---------------------------
Title: Delaware Personal Data Privacy Act (DPDPA): An Overview
URL: https://usercentrics.com/us/knowledge-hub/delaware-digital-personal-data-protection-act-dpdpa/
---------------------------

# Delaware Personal Data Privacy Act (DPDPA): An Overview

The Delaware Personal Data Privacy Act (DPDPA), signed on September 11, 2023, is the twelfth comprehensive U.S. state privacy law. It took effect on January 1, 2025, and House Bill 380 expands its scope from January 1, 2027. This overview covers who the law applies to, consumer rights, sensitive data, opt-out signals, and enforcement.

### At a Glance

- The DPDPA took effect on January 1, 2025, and the Delaware Department of Justice is its sole enforcer.
- The law currently applies to businesses that process the personal data of at least 35,000 Delaware consumers, or at least 10,000 consumers while deriving more than 20 percent of gross revenue from selling personal data.
- HB 380, signed on September 2, 2026, lowers those thresholds to 10,000 and 5,000 consumers from January 1, 2027, and tightens the rules on sensitive data, profiling, and third-party contracts.
- Controllers have been required to recognize universal opt-out signals, such as Global Privacy Control, since January 1, 2026.
- The mandatory 60-day cure period ended on December 31, 2025, so the Department of Justice now decides whether to offer one.
- Willful violations can carry civil penalties of up to USD 10,000 per violation, and there is no private right of action.

Delaware’s law, enacted through [HB 154](https://legis.delaware.gov/BillDetail?LegislationId=140388), was the eighth state-level data privacy law passed in the United States in 2023 and the twelfth comprehensive privacy law passed. Additional states have enacted comprehensive laws since.

Delaware’s privacy law shares core features with [California’s Consumer Privacy Act (CCPA)](https://usercentrics.com/us/us/knowledge-hub/california-consumer-privacy-act/), such as consumer rights to access, delete, and opt out. Unlike California’s laws, it has no private right of action. It also applies to a broad range of companies of all sizes: it doesn’t specifically target large businesses, like [Florida’s law](https://usercentrics.com/knowledge-hub/florida-digital-bill-of-rights-fdbr/),,or exclude small ones, like the [Texas Data Privacy and Security Act (TDPSA)](https://usercentrics.com/knowledge-hub/texas-data-privacy-and-security-act/). From January 1, 2027, its 10,000-consumer threshold will be the lowest in the nation, according to the Governor’s office.

## What Is the Delaware Personal Data Privacy Act?

Delaware’s data privacy law protects the personal data rights of the state’s roughly one million residents when they act in individual or household contexts, rather than in a commercial or employment capacity. From January 1, 2027, certain profiling and “report” obligations also reach the employment context (see the HB 380 section below).

### Privacy Notice Requirements

Data controllers, defined under the law as “a person that, alone or jointly with others, determines the purpose and means of processing personal data” must provide consumers with a privacy notice that is “accessible, clear, and meaningful”. The notice has to describe the organization’s data processing operations, and include:

- Categories of personal data collected and processed
- Purposes of processes
- Categories of personal data shared with third parties
- Categories of recipients of personal data
- How consumers can exercise their data privacy rights, including opt-out
- How consumers can appeal a controller’s decision (e.g. denial of a data subject access request)
- An active email address or other online mechanism that consumers can use to contact the controller
- A clear and conspicuous disclosure if the controller sells personal data to third parties or processes it for targeted advertising

### Opt-Out Model for Most Processing

Like most U.S. state privacy laws, the DPDPA uses an opt-out model for most processing, so controllers can collect personal data without consumers’ consent in many cases. Consent is required for sensitive data, the personal data of a known child, and targeted advertising or sales involving consumers ages 13 to 17.

Consumers have the right to opt out of the processing of their personal data for sale, targeted advertising, or profiling “in furtherance of solely automated decisions that produce legal or similarly significant effects concerning the consumer,” and controllers must provide information about and mechanisms for doing so. From January 1, 2027, [HB 380](https://legis.delaware.gov/BillDetail/143105) removes the word “solely,” so the profiling opt-out will cover profiling in furtherance of automated decisions more broadly.

The law notes that controllers must provide “a clear and conspicuous link on the controller’s Internet web site to an Internet web page that enables a consumer, or an agent of the consumer, to opt out of the targeted advertising or the sale of the consumer’s personal data.” From January 1, 2027, this link requirement also covers profiling and applies to a controller’s applications as well as its website.

