Delaware, USA

Regulator And AuthorityGreen

Enforcement authority sits with the Delaware DOJ/Attorney General's Consumer Protection Unit; there is no dedicated privacy regulator or rulemaking agency.

Claims (1):

• The Delaware Personal Data Privacy Act (DPDPA) took effect on January 1, 2025, and is enforced by the Delaware Department of Justice.

Act And InstrumentsGreen

The DPDPA is the sole omnibus instrument; a separate long-standing Delaware breach-notification statute (6 Del. C. §12B) operates alongside it.

Claims (1):

• The Delaware Personal Data Privacy Act (DPDPA) took effect on January 1, 2025, and is enforced by the Delaware Department of Justice.

Material ScopeGreen

Material scope is defined by consumer-count/revenue thresholds and a broad personal-data definition, with sectoral exemptions.

Claims (2):

• The DPDPA applies to persons conducting business in or targeting Delaware residents that, in the preceding calendar year, controlled or processed the personal data of 35,000 or more consumers, or 10,000 or more consumers while deriving more than 20% of gross revenue from selling personal data.
• The DPDPA does not apply to personal data maintained in compliance with the Gramm-Leach-Bliley Act, HIPAA, or the Fair Credit Reporting Act, nor to certain data processed for specified exempt purposes.

Territorial ScopeGreen

The Act reaches any entity, regardless of domicile, that targets Delaware residents or conducts business in the state and meets the threshold; the AG has indicated it will pursue out-of-state controllers meeting the threshold.

Claims (1):

• The Attorney General has stated it will not hesitate to pursue enforcement against out-of-state third parties doing business in Delaware if they meet the DPDPA's applicability threshold.

Regulator Registration And FilingAmber

No controller registration/filing regime with the Attorney General was identified; compliance is self-assessed against statutory thresholds.

Claims (1):

• No controller registration or filing obligation with the Delaware Attorney General was located within the DPDPA or AG guidance; compliance appears self-assessed.

Lawful BasesAmber

No enumerated Art. 6-style lawful bases; a notice/purpose-limitation-and-opt-out model governs ordinary processing.

Claims (1):

• Rather than enumerating GDPR-style lawful bases, the DPDPA relies on a notice-and-purpose-limitation model, requiring affirmative consumer consent only for sensitive-data processing, secondary-purpose processing, and processing following a consumer opt-out.

Consent ThresholdsGreen

Consent must be affirmative, freely given, specific, informed and unambiguous; broad ToS acceptance and dark-pattern-induced agreement are expressly invalid.

Claims (1):

• Under the DPDPA, consent must be affirmative, freely given, specific, informed, and unambiguous; acceptance of broad terms of service, passive interaction with content, or agreement obtained through deceptive webpage design is not valid consent.

Special CategoriesGreen

Sensitive data (health, biometric, genetic, ethnicity, religion, sexual orientation, immigration status, children's data) requires prior consumer consent.

Claims (1):

• Sensitive data under the DPDPA includes data revealing racial/ethnic origin, religious beliefs, health diagnoses, sexual orientation/activity, citizenship/immigration status, and genetic or biometric data used to uniquely identify an individual, requiring consumer consent prior to collection or processing.

Pseudonymisation And AnonymisationRed

Detailed pseudonymisation/anonymisation safe-harbour criteria were not confirmed in the reviewed AG guidance.

Access RightGreen

Consumers may access their personal data free of charge once every 12 months; additional requests may incur an administrative fee.

Claims (1):

• Delaware consumers may request access to personal data a controller has collected about them free of charge once every 12 months; controllers may charge an administrative fee for additional requests.

Rectification And ErasureGreen

Consumers may correct inaccuracies and delete personal data, including data obtained by controllers from third parties.

Claims (1):

• Consumers have the right to correct inaccuracies in and delete their personal data, including data a controller collected through third parties.

Restriction And ObjectionGreen

Consumers may opt out of the sale of personal data to third parties and may designate an authorized agent to do so on their behalf.

Claims (1):

• Consumers may opt out of the sale of personal data to third parties and may designate a third party to exercise the opt-out on their behalf.

Data PortabilityGreen

Portability is included among the enumerated consumer rights alongside access, correction, erasure and opt-out.

Claims (1):

• Consumer rights under the DPDPA include information access, data rectification, erasure, portability, and opt-out options for targeted advertising and automated profiling.

Deadlines And Response WindowsGreen

Controllers have 45 days to respond to a consumer's appeal of a denied rights request.

Claims (1):

• A controller has 45 days after receipt of a consumer's appeal of a denied rights request to respond in writing, explaining the actions taken and reasons for refusal.

Accountability And DpiaGreen

DPIAs are required for high-risk processing activities.

Claims (1):

• Controllers must conduct data protection impact assessments (DPIAs) for high-risk processing activities under the DPDPA.

