate than staff, 57 percent against 49 percent. Only 6 percent reported an AI incident in the past year, which the report itself cautions may reflect harm going undetected rather than harm not occurring.

Your AI vendor is a processor, a third party, or a problem

Every AI vendor that touches donor data has a legal role, and the facts decide it, not the label in the contract. If it processes data only on your instructions under a written contract, it is a processor, and Section 12D-107 requires that contract to set out processing instructions, confidentiality, deletion at the end of service, subcontractor controls and specific purposes that “may not be described in generic terms.” If the vendor determines purposes for itself, such as training a shared model on your data, Section 12D-107(d) says it is a controller for that processing, and calling it a processor in the contract does not change that. Disclosures to that kind of vendor fall under the third party contracting and due diligence duties described in section 6.

A consumer chatbot account on a staff member’s personal email usually comes with click through terms, but those terms were written for an individual user, not for your organization’s processing of supporter data, and they rarely meet the processor contract requirements above. Personal accounts are one possible form of the shadow use the survey measured, though the survey does not say how much of that 53 percent they represent. If you have not already published an internal AI use policy, our earlier article on nonprofit AI grant disclosure rules walks through what a workable one should contain.

5. When does an AI inference become sensitive data?

Under the amended Delaware law, an AI inference becomes sensitive data when it is used to reveal or identify a sensitive category, and processing it then requires the consumer’s consent. Section 12D-102(33) defines sensitive data to include “inferences made based on personal data, alone or in combination with other data, that are used to reveal or identify” racial, national or ethnic origin, religious beliefs, mental or physical health condition, diagnosis, treatment or status (including pregnancy), sex life, sexual orientation, transgender or nonbinary status, citizenship status or immigration status. The expanded definition also covers specified financial account credentials and card numbers, government issued identification numbers that law does not require to be public, and neural data. Those categories matter most to human services organizations that collect benefits, identity or payment documentation.

Section 12D-106(a)(4) then bars processing sensitive data unless the consumer consents and the processing is “reasonably necessary and proportionate to the disclosed purposes.” Consent must be a clear affirmative act. Under Section 12D-102(8), acceptance of broad terms of use, hovering over content, or agreement obtained through a dark pattern does not count.

Nonprofit data is unusually rich in exactly these signals. A gift to a disease research foundation, a recurring gift to a congregation, attendance at an immigrant legal clinic, or membership in an LGBTQ advocacy group can all point toward a sensitive category. The giving record alone may or may not “reveal” anything; that question has no Delaware enforcement precedent yet. An inference does not have to be accurate to matter; the question is whether you use it to reveal or identify a sensitive category. The risk rises sharply when an AI tool turns the signal into an explicit label, such as a segment called “likely caregiver of a cancer patient,” and you then use that label to target appeals.

Colorado reaches a similar result through a different door. Its definition of sensitive data covers personal data “revealing” religious beliefs, health condition or diagnosis, sex life or sexual orientation, and citizenship status. Processing sensitive data is one of the triggers for a mandatory data protection assessment under Section 6-1-1309, which applies to every covered controller with no separate size cutoff.

6. Do wealth screening, donor scoring and list exchanges count as profiling or sales?

Wealth screening and donor scoring almost always meet the statutory definition of profiling, and list exchanges can be sales, but which obligations follow depends on how the output is used. Delaware’s Section 12D-102(26) defines profiling as “any form of automated processing performed on personal data to evaluate, analyze, or predict personal aspects” of an individual, expressly including “economic situation,” “personal preferences,” “interests” and “behavior.” A model that predicts giving capacity is predicting economic situation.

Profiling that triggers the opt out

The opt out right is narrower than the definition. It applies to profiling “in furtherance of automated decisions that produce legal or similarly significant effects.” Section 12D-102(14) defines those as decisions resulting in the provision or denial of financial or lending services, housing, insurance, education enrollment or opportunity, criminal justice, employment opportunities, health care services, or “access to essential goods or services.” Deciding which donors receive a major gift visit is not on that list.

So routine donor scoring usually sits outside the opt out. It does not sit outside the law. For controllers at 50,000 or more Delaware consumers, Section 12D-108 requires documented data protection assessments for heightened risk processing, which includes targeted advertising, sales, processing of sensitive data, and profiling that presents a reasonably foreseeable risk of, among other things, “a physical or other intrusion upon the solitude or seclusion, or the private affairs or concerns, of consumers” that would offend a reasonable person. Screening tools that append estimated net worth, property holdings and political giving to a supporter’s record present a plausible risk of that kind and should be assessed. No Delaware decision has yet found that wealth screening meets the test.

List rentals and swaps

A sale under Section 12D-102(32) is “the exchange of personal data for monetary or other valuable consideration by the controller to a third party.” A donor list rental or a reciprocal exchange, where you give names and receive names, may constitute a sale, because money and the names you receive are both consideration. The definition also lists exceptions, including disclosures to a processor, to an affiliate, at the consumer’s direction, and to provide a product or service the consumer requested. Review the actual recipient, purpose, consideration and consumer direction for each transfer rather than treating every one the same way. No Delaware enforcement action has tested how list exchanges fit.