Additionally, since January 1, 2026, one year after the law took effect, controllers must allow consumers to opt out of processing for targeted advertising, or of any sale of personal data, through an opt-out preference signal sent, with the consumer’s consent, by a platform, technology, or mechanism.

## Definitions in the Delaware Personal Data Privacy Act

These definitions determine how the DPDPA applies in practice, because terms such as controller, sale, and targeted advertising set the scope of both consumer rights and business obligations. From January 1, 2027, HB 380 amends several of them, including sensitive data and sale, and adds new terms such as “report” and “resident.” The next question is which organizations fall within the law, which depends on how many Delaware consumers’ data they process.

### Personal Data Under the DPDPA

Refers to *“any information that is linked or reasonably linkable to an identified or identifiable individual, and does not include de-identified data or publicly available information”*.

It should be noted that personal data (also called personal information) and [personally identifiable data](https://usercentrics.com/knowledge-hub/personally-identifiable-information-vs-personal-data/) are not always the same thing, and distinctions are often made in data privacy laws.

### Sensitive Data Under the DPDPA

Sensitive data is a category of personal data that could cause harm if unlawfully accessed or misused, and under the DPDPA it cannot be processed without the consumer’s prior consent. Delaware’s privacy law specifically refers to personal data that would reveal any of the following:

- Racial or ethnic origin
- Religious beliefs
- Mental or physical health condition or diagnosis (including pregnancy)
- Sex life or sexual orientation, including status as transgender or nonbinary
- National origin
- Citizenship or immigration status
- Genetic or biometric data
- Personal data of a known child
- Precise geolocation data (with precision and accuracy within a radius of 1,750 feet)

From January 1, 2027, HB 380 expands this definition to add health treatment or status, neural data, financial account numbers and log-in credentials, and government-issued identification numbers, such as Social Security, passport, state ID, and driver’s license numbers. It also covers inferences drawn from personal data that are used to reveal or identify any sensitive category. Processing sensitive data will then require consent and must be reasonably necessary and proportionate to the disclosed purposes.

Selling sensitive data will be allowed only where it is strictly necessary to provide a product or service the consumer requested, with clear advance notice, the consumer’s consent, and a consent record kept for five years.

### Consent Under the DPDPA

Like many other data privacy laws, the Delaware data privacy law follows the [European Union’s General Data Protection Regulation (GDPR)](https://usercentrics.com/knowledge-hub/the-eu-general-data-protection-regulation/) with regard to the definition of valid consent: “a clear affirmative act signifying a consumer’s freely given, specific, informed and unambiguous agreement to allow the processing of personal data relating to the consumer.”

To provide additional clarity, “Consent” may include a written statement, including by electronic means, or any other unambiguous affirmative action.” Under the DPDPA, consent does not include:

- Acceptance of a general or broad terms of use or similar document that contains descriptions of personal data processing along with other, unrelated information
- Hovering over, muting, pausing, or closing a given piece of content
- Agreement obtained through the use of [dark patterns](https://usercentrics.com/knowledge-hub/dark-patterns-and-how-they-affect-consent/)

### Consumer Under the DPDPA

Refers to “an individual who is a resident of [Delaware]”.

The definition does not include “an individual acting in a commercial or employment context or as an employee, owner, director, officer, or contractor of a company, partnership, sole proprietorship, nonprofit organization, or government agency whose communications or transactions with the controller occur solely within the context of that individual’s role with the company, partnership, sole proprietorship, nonprofit organization, or government agency.”

### Controller under the DPDPA

Businesses and other organizations that collect and use personal data will likely qualify as controllers, though the law uses the word “person”. Controller is defined as *“*a person that, alone or jointly with others, determines the purpose and means of processing personal data.”

### Processor Under the DPDPA

Like controller, while the law references a person, in most cases this is likely to be done by a company or other organization. Processor is defined as “a person that processes personal data on behalf of a controller.” It could include third parties like advertising partners or fulfillment companies.

### Report Under the DPDPA

From January 1, 2027, HB 380 adds a definition of “report” to the DPDPA. The term matters because controllers that disclose reports for use in significant decisions take on additional duties (see “Key Requirements for Controllers Under the DPDPA”). The law defines a report as “any written, oral, or other communication of any personal data by a controller or processor, including recommendations, summaries, or automated decisions based on personal data or profiling.”