Dpo RequirementsRed

No DPO-appointment threshold analogous to GDPR Art. 37 was identified.

Claims (1):

• No dedicated Data Protection Officer appointment threshold analogous to GDPR Art. 37-39 was identified in the DPDPA or AG guidance.

Ropa RequirementsAmber

Controllers/processors document processing relationships contractually; a formal public ROPA filing requirement was not confirmed.

Claims (1):

• Businesses are directed to inventory personal data collected, identify storage locations, and document access and third-party processor relationships, though no formal public Records-of-Processing-Activities filing requirement was confirmed.

Joint Controller ArrangementsAmber

The Act distinguishes controller/processor roles by decision-making authority; a processor exercising independent decision-making becomes a controller for that processing.

Security MeasuresGreen

Controllers must employ reasonable data security measures proportionate to the sensitivity of the personal data collected.

Claims (1):

• The DPDPA requires businesses to employ reasonable data security measures proportionate to the nature and sensitivity of the personal data collected, to prevent unauthorized access.

Breach NotificationGreen

Delaware's separate 2018 breach-notification statute requires notice to affected residents and, above 500 residents, to the Attorney General.

Claims (1):

• Delaware's data breach notification statute, in effect since April 14, 2018, requires notice to affected Delaware residents and, where a breach affects 500 or more residents, additional notice to the Delaware Attorney General.

Retention And DisposalAmber

No DPDPA-specific retention-period or disposal-duty detail beyond general data-minimization principles was confirmed.

Transfer MechanismsRed

No dedicated transfer-mechanism provisions were located; general contractual/security duties apply irrespective of data destination.

Claims (1):

• The DPDPA does not contain an adequacy-decision framework, Standard Contractual Clauses regime, Binding Corporate Rules mechanism, or data-localisation mandate; cross-border transfer is governed only indirectly through the Act's general controller/processor contractual and security obligations.

Adequacy ReceivedRed

Not applicable; US states do not receive adequacy decisions under this framework.

Adequacy GrantedRed

No adequacy-granting mechanism exists under the DPDPA.

Sccs And BcrsRed

No SCC or BCR regime identified under the DPDPA.

Transfer Impact AssessmentRed

No transfer-impact-assessment requirement identified.

Data LocalisationRed

No data-localisation mandate identified under the DPDPA.

Financial Sector OverlayAmber

Data maintained in compliance with GLBA is exempt from the DPDPA.

Claims (1):

• The DPDPA does not apply to personal data maintained in compliance with the Gramm-Leach-Bliley Act, HIPAA, or the Fair Credit Reporting Act, as well as personal data processed for certain specified purposes.

Health Sector OverlayAmber

Data maintained in compliance with HIPAA is exempt from the DPDPA.

Claims (1):

• The DPDPA does not apply to personal data maintained in compliance with the Gramm-Leach-Bliley Act, HIPAA, or the Fair Credit Reporting Act, as well as personal data processed for certain specified purposes.

Telecoms And EprivacyRed

No Delaware-specific telecoms/ePrivacy overlay was identified.

Employment DataAmber

The DPDPA excludes personal data processed in an employment context (e.g., job applications) from its consumer protections.

Claims (1):

• The DPDPA applies to Delawareans acting in an individual or household context and does not protect an individual acting in an employment context, such as applying for a job.

Credit And ScoringAmber

The Fair Credit Reporting Act exemption covers certain credit-related data; no DE-specific credit-scoring overlay beyond this was identified.

Claims (1):

• The DPDPA does not apply to personal data maintained in compliance with the Gramm-Leach-Bliley Act, HIPAA, or the Fair Credit Reporting Act, as well as personal data processed for certain specified purposes.

EducationRed

No Delaware-specific education-sector data overlay was identified.

InsuranceRed

No Delaware-specific insurance-sector data overlay was identified.

Cookies And TrackersAmber

No dedicated cookie-consent statute distinct from the general personal-data consent framework was identified.

Dark PatternsGreen

Consent obtained through deceptive webpage design is expressly excluded as valid consent.

Claims (1):

• Acceptance of broad terms of service, hovering over or pausing on content, and agreement obtained through deceptive webpage design ('dark patterns') are not considered valid consent under the DPDPA.

Opt Out SignalsGreen

Universal opt-out mechanisms must be honored by controllers as valid consumer opt-out requests as of January 1, 2026.

Claims (1):

• Beginning January 1, 2026, controllers must recognize universal opt-out mechanisms as valid consumer requests to opt out of personal-data processing across multiple websites at once.

Clean Rooms And DcrRed

No clean-room or data-collaboration-room rules were identified under the DPDPA.

Cross Context AdvertisingGreen

Consumers may opt out of processing for targeted advertising and automated profiling.

Claims (1):

• Consumer rights under the DPDPA include opt-out options for targeted advertising and automated profiling.

