Delaware
Delaware Online Privacy and Protection Act (DOPPA)
Delaware’s website privacy policy law, similar to California’s CalOPPA. Applies to any website that collects personal data from Delaware residents.
- Status
- In effect since January 1, 2016
- Citation
- Del. Code tit. 6, § 1205C
- Official text
- Read the law(opens in a new tab)
Who it covers
Any website or online service that collects personal information from Delaware residents.
What it asks of your website
- Post a privacy policy that’s easy to find.
- List the kinds of data collected and the kinds of third parties it’s shared with.
- Say how the site responds to “Do Not Track” and whether other companies collect data across sites.
- Show the policy’s effective date.
Who has to comply
The Delaware Online Privacy and Protection Act has applied since January 1, 2016 to the owner of any commercial website, online or cloud service, or app that collects personally identifiable information from Delaware residents over the internet. There’s no size threshold. A company that only hosts or manages a site it doesn’t own isn’t the operator.
It still applies alongside Delaware’s newer, broader Personal Data Privacy Act; neither law replaces the other.
What the privacy policy must say
Make the policy conspicuously available on your website. It must:
- Identify the categories of personal information you collect and the third parties you share it with.
- Describe how users can review and request changes, if you offer that.
- Explain how you tell users about material changes.
- State its effective date.
- Disclose how you respond to Do Not Track signals (or link clearly to the protocol you follow).
- Disclose whether other parties may collect information about users’ online activity.
A violation happens only if you don’t post a compliant policy within 30 days of being notified, and acted knowingly and willfully or negligently and materially.
Ads on sites for children
Delaware counts anyone under 18 as a child. A site, service or app directed mainly at children may not market or advertise certain products, and neither may any site to a child it actually knows is using it. The list includes alcohol, tobacco, firearms and ammunition, fireworks, tanning, lottery and gaming, tattoos and piercing, drug paraphernalia and sexually oriented material. A child-directed site must tell its ad network, which then may not serve those ads there.
Enforcement
The Consumer Protection Unit of the Delaware Department of Justice enforces the law. The law also limits when online booksellers can disclose what users read to the government.
Where GoConsent helps
A plain-English summary, last reviewed October 26, 2026. It isn’t legal advice, and some duties depend on how your business handles data, such as security programs and answering access requests. Read the official text and talk to a lawyer about your situation.
FAQ
Questions, answered
Does DOPPA apply to small websites?
Yes. Any commercial site that collects personal information from Delaware residents needs a compliant privacy policy.
Who is a child under DOPPA?
Anyone under 18 who lives in Delaware.
Is there a grace period?
Yes. A violation only occurs if the policy isn’t fixed within 30 days of being notified.
Check your site against this law
GoConsent scans your site, tells you which laws likely apply and what to fix. Free, with no visit limits.