In practice, this can include a risk score, a candidate ranking, or an automated recommendation that a third party uses in a decision about housing, lending, insurance, education, employment, health care, or access to essential goods or services.

### Resident Under the DPDPA

HB 380 also introduces the term “resident,” defined as “any natural person residing in the State.”

The distinction from “consumer” is important. A consumer is a Delaware resident acting in an individual or household context, and the definition excludes people acting in a commercial or employment capacity. The report and profiling provisions refer to residents instead, so they can apply to personal data processed in the employment context, such as AI resume screening, interview scoring, and reports used for hiring, promotion, discipline, or termination. Employment data otherwise remains exempt from the DPDPA.

### Profiling Under the DPDPA

Profiling is increasingly becoming a standard inclusion in data privacy laws, particularly as it can relate to “automated decision-making” or the use of AI technologies. The DPDPA defines profiling as “any form of automated processing performed on personal data to evaluate, analyze, or predict personal aspects related to an identified or identifiable individual’s economic situation, health, demographic characteristics, personal preferences, interests, reliability, behavior, location, or movements.”

### Targeted Advertising Under the DPDPA

This is also increasingly becoming a standard inclusion in data privacy laws, and can refer to the use of emerging technologies like AI tools. The Delaware data privacy law defines targeted advertising as “displaying advertisements to a consumer where the advertisement is selected based on personal data obtained or inferred from that consumer’s activities over time and across nonaffiliated Internet web sites or online applications to predict such consumer’s preferences or interests.”

The following are not included in the definition of targeted advertising:

- Advertisements based on activities within a controller’s own Internet web sites or online applications
- Advertisements based on the context of a consumer’s current search query, visit to an Internet web site, or online application
- Advertisements directed to a consumer in direct response to the consumer’s request for information or feedback
- Processing personal data solely to measure or report advertising frequency, performance or reach

### Sale Under the DPDPA

Refers to “the exchange or transfer of personal data for monetary or other valuable consideration by the controller to a third party”.

Exclusions to the definition of sale include disclosures of personal data:

- To a processor that processes the personal data on behalf of the controller where limited to the purpose of such processing
- To a third party for purposes of providing a product or service affirmatively requested by the consumer
- Transfer of personal data to an affiliate of the controller
- Where the consumer directs the controller to disclose the personal data or intentionally uses the controller to interact with a third party
- That the consumer intentionally made available to the general public via a channel of mass media, and did not restrict to a specific audience
- Transfer of personal data to a third party as an asset in a merger, acquisition, bankruptcy, or similar transaction, or a proposed one, in which the third party assumes control of all or part of the controller’s assets

These definitions determine how the DPDPA applies in practice, because terms such as controller, sale, and targeted advertising set the scope of both consumer rights and business obligations. From January 1, 2027, HB 380 amends several of them, including sensitive data and sale, and adds new terms such as “report” and “resident.” The next question is which organizations fall within the law, which depends on how many Delaware consumers’ data they process.

## Which Organizations Does the Delaware Personal Data Privacy Act Cover?

The DPDPA’s thresholds are lower than those of many comparable U.S. state laws, which reflects the state’s population of roughly one million people. California, by comparison, has about 40 million. As a result, the law applies to more small businesses.Through December 31, 2026, the DPDPA applies to organizations that conduct business in Delaware or produce products or services targeted to Delaware residents and, during the preceding calendar year:

- Controlled or processed the personal data of at least 35,000 consumers, excluding data processed solely to complete a payment transaction, or
- Controlled or processed the personal data of at least 10,000 consumers and derived more than 20 percent of gross revenue from the sale of personal data

From January 1, 2027, HB 380 applies the law to organizations that, during the preceding calendar year:

- Controlled or processed the personal data of at least 10,000 consumers, excluding data processed solely to complete a payment transaction

- Controlled or processed the personal data of at least 5,000 consumers and derived more than 20 percent of gross revenue from the sale of personal data, or
- Are third parties that acquire personal data from a controller, regardless of the number of consumers

### Exemptions to DPDPA Requirements

The DPDPA’s exemptions are similar to those in other state laws and include data processing governed by federal laws such as the Health Insurance Portability and Accountability Act (HIPAA) and the [Gramm-Leach-Bliley Act (GLBA)](https://usercentrics.com/us/knowledge-hub/glba-compliance/). From January 1, 2027, HB 380 narrows the entity-level exemption for financial institutions, so organizations in the financial sector should confirm whether they remain exempt.

