Delaware Personal Data Privacy Act (DPDPA)
Amended Delaware · In force Jan 1, 2025 · next deadline Jan 1, 2027 (in 3 months)
Deadlines
Summaries for reference, not legal advice. Check the official text.
What it does
Comprehensive privacy law with low applicability thresholds and no exemption for nonprofits. Grants rights to access, correct, delete, port, and opt out of targeted advertising, sale and profiling, and requires honoring opt-out preference signals from Jan 1, 2026. A 2026 amendment (85 Del. Laws c. 463) lowers thresholds further and adds third-party duties from Jan 1, 2027.
- Who it applies to
- Until Jan 1, 2027: persons doing business in Delaware or targeting residents that controlled or processed personal data of 35,000+ consumers (excluding payment-only data), or 10,000+ consumers and derived over 20% of gross revenue from selling personal data. From Jan 1, 2027: 10,000+ consumers, or 5,000+ consumers and over 20% of gross revenue from sale, plus third parties that acquire personal data from a controller.
- Penalties
- Violations are unlawful practices under 6 Del. C. 2513 and subchapter II of chapter 25 of Title 29, enforced by the Department of Justice (civil penalties up to $10,000 per willful violation under Delaware consumer fraud law). Mandatory 60-day cure ran Jan 1 - Dec 31, 2025; from Jan 1, 2026 cure is at DOJ discretion.
- Enforced by
- Delaware Department of Justice (Attorney General)
- Official name
- Delaware Personal Data Privacy Act (HB 154), 6 Del. C. ch. 12D
- Citation
- HB 154 (152nd GA), 84 Del. Laws c. 197; amended by 85 Del. Laws c. 463; 6 Del. C. 12D-101 to 12D-111
- Topics
- privacy, children
Research notes
The 2026 amending act is cited in the Delaware Code as 85 Del. Laws c. 463; the underlying bill number and signing date were not verified. The per-violation penalty amount comes from Delaware's general consumer fraud enforcement law (the DPDPA itself does not state a dollar figure) and was not re-verified on the official code page.
Related
Alabama Personal Data Protection Act (APDPA)
CCPA / CPRA
Colorado AI Act
Connecticut Data Privacy Act (CTDPA)Questions about Delaware Personal Data Privacy Act (DPDPA)
- What are the Delaware Personal Data Privacy Act (DPDPA) compliance deadlines?
- Jan 1, 2025: DPDPA takes effect. Dec 31, 2025: Mandatory 60-day cure period expires. Jan 1, 2026: Opt-out preference signals must be honored. Jan 1, 2027: Amended thresholds and third-party duties take effect.
- When does Delaware Personal Data Privacy Act (DPDPA) take effect?
- Delaware Personal Data Privacy Act (DPDPA) took effect on Jan 1, 2025. The next milestone is Jan 1, 2027: Amended thresholds and third-party duties take effect.
- Who does Delaware Personal Data Privacy Act (DPDPA) apply to?
- Until Jan 1, 2027: persons doing business in Delaware or targeting residents that controlled or processed personal data of 35,000+ consumers (excluding payment-only data), or 10,000+ consumers and derived over 20% of gross revenue from selling personal data. From Jan 1, 2027: 10,000+ consumers, or 5,000+ consumers and over 20% of gross revenue from sale, plus third parties that acquire personal data from a controller.
- What are the penalties under Delaware Personal Data Privacy Act (DPDPA)?
- Violations are unlawful practices under 6 Del. C. 2513 and subchapter II of chapter 25 of Title 29, enforced by the Department of Justice (civil penalties up to $10,000 per willful violation under Delaware consumer fraud law). Mandatory 60-day cure ran Jan 1 - Dec 31, 2025; from Jan 1, 2026 cure is at DOJ discretion.