Once data leaves for a third party, the 2027 text imposes duties that did not exist before. You must sign a contract that limits the purpose, binds the recipient to the chapter and lets you stop and remediate misuse (Section 12D-106(a)(10)). You must also perform due diligence that, “at a minimum,” involves questionnaires and review of the recipient’s documents (Section 12D-106(a)(11)). Sensitive data may be sold only with specific notice, affirmative consent and a five year consent record (Section 12D-106(a)(12)).

The receiving side changed too. Under Section 12D-103(a)(3), a third party that acquires personal data from a controller is within the chapter, provided it meets the statutory definition of a third party and does business in or targets Delaware, and Section 12D-107A says a third party without the required contract “may not further process” that data. A small nonprofit that has never come near 10,000 Delaware consumers can therefore still be bound by Delaware law when it accepts a rented or swapped list from a covered organization. Hunton flags the third party coverage in its summary of the bill, and a National Law Review analysis notes that no other state consumer privacy law reaches third parties this way.

7. When does a human services nonprofit need an AI impact assessment?

A Delaware covered nonprofit needs a profiling impact assessment when it processes data of 50,000 or more Delaware consumers and uses profiling in furtherance of automated decisions about housing, financial services, insurance, education, employment, health care or access to essential goods or services. This is where the law stops being about fundraising and starts being about mission delivery. Rental assistance eligibility, financial counseling intake, food pantry prioritization and health navigation are all decisions on the statutory list.

This is in addition to the general heightened risk assessments described in section 6. Section 12D-108(a)(2) lists seven required elements for this profiling, each “to the extent reasonably known by or available to the controller.”

1. The purpose, intended use cases, deployment context and benefits of the profiling.
2. Whether the profiling poses a known or reasonably foreseeable heightened risk of harm, the nature of that risk, and the mitigation steps taken.
3. The main categories of personal data used as inputs and the outputs the profiling produces.
4. The main categories of personal data used to customize the profiling, if any.
5. Metrics used to evaluate performance and known limitations.
6. Transparency measures, including how consumers are told that profiling is happening.
7. Post deployment monitoring, user safeguards and oversight processes.

That list overlaps heavily with the documentation an ISO/IEC 42001 AI management system produces, but alignment with a framework does not by itself satisfy the statute. Section 12D-108(e) lets an assessment done for another law count only if it is “reasonably similar in scope and effect,” and Section 12D-108(d) allows one assessment to cover a comparable set of processing operations. Map each of the seven elements explicitly, then reuse the document across states only where the scope genuinely matches.

Two duties that apply below 50,000

Smaller covered nonprofits are not off the hook. Section 12D-106(a)(6), which applies to every covered controller, prohibits profiling in violation of state and federal anti discrimination law. It then adds that evidence, or lack of evidence, of proactive anti bias testing, including its quality, recency, scope, results and your response to them, is “relevant to any claim” and to any defense. A nonprofit that cannot show it ever tested an eligibility model has made a choice a court may weigh.

Second, if you hand an AI score or recommendation to a partner agency that uses it to make one of those significant decisions, Section 12D-106(f) treats it as a “report.” You must then require the recipient by contract to give adverse action notice, describe the data relied on, and offer a human review where technically feasible. You must also answer a resident’s request within 30 days with the data, its sources and every third party that received a report in the past 24 months.

Minnesota adds a parallel individual right. Section 325M.14 lets a consumer whose data was profiled in furtherance of a significant decision “question the result of the profiling,” learn the reason for the decision, and, if feasible, learn what could have produced a different result. If your organization also makes housing or employment decisions in Colorado, the state’s separate automated decision law takes effect the same day; see our analysis of Colorado’s rewritten AI Act and tenant screening.

8. What about staff, volunteers and board members?

Staff and board members acting in their organizational roles are generally outside Delaware’s consumer protections, but the 2027 text pulls AI profiling of applicants and employees partly back in, and volunteers are not expressly addressed. Section 12D-102(9) excludes from “consumer” anyone acting as an employee, owner, director, officer or contractor of a nonprofit “whose communications or transactions with the controller occur solely within the context of that individual’s role.”

The employment data exclusion in Section 12D-103(c)(11)a covers data about people applying to, employed by, or acting as an agent or contractor of the controller. In the amended text it carries a new exception: it does not cover “personal data processed in connection with profiling and reports under § 12D-106(f).” The Governor’s office described this as narrowing employee data exclusions that affect AI screening tools and hiring decisions. How that exception interacts with the consumer definition, which still excludes people acting in an employment context, has not been tested.

Volunteers are the gap a cautious nonprofit should close by policy. The employment exclusion names applicants, employees, agents and independent contractors. It does not name volunteers. Until the Department of Justice or a court says otherwise, treat volunteer records, including any AI tool that ranks or screens volunteer applicants, as consumer data. Board members who also give as individuals are donors for that purpose, and their giving records are consumer data too.

If AI touches hiring at your organization in other states, the patchwork widens. Colorado’s employer obligations, for example, begin January 1, 2027, as covered in our article on what applies to Colorado employers.