Exempted entities and their services/activities include:

- Governmental agencies, including regulatory, administrative, legislative or judicial bodies
- Public health organizations
- Financial institutions and affiliates subject to the GLBA (from January 1, 2027, the entity-level exemption narrows to certain banks, credit unions, insurers, securities professionals, and their affiliates)
- Press, wire, or other information service (and non-commercial activities of media entities)
- Victims or witnesses of criminal activities

Exempted regulations (and data processed relevant to them) include:

- [Health Insurance Portability and Accountability Act (HIPAA)](https://usercentrics.com/us/knowledge-hub/health-insurance-portability-and-accountability-act-hipaa/)
- Gramm-Leach-Bliley Act (GLBA)
- [Fair Credit Reporting Act (FCRA)](https://usercentrics.com/knowledge-hub/fair-credit-reporting-act-fcra/)
- Driver’s Privacy Protection Act
- Family Educational Rights and Privacy Act (FERPA)
- Farm Credit Act
- Airline Deregulation Act

## Consumers’ Rights Under the Delaware Personal Data Privacy Act

Consumers’ rights under the DPDPA are fairly standard compared to other comprehensive privacy laws in the U.S.

## DPDPA Consumer Rights

### Right to access

Confirmation of whether the controller is processing the consumer’s personal data, and access to that data, with exceptions (from January 1, 2027, this includes inferences about the consumer and whether their data is used for profiling in decisions with legal or similarly significant effects)

### Right to disclosure

A list of the categories of third parties to which the controller has disclosed the consumer’s personal data (from January 1, 2027, a list of the third parties themselves, with exceptions for pseudonymous data, lists that cannot be compiled with reasonable effort, and trade secrets)

### Right to correction

Any inaccurate or outdated information the controller has that was provided by the consumer

### Right to delete

Any personal data the controller has about or from the consumer (with some exceptions)

### Right to portability

Obtain a copy of the consumer’s personal data that the consumer previously provided to the controller, in a readily usable format, with some exceptions

### Right to nondiscrimination

Controllers cannot unlawfully discriminate against consumers, including for exercising their rights

### Right to opt out

Of sale of personal data, targeted advertising, or profiling “in furtherance of solely automated decisions that produce legal or similarly significant effects” concerning the consumer

Consumers can designate an authorized agent to opt out of personal data processing for them. This is particularly relevant as the DPDPA requires controllers to recognize universal opt-out signals, a requirement that has applied since January 1, 2026.

## Do you know what your site is tracking?

Scan your site for free and see the active cookies, trackers, and scripts. Get your customized report in minutes with your compliance risk level, and start closing gaps.

### Coverage for Children and Teens Under the DPDPA

Parents or legal guardians of children can exercise the rights of children, whose data is considered sensitive by default. Because of this designation, consent is required before children’s data can be collected or used. Like a number of the other U.S. data privacy laws, Delaware’s law defers to the federal [Children’s Online Privacy Protection Act (COPPA)](https://usercentrics.com/us/knowledge-hub/childrens-online-privacy-protection-act-coppa/) regarding rights, responsibilities and protections for children and their data online, including for the definition of a child, which is a person under the age of 13.

The DPDPA also protects teenagers. A controller may not process a consumer’s personal data for targeted advertising, or sell it, without the consumer’s consent where the controller has actual knowledge, or willfully disregards, that the consumer is at least 13 but younger than 18.

### Consumer Requests Under the DPDPA

Consumers can make one free request to a controller to exercise their rights, e.g. getting a copy of their data, every 12 months. A controller can deny requests from a consumer that are “manifestly unfounded, excessive or repetitive”. Reasonable reasons to deny a request could also include if the consumer’s identity cannot reasonably be verified, or if too many requests are received in a 12-month period.

The controller may charge the consumer a reasonable fee to cover the administrative costs of complying with such a request if it’s “manifestly unfounded, excessive or repetitive”. However, in such an instance, the controller is responsible for demonstrating that it is.

An organization has 45 days to respond and should respond without “undue delay.” It may extend that period by another 45 days if reasonably necessary.

