Regulations › US states › Delaware
DPDPA
Delaware Personal Data Privacy Act
WhenIn effect since 1 January 2025
Who enforces itState Attorney General
Who it applies toBusinesses that process personal data of the state's residents above the law's thresholds. Thresholds, exemptions and sensitive-data rules differ by state.
Thresholds35,000 consumers, or 10,000 consumers plus over 20% of gross revenue from sales
Universal opt-outMust honor opt-out preference signals for targeted ads and sale from January 1, 2026
Cure periodMandatory 60-day cure expired December 31, 2025
Request deadline45 days, extendable once by 45 days with notice
Maximum penaltyUp to $10,000 per violation under the consumer fraud enforcement provisions
Private actionNo private right of action
Every requirement we score, with the rule in plain words and the section it comes from. Darker means more demanding. See every law side by side →
Who it covers
Thresholds
2
35,000 consumers, or 10,000 consumers plus over 20% of gross revenue from sales; payment-only data excluded.6 Del. C. § 12D-103(a) · source ↗
HB 380 (85 Del. Laws c. 463) amends the Act effective January 1, 2027. Thresholds drop to 10,000 or 5,000 plus 20%, and third parties acquiring data are covered.
Exemptions
2
Entity-level GLBA financial institution exemption; HIPAA PHI exempt only at data level; nonprofits covered except victim-services groups.6 Del. C. § 12D-103 · source ↗
HB 380 (85 Del. Laws c. 463) amends the Act effective January 1, 2027. GLBA entity exemption narrowed to specified institutions.
Sensitive data and minors
Sensitive data
2
Opt-in consent; categories include transgender or nonbinary status, sex life, and citizenship status.6 Del. C. §§ 12D-102, 12D-106 · source ↗
HB 380 (85 Del. Laws c. 463) amends the Act effective January 1, 2027. Adds neural data, financial credentials, government IDs; sale must be strictly necessary with notice and five-year consent records.
Children and teens
3
Under 13: parental consent (COPPA). Ages 13 to 17: consent required for targeted ads, sale and profiling with actual knowledge or willful disregard.6 Del. C. §§ 12D-103(d), 12D-106 · source ↗
Data minimization
1
Collection adequate, relevant and reasonably necessary to disclosed purposes.6 Del. C. § 12D-106 · source ↗
HB 380 (85 Del. Laws c. 463) amends the Act effective January 1, 2027. Standard becomes reasonably necessary and proportionate (level 2).
Consumers' rights
Rights
2
Access, correct, delete, portability, list of specific third parties, opt out of sale, targeted ads, and profiling (8 rights).6 Del. C. § 12D-104 · source ↗
HB 380 (85 Del. Laws c. 463) amends the Act effective January 1, 2027. Access expands to inferences and profiling information.
Appeals
2
Internal appeal decided in writing within 60 days; denial must give a way to contact the Department of Justice.6 Del. C. § 12D-104(d) · source ↗
Universal opt-out
2
Must honor opt-out preference signals for targeted ads and sale from January 1, 2026.6 Del. C. §§ 12D-104, 12D-106(e) · source ↗
Business duties
Assessments
2
Controllers with data of 100,000+ consumers must assess targeted ads, sale, risky profiling and sensitive data; DOJ may request.6 Del. C. § 12D-108 · source ↗
HB 380 (85 Del. Laws c. 463) amends the Act effective January 1, 2027. Threshold drops to 50,000 and adds profiling impact assessments (level 3). Applies to processing from July 1, 2025.
Processor contracts
3
Detailed contract terms, deletion, compliance information, assessments, and subcontracting only after controller gets a chance to object.6 Del. C. § 12D-107 · source ↗
Privacy notice
2
Notice of categories, purposes, rights and appeals, third-party sharing and contact; clear sale and targeted ads disclosure with opt-out method.6 Del. C. § 12D-106(c)-(d) · source ↗
HB 380 (85 Del. Laws c. 463) amends the Act effective January 1, 2027. Adds controller identity and rights description.
Loyalty programs
2
Bona fide loyalty programs allowed; if an opt-out signal conflicts, honor the signal but may ask the consumer to confirm participation.6 Del. C. § 12D-106(b), (e) · source ↗
De-identified data
3
Public no-reidentification commitment and contract duties for deidentified data; pseudonymous data exempt from rights with separation; oversight duty.6 Del. C. §§ 12D-102, 12D-109 · source ↗
Enforcement
Cure period
1
Mandatory 60-day cure expired December 31, 2025; cure now at Department of Justice discretion.6 Del. C. § 12D-111(b)-(c) · source ↗
Maximum penalty
2
Up to $10,000 per violation under the consumer fraud enforcement provisions.6 Del. C. § 12D-111 (via § 2513 and § 2522) · secondary source · source ↗
Statute text read only states violations are unlawful practices under § 2513; $10,000 figure from secondary source, § 2522 cite not verified.
Rulemaking
0
No rulemaking authority in the Act.6 Del. C. ch. 12D (no provision) · source ↗
DOJ may publish a list of presumptively authorized agents (§ 12D-105). Rulemaking under HB 380 not confirmed.
Scores are our reading on the published rubric, checked 18 October 2026. Not legal advice.
Regulations library
Every US state privacy law, on one map
24 states have a comprehensive privacy law in the library, alongside the EU, UK, US federal and global laws: 102 in all, each explained in plain words with its sources. Select a state to see what applies there.
- In force
- Coming into force
- Sector laws