9. Who enforces these laws, and what are the penalties?

State attorneys general enforce all of these laws, the privacy statutes themselves generally do not create a private right of action, and the guaranteed warnings that once came before a penalty are gone or now discretionary. In Delaware, the Department of Justice has exclusive enforcement authority under Section 12D-111, and a violation is an unlawful practice under the state’s consumer fraud statute. Section 2522 of that statute sets a civil penalty of up to $10,000 for each willful violation, defined as conduct the person “knew or should have known” was prohibited.

The missing private right of action is narrower than it sounds. Section 12D-111 says violations of the privacy chapter are enforced solely by the Department of Justice, but Delaware’s consumer fraud statute separately lets victims of deceptive practices sue under Section 2525. Separate consumer protection, contract, confidentiality, discrimination and other claims may still be available to a donor or client whose data is misused.

Delaware’s mandatory 60 day cure period ran only through December 31, 2025. Since January 1, 2026, Section 12D-111(c) lets the Department decide whether to offer a cure based on seven factors, including the number of violations, “the size and complexity of the controller,” the likelihood of public injury, and whether the violation was likely caused by human or technical error. Size helps a small nonprofit, but only as one factor in a discretionary call.

The other states follow their own rules. Maryland treats violations as unfair, abusive or deceptive trade practices, with civil penalties of up to $10,000 per violation and $25,000 for each repeat violation. Minnesota’s Section 325M.20 sets penalties of up to $7,500 per violation, and its 30 day warning letter provision expired January 31, 2026. Oregon’s Department of Justice says that “as of January 1, 2026, the Attorney General is no longer required to give controllers notice and opportunity to cure.” Maryland’s cure opportunity is discretionary and covers only violations on or before April 1, 2027. Colorado’s general cure provision has been repealed, and its law is enforced by the Attorney General and district attorneys.

Reputational exposure is the larger number for most charities. A privacy enforcement action against a nonprofit becomes a story about donor trust, and the Nonprofit Quarterly summary of the NTEN and Bridgespan data found data privacy cited as a major barrier by 55 percent of executives and a significant concern by 56 percent of staff. Your own people already see the risk.

10. What should a small nonprofit do before January 1?

A small nonprofit should use the roughly 88 days before January 1, 2027 to confirm whether it is covered, inventory its AI uses, and fix the contracts and notices that a regulator would read first. The plan below is a defensible baseline, not a safe harbor, and it assumes a team of 5 to 50 staff without a dedicated privacy officer.

Days 1 to 30: know your numbers and your tools

• Count qualifying unique Delaware consumers across your CRM, email platform, event tools and program systems for calendar year 2026, deduplicate overlapping records, and document the exclusions you applied, such as data used solely to complete a payment. Repeat the count for Maryland at 35,000, and Colorado, Oregon and Minnesota at 100,000.
• Check the other coverage routes too: the data sale thresholds (5,000 Delaware consumers with more than 20 percent of gross revenue from data sales, and the comparable tests in each other state) and Delaware’s third party route for any list you acquired from another organization.
• Build an AI inventory. List every AI tool, every AI feature inside existing software, and every personal account staff use for work. For each, record what data goes in, what labels or scores come out, and who sees them.
• Flag any output that could reveal a sensitive category, any use in housing, financial, health, education, employment or essential services decisions, and any data that leaves your organization.

Days 31 to 60: fix contracts and data flows

• Classify each AI vendor’s actual role. For processing performed on your instructions, use a processor agreement with specific purposes, confidentiality, deletion and subcontractor terms, and a clause that bars training shared models on your data unless you approve it. Where the vendor independently determines purposes or uses the data, apply the third party contracting and due diligence requirements instead.
• Move staff off personal AI accounts for any work involving donor, member or client data, and onto approved accounts with a signed agreement.
• Inventory list rentals and swaps. Add the Section 12D-106(a)(10) contract terms, run and file a due diligence questionnaire for each partner, and stop accepting lists from any source that will not sign.
• Remove or gate any AI segment that labels a sensitive category, unless you have affirmative consent for that use.

Days 61 to 88: notices, rights and documentation

• Rewrite your privacy notice so it is “reasonably particular” to what you actually do, names the categories of data and third parties, describes every consumer right, and explains how to opt out of targeted advertising, sales and significant decision profiling.
• Stand up a rights request process with a 45 day response clock, an appeal path with a 60 day response clock, and recognition of universal opt out signals such as Global Privacy Control.
• Write a short assessment for each high risk AI use, even if you are under 50,000. It is required for larger Delaware controllers and for covered Colorado and Maryland controllers in high risk cases, and it is the record you will want if a regulator or a reporter calls. Treat it as a compliance baseline, not proof that one assessment satisfies every state.
• Take the AI policy and the inventory to the board. Boards approve audits and investment policies; a privacy and AI risk summary belongs on the same agenda.

None of this requires new headcount, but it does require someone with authority to own it. That is the role a virtual Chief Compliance Officer fills for small organizations that cannot justify a full time privacy hire.

This article is provided for general informational purposes and reflects the state of the law as of October 2026. It is not legal advice. Regulations in this area are changing quickly. Confirm current requirements and consult qualified counsel before making decisions for your organization.