### Private Right of Action Under the DPDPA

The DPDPA does not include a private right of action, so consumers cannot sue controllers for violations of the law. Enforcement falls solely to the Delaware Department of Justice. By comparison, California’s CCPA provides a limited private right of action that applies only to certain data breaches.

## What Changes Under Delaware HB 380 on January 1, 2027?

Governor Matt Meyer signed House Bill 380 on September 2, 2026, and its amendments to the DPDPA take effect on January 1, 2027. Businesses have a limited time frame to review their data practices, contracts, and consumer-facing mechanisms against the new requirements. House Bill 381, signed the same day, separately amends Delaware’s data breach notification law.

ASPECTCURRENT REQUIREMENTFROM JANUARY 1, 2027ApplicabilityAt least 35,000 consumersAt least 10,000 consumersApplicability (Data Sales)At least 10,000 consumers and more than 20 percent of gross revenue from selling personal dataAt least 5,000 consumers and more than 20 percent of gross revenue from selling personal dataThird PartiesNot directly coveredThird parties that acquire personal data from a controller are covered, with no consumer thresholdFinancial InstitutionsEntity-level exemption for GLBA-regulated institutions and affiliatesEntity-level exemption narrows to certain banks, credit unions, insurers, securities professionals, and their affiliatesSensitive DataConsent required to processConsent required, and processing must be reasonably necessary and proportionate; the definition adds neural data, financial account and government ID data, health treatment or status, and inferencesSale of Sensitive DataConsent required to process sensitive dataAllowed only if strictly necessary to provide a requested product or service, with clear advance notice, consent, and a consent record kept for five yearsThird-Party ContractsContracts required with processorsContracts and reasonable due diligence also required for third parties that receive personal dataOpt-Out LinkTargeted advertising and saleTargeted advertising, sale, and profiling, on websites and in applicationsProfilingOpt-out limited to “solely” automated decisions“Solely” removed; impact assessments required for profiling in automated decisionsData Protection AssessmentsControllers processing data of at least 100,000 consumersControllers processing data of at least 50,000 consumersEmployment dataExemptExemption does not cover personal data processed for profiling and “reports” used in decisions with legal or similarly significant effects on Delaware residents

## Key Requirements for Controllers Under the DPDPA

The DPDPA is similar to other U.S. privacy laws in its requirements for notices, data access, use, and security. Because its thresholds are lower than those of many comparable laws, it is likely to apply to more businesses, and the HB 380 amendments extend its reach further from January 1, 2027.

The law also sets responsibilities for processors, including following controllers’ instructions, helping controllers respond to consumer requests such as access requests, and supporting safeguards for the personal data they handle.

Controllers carry most of the DPDPA’s obligations, from how they inform consumers to how they handle sensitive data, contracts, and assessments. The requirements below follow the order in which a consumer typically encounters them, beginning with the notice a controller must provide.

Controllers must provide one or more secure and reliable ways for consumers to submit requests or appeal decisions, taking into account how consumers normally interact with the controller and the need to verify the consumer’s identity. A controller may not require a consumer to create a new account to exercise their rights.

### Notifications Defined by the DPDPA

Controllers must provide a privacy notice that is “accessible, clear, and meaningful”, and describes the organization’s data processing activities, including information about the data collected, processing purposes, parties data is shared with, and ways to exercise consumer rights. Companies’ contact method must be secure, reliable, and easy for consumers to use to make requests or appeal controllers’ decisions, and be able to verify their identities as needed.

### Purpose Limitation Defined by the DPDPA

Controllers can process personal data for the purposes they have communicated, as long as the collection is “adequate, relevant, and reasonably necessary in relation to the purposes for which such data is processed, as disclosed to the consumer.” From January 1, 2027, HB 380 requires processing, not only collection, to be reasonably necessary and proportionate to the disclosed purposes. If the purposes for processing change, the controller must provide new notice and, where relevant, obtain new consumer consent.

### Data Security Defined by the DPDPA

Controllers must establish and maintain reasonable administrative, technical, and physical data security practices for personal data under their control, including deidentified data, and *“protect the confidentiality, integrity, and accessibility of personal data appropriate to the volume and nature of the personal data at issue”*. Processors working with/for controllers are also responsible for safeguarding personal data they have access to, and obligations should be established contractually prior to processing.

