Delaware DPDPA

Delaware Personal Data Privacy Act (6 Del. C. Chapter 12D)

The Delaware Personal Data Privacy Act took effect on 1 January 2025 with some of the lowest applicability thresholds of any state law. HB 380, signed on 2 September 2026, lowers them further from 1 January 2027 and expands sensitive data and assessment duties.

Who it applies to

Persons doing business in Delaware or targeting its residents that control or process the personal data of 35,000 or more consumers, or 10,000 or more consumers while deriving more than 20 percent of gross revenue from selling personal data (excluding payment-only data). From 1 January 2027 the thresholds fall to 10,000 consumers, or 5,000 with more than 20 percent of revenue from data sales.

Identity requirements

• Obtain consent before processing sensitive data, including biometric and genetic data; from 2027 processing must also be reasonably necessary and proportionate, and sensitive data expands to government ID numbers, financial credentials and neural data
• Obtain parental consent for children under 13 and consent for targeted advertising or sale involving consumers aged 13 to 17
• Honor universal opt-out preference signals (required from 1 January 2026)
• Conduct data protection assessments where the controller processes data of 100,000 or more consumers (50,000 from 2027)
• Honor rights to access, correct, delete and port data, and to obtain a list of categories of third parties

How it impacts identity systems

Penalties

Violations are unlawful practices enforced by the Department of Justice under Delaware's consumer protection law, with civil penalties of up to 10,000 dollars per wilful violation commonly cited; the Act itself does not state a figure. The mandatory 60-day cure period ran through 31 December 2025, and cure is now at the Department's discretion.