Direct MarketingAmber

No DE-specific direct-marketing consent/suppression regime distinct from the general sale/targeted-advertising opt-out was identified.

Profiling RestrictionsGreen

Consumers may opt out of processing for automated profiling; minors under 18 require opt-in consent for related targeted-advertising/sale processing.

Claims (1):

• The DPDPA requires controllers to obtain opt-in consent before selling a consumer's personal data or processing personal data for targeted advertising when the consumer is under 18 years old.

Automated Decision Making TransparencyAmber

No explicit ADM-explanation right distinct from the general profiling opt-out was confirmed.

Ai Risk AssessmentsRed

No AI-specific risk-assessment regime (EU AI Act analogue) was identified; DPIA obligations cover high-risk processing generally.

Claims (1):

• No AI-system-specific risk-assessment regime akin to the EU AI Act or state AI-transparency statutes was identified within the DPDPA; its DPIA obligations address 'high-risk processing' generally rather than AI systems specifically.

Biometric RegimeGreen

Biometric data used to uniquely identify an individual is classified as sensitive data requiring consent.

Claims (1):

• Genetic and biometric data used to uniquely identify an individual are classified as sensitive data under the DPDPA, requiring consumer consent prior to collection or processing.

Genetic DataGreen

Genetic data used to uniquely identify an individual is classified as sensitive data requiring consent.

Claims (1):

• Genetic and biometric data used to uniquely identify an individual are classified as sensitive data under the DPDPA, requiring consumer consent prior to collection or processing.

State Surveillance CarveoutsAmber

The Act permits denial of consumer-rights requests where necessary to comply with federal, state, or local law, functioning as a general legal-compliance carve-out rather than a dedicated national-security exemption.

Claims (1):

• A controller may deny a consumer's rights request where fulfilling it would restrict the controller's ability to comply with federal, state, or local law.

Age VerificationAmber

No standalone age-verification mandate distinct from the under-18 opt-in-consent trigger was identified.

Parental ConsentGreen

Parents/guardians may exercise DPDPA consumer rights on a child's behalf, and controllers must additionally follow COPPA parental-consent requirements.

Claims (1):

• Where a child's personal data is processed, the child's parent or legal guardian may exercise the DPDPA's consumer rights on the child's behalf, and controllers must follow COPPA parental-consent requirements.

Minor Profiling BansGreen

Opt-in consent is required before selling or using a under-18 consumer's data for targeted advertising, restricting default profiling-adjacent uses.

Claims (1):

• In addition to protections afforded adults, Delaware law provides additional protections for children and teens under 18, including a requirement of opt-in consent before selling their personal data or using it for targeted advertising.

Education SettingsRed

No Delaware-specific education-sector/student-data provisions were identified within the DPDPA.

Dependent AdultsRed

No Delaware-specific dependent-adult (elderly/incapacitated) protections were identified within the DPDPA.

Regulator Powers And PenaltiesGreen

Civil penalties up to $10,000 per violation, plus injunctive relief, restitution, and disgorgement, are available to the Attorney General.

Claims (1):

• Entities or individuals that violate the DPDPA may face civil penalties up to $10,000 per violation, and the Attorney General can additionally seek injunctive relief, restitution, and/or disgorgement.

Enforcement Activity IndexAmber

No specific published enforcement actions/fines under the DPDPA were located as of this run; enforcement began January 1, 2025.

Regulator Funding And CapacityRed

No specific headcount or budget figures for DPDPA enforcement within the Consumer Protection Unit were located.

Claims (1):

• No specific headcount, budget, or staffing figures for DPDPA enforcement within the Delaware DOJ Consumer Protection Unit were located in reviewed sources.

Collective Redress And Class ActionsAmber

Absent a private right of action, collective redress is limited to Attorney General complaint channels rather than consumer-initiated class actions.

Claims (1):

• Because the DPDPA lacks a private right of action, consumer complaints are channeled to the Attorney General's office (privacy@delaware.gov) rather than through consumer-initiated class actions.

Private Right Of ActionAmber

The DPDPA does not include a private cause of action; private citizens cannot sue directly under the Act.

Claims (1):

• The DPDPA does not include a private cause of action; private citizens are not entitled to file lawsuits or enforce legal rights directly under the Act.

Recent Developments 180DAmber

HB 380, introduced April 16, 2026, would amend the DPDPA (lower thresholds, expanded rights, January 1, 2027 effective date) and was reported to have passed the Legislature by June 2026; gubernatorial signature is unconfirmed.

Claims (1):

• House Bill No. 380, introduced to the Delaware House on April 16, 2026, would amend the DPDPA by lowering the applicability threshold to 10,000 consumers (or 5,000 with significant data-sale revenue), expand access and profiling opt-out rights, and take effect January 1, 2027; the bill was reported to have passed the Legislature by June 2026, but gubernatorial signature was not confirmed as of this run.