### Data Protection Assessments (DPA) Defined by the DPDPA

Controllers that control or process the personal data of at least 100,000 consumers, excluding data processed solely to complete a payment transaction, must conduct and document data protection assessments, also known as data protection impact assessments, for “processing activities that present a heightened risk of harm to a consumer.” Such activities include:

- Processing for the purposes of targeted advertising
- Processing sensitive data
- Sale of personal data
- Processing for the purposes of profiling if there is a reasonably foreseeable or heightened risk of harm to consumers

From January 1, 2027, HB 380 lowers this threshold to 50,000 consumers. Those controllers must also conduct and document an impact assessment if they engage in profiling in furtherance of automated decisions that produce legal or similarly significant effects.

The assessment must cover the purpose and intended uses of the profiling, any known or reasonably foreseeable risks of harm and the steps taken to mitigate them, the categories of personal data used, performance metrics and known limitations, transparency measures, and post-deployment monitoring.

The Attorney General can require a data controller to conduct or disclose a DPA and share the results of one in the course of an investigation. The AG can also evaluate a data protection assessment to determine whether it meets the law’s requirements.

### Consent Requirements Defined by the DPDPA

In many circumstances, consumer consent is not required before personal data is collected or processed. Consent is required before processing sensitive data or children’s data, for example, before processing for targeted advertising or selling the data of consumers ages 13 to 17, or when the organization’s processing purposes change.

Controllers must provide clear notice of what data is collected and processed, the purposes, who it is shared with, and consumers’ rights and how to exercise them, so that consumers are reasonably informed and can make requests or opt out of processing.

In addition to providing information about how consumers can opt out, controllers must provide information so consumers know that they can change or revoke previous consent later. Revoking consent must be as easy as giving it. After a consumer revokes consent, the controller must stop processing the data as soon as practicable and no later than 15 days after receiving the request.

### Nondiscrimination Defined by the DPDPA

Like other U.S. privacy laws, Delaware’s regulation prohibits discrimination against consumers, including discrimination for exercising their rights under the law. For example, if a consumer opts out of data processing on a website, that individual cannot be blocked from accessing the site or its functions. There are, however, some web or app features and functions that will not work without certain cookies or trackers being activated, so if a consumer opts out and they no longer work optimally, this is not discriminatory.

Processing personal data is also prohibited if doing so would violate other state or federal laws governing discrimination.

Controllers can offer voluntary incentives to consumers for their participation in activities that collect personal data, e.g. newsletter signups, surveys, or loyalty programs. Such offers must be reasonable and proportionate to the request and type and amount of data collected so, though, as not to look like payments for consent, which data protection authorities frown upon. Consumers who decline such offers also cannot be discriminated against, e.g. by not having access to comparable offers or being charged a different price for goods or services.

### Processor and Third-Party Contracts Under the DPDPA

Processors need to assist controllers in meeting their obligations under the law, which include restricting processes to publicized purposes, safeguarding personal data, and providing information enabling data protection assessments.

There needs to be a contract in place between the controller and processor prior to data collection. Such contracts are binding on both sides and need to include:

- Duty of confidentiality
- Clear instructions for processing data, including:
    - Nature and purpose of the processing
    - Type of data that is subject to processing
    - Duration of the processing
- Rights and obligations of both parties
- The processor must delete or return the personal data to the controller at the controller’s direction or at the end of the provision of services, unless there are superseding legal requirements for the processor
- The processor must provide the controller (upon request) all information needed to verify that the processor has complied with all of their contractual obligations to the controller
- If the processor engages any subcontractors, it must have contracts in place so that they meet the processor’s obligations under the law

From January 1, 2027, HB 380 adds contract and due diligence requirements for third parties, meaning recipients that are neither processors nor affiliates, to which a controller discloses personal data, including in a sale or for targeted advertising. The contract must:

- Limit the disclosure to specified purposes, including whether they involve decisions that produce legal or similarly significant effects
- Require the third party to comply with the DPDPA and provide the same level of privacy protection
- Allow the controller to take reasonable and appropriate steps to confirm the third party uses the data consistently with the controller’s obligations
- Require the third party to notify the controller if it can no longer meet its obligations
- Allow the controller, on notice, to take reasonable and appropriate steps to stop and remediate unauthorized use

Controllers must also conduct reasonable due diligence of these third parties, which at a minimum includes questionnaires and a review of relevant documents. A third party that receives personal data without a contract meeting these requirements may not process it further.

