Delaware
Delaware Personal Data Privacy Act
Delaware’s consumer privacy law. It gives Delaware residents rights over their personal data and sets rules for businesses that meet its size limits.
- Status
- In effect since January 1, 2025
- Citation
- Del. Code tit. 6, § 12D-101 et seq.
- Official text
- Read the law(opens in a new tab)
Who it covers
Businesses that handle data of 35,000+ Delaware residents a year, or 10,000+ if they get over 20% of revenue from selling data. From Jan 1, 2027: 10,000, or 5,000.
What it asks of your website
- A privacy notice explaining what you collect, why, who you share it with and how people use their rights.
- Let people access, delete and correct their data, and opt out of targeted ads and the sale of their data.
- Honor Global Privacy Control as an opt-out (from Jan 1, 2026).
- Get opt-in consent before using sensitive data (health, precise location, children’s data and more).
- Offer an appeal when you turn down a privacy request.
- From Jan 1, 2027: give people a list of the specific third parties you disclosed their data to, on request.
Who has to comply, now and from 2027
The Delaware Personal Data Privacy Act has been enforced since January 1, 2025. Today it applies to businesses that handle the personal data of 35,000 or more Delaware consumers (not counting payment-only data), or 10,000 or more while getting over 20% of gross revenue from selling personal data.
Amendments signed on September 2, 2026 (HB 380) take effect on January 1, 2027. They lower the thresholds to 10,000 consumers, or 5,000 with over 20% of revenue from sales, and also cover third parties that get personal data from a business.
The Department of Justice says the law applies to both for-profit and nonprofit organizations; only nonprofits dedicated to fighting insurance crime are exempt.
Visitors’ rights and your deadlines
- Rights to confirm and access, correct, delete, get a portable copy, opt out of targeted advertising, sale and profiling, and get a list of the categories of third parties you disclosed their data to. From January 1, 2027, that becomes a list of the specific third parties, with some exceptions.
- Respond within 45 days, extendable once by 45 more with notice.
- Appeals: answer in writing within 60 days; a denial must say how to contact the Department of Justice.
Global Privacy Control since January 1, 2026
Since January 1, 2026, businesses must let consumers opt out of targeted advertising and sale through an opt-out preference signal such as Global Privacy Control. The signal must reflect the consumer’s own choice, not a default setting, and it wins over a conflicting site setting, though you may ask the consumer to confirm.
Sensitive data and teens
Sensitive data needs consent. Delaware’s definition already includes health conditions including pregnancy, and status as transgender or nonbinary. From 2027 it widens to cover treatment as well as status, plus categories such as neural data and government ID numbers.
For consumers you know, or willfully disregard, are 13 to 17, you need consent before targeted advertising or sale. For children under 13, follow COPPA.
Enforcement
Only the Department of Justice enforces the law; there’s no private right of action. The mandatory 60-day cure period ran through December 31, 2025; since then a chance to cure is at the Department’s discretion. A violation is an unlawful practice under Delaware’s consumer fraud law, with civil penalties of up to $10,000 per willful violation.
Where GoConsent helps
Privacy Policy builder
A Privacy Policy with a Notice at Collection, written from your settings and your latest scan, drafted to cover the points privacy laws describe. Review it with your lawyer.
Opt-outs and requests
Your Privacy Choices with a Marketing switch, “Opt out using your email”, and a Requests tab with deadlines and reminders.
Copy and delete requests (Pro)
Visitors ask for a copy of their information or for it to be deleted from Your Privacy Choices, with a 45-day deadline, a checklist and reminders.
Global Privacy Control
On by default. Honored as an opt-out, shown to the visitor, and logged with the consent record.
Children’s Privacy Policy (Pro)
A children’s privacy notice page for sites that may collect information from children under 13.
A plain-English summary, last reviewed October 25, 2026. It isn’t legal advice, and some duties depend on how your business handles data, such as security programs and answering access requests. Read the official text and talk to a lawyer about your situation.
FAQ
Questions, answered
Does Delaware’s privacy law apply to nonprofits?
Yes. The Department of Justice says it applies to both for-profit and nonprofit organizations.
Is Delaware lowering its thresholds?
Yes. From January 1, 2027: 10,000 consumers, or 5,000 with over 20% of revenue from selling data. Today it’s 35,000, or 10,000.
Do I have to honor Global Privacy Control in Delaware?
Yes, since January 1, 2026.
Check your site against this law
GoConsent scans your site, tells you which laws likely apply and what to fix. Free, with no visit limits.
