- Delaware Personal Data Privacy Act (DPDPA)
- Code: Del. House Bill 154
Effective Date: January 1, 2025
Persons that who conduct business in Delaware or persons that produce products or services that are targeted to residents of Delaware and that during the preceding calendar year did any of the following:
(1) Controlled or processed the personal data of not less than 35,000 consumers, excluding personal data controlled or processed solely for the purpose of completing a payment transaction; or
(2) Controlled or processed the personal data of not less than 10,000 consumers and derived more than 20 percent of their gross revenue from the sale of personal data
Definition of "Personal Data"
Any information that is linked or reasonably linkable to an identified or identifiable individual. Does not include de-identified data or publicly available information. Personal data does not include data from people acting in an employment or commercial context.
Definition of "Sale"
Exchange of personal data for monetary or other valuable consideration by the controller to a third party
Requires a controller "that controls or processes the data of not less than 100,000 consumers, excluding data controlled or processed solely for the purpose of completing a payment transaction" to conduct and document data protection assessments "for each of the controller's processing activities" presenting a heightened risk of harm to a consumer, which includes targeted advertising, sale, sensitive data, certain profiling
Opt-In Consent Required for Processing Sensitive Data
Consumer Rights to Request Access, Correction, Deletion & Portability
Consumer Right to Opt Out of Sale
Consumer Right to Opt Out of Targeted Ads
Pseudonymous Data Exempt from Consumer Requests
Universal Opt-Out Mechanism Required Recognition/Date
Yes, no later than January 1, 2026
Data of Minors
A controller is prohibited from processing the personal data of a consumer for the purposes of targeted advertising or the sale of consumer's personal data without the consumer's consent where a controller has actual knowledge or willfully disregards that the consumer is at least 13 years of age but younger than 18 years of age.
Yes (both entity-level and data level)
Applies/Does Not Apply to Personal Information in a Commercial or Employment Context
Does not apply to commercial or employment context; applies in an individual or household context
Private Right of Action
Cure Period Expiration
December 31, 2025
DE Dept. of Justice Bureau of Consumer Protection/refers to Delaware Code provision (29 DE Code § 2522) that provides for penalties of up to $10,000 per violation.