### Universal Opt-Out Mechanism

Not all U.S. state privacy laws require recognition of a universal opt-out mechanism, also called a global opt-out signal, such as [Global Privacy Control (GPC)](https://usercentrics.com/us/global-privacy-control/) but the requirement has become more common in recent laws. The DPDPA includes this requirement, and organizations have been required to recognize universal opt-out mechanisms since January 1, 2026, one year after the law took effect.

This mechanism enables consumers to set and communicate their preferences with regards to the processing of their personal data once, e.g. in their web browser, and then they’re communicated to all websites or other platforms or services that the consumer uses that can detect the signal.

## What Happens If You Violate the Delaware Personal Data Privacy Act?

Enforcement of the DPDPA is centralized, as in most other U.S. states, and operates through Delaware’s existing consumer protection laws.

### Enforcement Authority

The Delaware Department of Justice, led by the Attorney General, has sole authority to enforce the DPDPA.

Consumer complaints about controllers’ data processing or denial of consumer requests can be submitted to the Attorney General, which will notify an organization of any complaint and if an investigation is launched. The Attorney General can require data protection assessments and other information from controllers in the course of an investigation, and can evaluate whether those assessments meet the law’s requirements.

### Consumer Complaints Under the DPDPA

Controllers have to provide information and a process to consumers not only to exercise their rights, but to lodge an appeal if the controller refuses to take action on a request, either within a reasonable amount of time or at all. This appeal process must be similar to the process to make a request and just as easy to do.

If a consumer submits an appeal, the controller has 60 days from receiving it to reply to the consumer about any action taken, including written explanation of reasons for the decision. Controllers also have to provide consumers with an online mechanism, if possible, or another way to contact the Department of Justice to submit a further complaint if the controller does not resolve issues with the consumer.

The DOJ can decide to issue a notice of violation to a controller, e.g. resulting from a complaint. As previously noted, consumers do not have private right of action under the DPDPA.

### Cure Period Under the DPDPA

Through December 31, 2025, if the Department of Justice determined that a violation had occurred and could be cured, it notified the controller and provided 60 days to fix the issue and prevent it from recurring.

If the controller failed to cure the violation within 60 days, the DOJ could initiate enforcement proceedings. Since January 1, 2026, the DOJ has discretion over whether to offer a cure period at all, and it may consider the following factors in making that decision:

- Number of violations
- Size and complexity of the controller or processor
- Nature and extent of the controller’s or processor’s processing activities
- Substantial likelihood of injury to the public
- Safety of persons or property
- Whether such alleged violation was likely caused by human or technical error
- Extent to which the controller or processor has violated this or similar laws in the past

The mandatory cure period ended on December 31, 2025. The DOJ can still offer a cure period, but doing so is now at its discretion.

### Fines and Penalties

The DPDPA does not set its own fine amounts. Instead, it provides that a violation is an unlawful practice under Delaware’s consumer protection laws ([Subchapter II of Chapter 25 of Title 6](https://delcode.delaware.gov/title29/c025/sc02/index.html)), which the Department of Justice enforces. A court can order a violator found to have willfully violated those laws to pay a civil penalty of up to USD 10,000 per violation.

## The Delaware Personal Data Privacy Act and Consent Management

Delaware’s law is based on an opt-out model, so consent is not required before collecting or processing personal data in many circumstances, unlike the opt-in consent that applies to non-essential cookies under EU rules, for example. Consent is required for sensitive data, children’s data, and targeted advertising or sales involving consumers ages 13 to 17.

Consumers do have to be informed about data collection and use, parties with access, and what their rights are and how to exercise them. This information and a comprehensive privacy notice need to be clear and easily accessible, e.g. on the organization’s website.

Consumers must be able to opt out of the processing of their data and to change or revoke previous consent preferences. A consent management platform (CMP), such as [Usercentrics Web CMP](https://usercentrics.com/website-consent-management/) or [Usercentrics App CMP](https://usercentrics.com/in-app-sdk/) support this.

Since January 1, 2026, organizations must also recognize consumers’ opt-out choices expressed through a universal opt-out signal, such as Global Privacy Control.

A CMP can help present information about the categories of data and specific services in use by the controller, its processors, and third parties with whom data is shared. The DPDPA requires controllers to describe these categories clearly in their privacy notice.

The United States still has a patchwork of state privacy laws rather than a single comprehensive federal law, so companies doing business across the country, and foreign organizations doing business in the U.S., may need to meet the requirements of multiple state laws.

