The Delaware Personal Data Privacy Act (DPDPA) took effect on 1 January 2025, and since 1 January 2026 it has required businesses to honour opt-out preference signals such as Global Privacy Control. It applies to businesses that process the data of 35,000 Delaware consumers, covers most nonprofits, and an amendment taking effect on 1 January 2027 lowers that threshold to 10,000 consumers.
Delaware's privacy law reaches further than most
The Delaware Personal Data Privacy Act, chapter 12D of title 6 of the Delaware Code, was signed into law as HB 154 in 2023 and took effect on 1 January 2025. Its version carries broader reach than many of its predecessors.
Most US state privacy laws include a revenue threshold, exempt small businesses or exempt nonprofits. The DPDPA does none of these. If your website processes the personal data of at least 35,000 Delaware consumers, excluding data processed only to complete a payment, the law applies regardless of your annual revenue. A second trigger covers controllers that process the data of at least 10,000 Delaware consumers and derive more than 20% of gross revenue from selling personal data.
Those thresholds fall on 1 January 2027, when an amendment (85 Del. Laws, c. 463) takes effect. From that date the law applies at 10,000 consumers, or at 5,000 consumers with more than 20% of revenue from data sales, and also to third parties that acquire personal data from a controller.
Who must comply with the DPDPA
The DPDPA applies to persons that conduct business in Delaware or produce products or services targeted at Delaware residents, provided they meet one of the processing thresholds above. The law does not require the controller to have a physical presence in the state. What counts is the data of Delaware residents, not where a company is incorporated.
Few entity types are exempt. Section 12D-103 excludes state and local government bodies (but not institutions of higher education), financial institutions subject to the Gramm-Leach-Bliley Act, national securities associations, and only one kind of nonprofit: one dedicated exclusively to preventing and addressing insurance crime. Every other nonprofit that meets a threshold is covered. Certain data is excluded too, such as protected health information under HIPAA and data covered by the Fair Credit Reporting Act.
The absence of a revenue threshold is significant. Under laws like the Utah Consumer Privacy Act, only businesses with $25 million in annual revenue need comply. Delaware removed that barrier entirely.
Consumer rights under the DPDPA
Delaware residents receive six core rights over their personal data:
- Right to confirm and access: verify whether a controller is processing their data, and obtain it
- Right to correct: fix inaccuracies in their personal data
- Right to delete: request erasure of data the controller holds
- Right to portability: receive a portable copy in a readily usable format
- Right to a third-party list: obtain a list of the categories of third parties that received their data
- Right to opt out: refuse processing for targeted advertising, data sales, or profiling in solely automated decisions with legal or similarly significant effects
Controllers must respond to consumer requests within 45 days, with one 45-day extension permitted when reasonably necessary. The right to a third-party list mirrors provisions in the Connecticut Data Privacy Act and goes beyond what most state laws require.
Universal opt-out signals in force since January 2026
Since 1 January 2026, controllers must let consumers opt out of targeted advertising and the sale of their data through an opt-out preference signal, such as Global Privacy Control (GPC), sent by a browser setting, extension or device setting. Section 12D-106 also requires a clear and conspicuous opt-out link on the controller's website.
Your website must detect the Sec-GPC HTTP header or the navigator.globalPrivacyControl JavaScript property and treat an active signal as an opt-out for that visitor.
If your site already honours GPC for Colorado or Connecticut, extending that logic to Delaware visitors takes little extra work. If not, a consent management platform with built-in GPC detection can handle signal recognition for you.
Sensitive data and teenagers need consent
The DPDPA requires opt-in consent before processing sensitive data. The definition of sensitive data is broad and includes:
| Category | Examples |
|---|---|
| Racial or ethnic origin | Self-reported demographic data |
| Religious beliefs | Affiliation data collected via forms |
| Health data | Mental or physical health condition or diagnosis, including pregnancy |
| Sex life, sexual orientation, transgender or nonbinary status | Profile or form fields that reveal them |
| Citizenship or immigration status | Visa or residency information |
| Precise geolocation | Location accurate to within 1,750 feet |
| Genetic or biometric data | Fingerprints, facial recognition identifiers |
| Children's data | Data from a known child under 13, processed in line with COPPA |
Teenagers get their own rule. Under section 12D-106, a controller that knows or wilfully disregards that a consumer is at least 13 and younger than 18 may not process their data for targeted advertising, or sell it, without the consumer's consent. From 1 January 2027, that consent requirement extends to every opt-out purpose, profiling included.
Consent must be freely given, specific, informed and unambiguous. Pre-ticked checkboxes do not qualify. If your site collects any of these data categories from Delaware residents, or targets ads at teenagers, a clear opt-in mechanism is required before processing begins.
