Key Facts
Overview
Delaware's DPDPA features the broadest children's age protection among US state privacy laws, requiring opt-in consent for sale and targeted advertising of data from anyone under 18. It also has lower applicability thresholds (35,000/10,000) than most states and must honor universal opt-out mechanisms.
What This Means for Your Website
- GPC/universal opt-out signals must be honored
- Under 18: opt-in consent required for sale and targeted advertising (broadest age threshold)
- Opt-in consent required for sensitive data
- The cure period (60 days) sunsets December 31, 2025
- The AG can seek restitution and disgorgement in addition to penalties
Key Requirements
The Delaware AG enforces the DPDPA with penalties up to $10,000 per violation, plus injunctive relief, restitution, and disgorgement. Consumer requests must be fulfilled within 45 days. Lower thresholds mean more businesses are captured than in most states.
How ConsentStack Handles This
ConsentStack detects Delaware visitors, honors GPC signals, and applies enhanced protections for under-18 visitors by blocking data sale and targeted advertising.
Penalties
Up to $10,000 per violation; plus injunctive relief, restitution, and disgorgement.
Key Requirements
- Honor GPC/universal opt-out signals
- Opt-in consent for sensitive data
- Parental consent for children's data
- Consumer rights: access, correct, delete, portability, opt-out
- Data protection assessments for high-risk processing
Notable Provisions
- Broadest children protection: under 18 opt-in for sale/advertising
- Lower thresholds (35,000/10,000)
- Cure period sunsets December 2025
- AG can seek restitution and disgorgement
Data Subject Rights
Confirm whether a controller is processing your personal data and access that data, unless doing so would reveal a trade secret; responses are free once in any 12-month period.
Correct inaccuracies in your personal data, taking into account the nature of the data and the purposes of the processing.
Have a controller delete personal data you provided or that it obtained about you.
Obtain a copy of your personal data processed by automated means in a portable and, where technically feasible, readily usable format you can transmit to another controller, without revealing trade secrets.
Obtain a list of the categories of third parties to which the controller has disclosed your personal data; from January 1, 2027 the amended law requires a list of the specific third parties, with limited exceptions.
Opt out of the processing of your personal data for targeted advertising, including through an opt-out preference signal that controllers must honor from January 1, 2026; for consumers known to be 13 to 17, targeted advertising requires consent.
Opt out of the sale of your personal data, including through an opt-out preference signal that controllers must honor from January 1, 2026; for consumers known to be 13 to 17, a sale requires consent.
Opt out of profiling in furtherance of solely automated decisions that produce legal or similarly significant effects, such as decisions on financial or lending services, housing, insurance, education, criminal justice, employment, health care or access to essential goods or services.
Designate an authorized agent, including through a browser setting, browser extension or global device setting, to opt out of targeted advertising, sale or profiling on your behalf; this agent right covers opt-outs only.
Appeal a controller's refusal to act on your request, within a reasonable period after receiving the decision, through a process that is conspicuously available and similar to the request process.
If your appeal is denied, the controller must give you an online mechanism, if available, or another method to submit a complaint to the Delaware Department of Justice.
Revoke consent you gave, for example to the processing of sensitive data, through a mechanism at least as easy as the one used to give it, after which the controller must stop the processing.
A controller may not discriminate against you for exercising your rights, including by denying goods or services, charging different prices or giving a different level of quality, except for bona fide loyalty, rewards, premium features, discount or club card programs.
US State Specifics
Other North America Regulations
Frequently Asked Questions
DPDPA requires you to recognize an opt-out preference signal such as Global Privacy Control. Check whether GPC is working on your site to confirm the signal reaches you and that trackers actually stop firing when it does.
Stay compliant with DPDPA
ConsentStack helps you implement Opt-out consent for Delaware, United States automatically.