Data protection assessments
Controllers processing the data of at least 100,000 consumers (excluding payment transaction data) must conduct and document data protection assessments for high-risk activities. These activities include processing personal data for targeted advertising, selling personal data, profiling, and processing sensitive data.
The assessment obligation applies to processing activities created or generated on or after 1 July 2025 and is not retroactive. Each assessment must weigh the benefits of the processing against potential risks to consumer rights. From 1 January 2027, the assessment threshold drops to 50,000 consumers.
How the DPDPA compares to other state laws
The DPDPA follows the opt-out model used by most US states rather than the opt-in framework of the GDPR. It shares structural similarities with the Virginia VCDPA but includes several provisions that set it apart.
| Provision | Delaware (DPDPA) | Virginia (VCDPA) | Texas (TDPSA) |
|---|---|---|---|
| Revenue threshold | None | None | None |
| Processing threshold | 35,000 consumers (10,000 from 2027) | 100,000 consumers | None (SBA small businesses exempt) |
| Universal opt-out signals | Required since 1 Jan 2026 | Not required | Required since 1 Jan 2025 |
| Third-party list | Yes | No | No |
| Cure period | 60 days in 2025, now discretionary | 30 days (permanent) | 30 days |
| Private right of action | No | No | No |
The Texas TDPSA shares the lack of a revenue threshold and, like Delaware, requires businesses to honour universal opt-out signals. Delaware's 35,000-consumer threshold is one of the lowest among state privacy laws that use a numeric trigger, and its 2027 figure will be lower still.
Enforcement and penalties
The Delaware Department of Justice holds exclusive enforcement authority. There is no private right of action, meaning individual consumers cannot sue businesses directly for violations.
A violation is an unlawful practice under Delaware's consumer fraud law, and a court can impose a civil penalty of up to $10,000 for each wilful violation under section 2522 of title 6 of the Delaware Code. During 2025, the Department of Justice had to give a 60-day cure period before acting on a curable violation.
That mandatory cure period ended on 31 December 2025. Since 1 January 2026, the Department may still offer a chance to cure, weighing factors such as the number of violations, the size of the business, the likelihood of harm and whether the violation was a human or technical error. Enforcement can now proceed without a warning period.
Practical steps for websites with Delaware visitors
Start by confirming whether the DPDPA applies to your operations. Review your analytics to estimate how many Delaware residents visit your site or use your services, and plan for the 10,000-consumer threshold that applies from 1 January 2027.
Update your cookie banner and privacy notice to reflect Delaware-specific rights, including the right to a list of third parties. When you decline a request, tell the consumer how to appeal and, if the appeal is denied, how to contact the Department of Justice.
Make sure GPC signals work. If your consent management platform supports GPC recognition, enable it for Delaware visitors and test it with a browser or extension that sends the Sec-GPC header.
Audit your data processing activities. Identify whether you process sensitive data from Delaware residents or target ads at teenagers and, if so, collect opt-in consent before that processing begins. A cookie audit can reveal tracking scripts that collect data categories qualifying as sensitive under the DPDPA.
Delaware privacy law: quick answers
Does the Delaware DPDPA apply to small businesses?
The DPDPA has no revenue threshold. Any business that processes the personal data of at least 35,000 Delaware consumers, or of 10,000 while deriving more than 20% of gross revenue from data sales, must comply regardless of size. From 1 January 2027 those figures fall to 10,000 and 5,000.
When must websites start honouring Global Privacy Control under Delaware law?
Since 1 January 2026. Controllers must let consumers opt out of targeted advertising and sales through an opt-out preference signal such as GPC, and keep a clear opt-out link on their website.
What is the penalty for violating the DPDPA?
A violation is an unlawful practice under Delaware's consumer fraud law, with civil penalties of up to $10,000 for each wilful violation. Since 1 January 2026, there is no guaranteed cure period before enforcement action.
Does the DPDPA require opt-in consent for cookies?
The DPDPA follows an opt-out model for general personal data processing, including most cookie-based tracking. Opt-in consent is required for sensitive data, such as precise geolocation and health data, and for targeted advertising or sales involving consumers known to be 13 to 17.
Does the DPDPA apply to nonprofits?
Yes. The only nonprofits exempt are those dedicated exclusively to preventing and addressing insurance crime. Every other nonprofit that meets a processing threshold must comply.
How does the DPDPA differ from the CCPA?
The CCPA applies based on revenue (more than $26,625,000), the number of consumers or households, or the share of revenue from selling or sharing data. The DPDPA uses consumer-count thresholds only and has no revenue floor. The CCPA also grants a limited private right of action for data breaches, which the DPDPA does not.
Check what your site sends before Delaware's 2027 threshold
If you are not sure which cookies your site sets, start with a free scan. Kukie.io finds and categorises every cookie, applies the consent model you set for each region, treats a GPC signal as an opt-out where you use an opt-out model, and keeps a record of each choice.