> **Learn more:** [Comparing U.S. state-level data privacy laws](https://usercentrics.com/knowledge-hub/comparison-guide-to-us-state-level-data-privacy-laws/)

A CMP can help by enabling banner customization and geotargeting, so that information and choices for specific regulations can be presented based on a visitor’s location. Geotargeting can also improve clarity by presenting this information in the visitor’s preferred language.

## Preparing for the Delaware Personal Data Privacy Act

Organizations doing business in Delaware have been subject to the DPDPA since January 1, 2025, and have been required to recognize universal opt-out signals since January 1, 2026. They should now review their practices ahead of the HB 380 amendments, which take effect on January 1, 2027.

Priorities include checking whether the lower thresholds bring the organization within scope, reviewing contracts and due diligence for third parties that receive personal data, and updating how sensitive data, profiling, and opt-out links are handled.

Companies that already meet the requirements of other state laws, such as California’s CCPA/CPRA, have likely completed much of the work needed to meet the DPDPA’s requirements, though each state’s law has its own provisions. Organizations should confirm the specific requirements of each state’s law and consult qualified legal counsel, their data protection officer (DPO), or a privacy expert.

Protecting customer privacy proactively can build trust and strengthen customer relationships over time. Clear, respectful consent experiences can also support higher-quality first-party data for audience building and measurement.

## Handle DPDPA requirements today and as the law changes

Usercentrics supports opt-out workflows, notice and disclosures, consent documentation, and geotargeted configurations for Delaware, other U.S. state privacy laws, and globally. Try it free for 14 days.

*Usercentrics does not provide legal advice, and information is provided for educational purposes only. We always recommend engaging qualified legal counsel or privacy specialists regarding data privacy and protection issues and operations.*

---

## Footer

### Products
- [Usercentrics Web CMP](https://usercentrics.com/us/website-consent-management/)
- [Usercentrics App CMP](https://usercentrics.com/us/in-app-sdk/)
- [Usercentrics CTV CMP](https://usercentrics.com/us/usercentrics-ctv-cmp/)
- [Usercentrics Privacy Policy Generator](https://usercentrics.com/us/privacy-policy-generator/)
- [Server Google Tag Manager (sGTM)](https://usercentrics.com/us/server-side-tracking-solution/)
- [Meta signals gateway](https://usercentrics.com/us/meta-signals-gateway/)
- [MCP Manager by Usercentrics](https://usercentrics.com/us/ai-model-context-protocol-manager/)
- [Web compliance scan](https://usercentrics.com/us/privacy-compliance-scanner/)
- [App compliance scan](https://usercentrics.com/us/app-data-privacy-audit/)
- [CMS Integrations](https://usercentrics.com/us/integrations/)

### Solutions
- [Data Privacy Regulatory Compliance](https://usercentrics.com/us/data-privacy-regulatory-compliance/)
- [Marketing Performance Optimization](https://usercentrics.com/us/marketing-performance-optimization/)
- [Migration](https://usercentrics.com/us/migration/)
- [Ad monetization](https://usercentrics.com/us/ad-monetization/)
- [First-Party Data Collection](https://usercentrics.com/us/server-side-tracking/)
- [Media & Publishing](https://usercentrics.com/us/media-publishing/)
- [Retail & Ecommerce](https://usercentrics.com/us/retail-ecommerce/)
- [Banking, Finance & Insurance](https://usercentrics.com/us/banking-finance-insurance/)
- [Healthcare & Pharmaceuticals](https://usercentrics.com/us/healthcare-pharmaceuticals/)
- [Gaming](https://usercentrics.com/us/gaming/)
- [Education](https://usercentrics.com/us/education/)
- [Automotive](https://usercentrics.com/us/automotive/)
- [Travel & Hospitality](https://usercentrics.com/us/travel/)

### Regulations
- [CCPA (California)](https://usercentrics.com/us/ccpa/)
- [GDPR (EU)](https://usercentrics.com/us/gdpr/)
- [CPRA (California)](https://usercentrics.com/us/cpra)
- [CPA (Colorado)](https://usercentrics.com/us/cpa/)
- [DMA (EU)](https://usercentrics.com/us/digital-markets-act-dma/)
- [PIPEDA (Canada)](https://usercentrics.com/us/pipeda/)
- [MTCDPA (Montana)](https://usercentrics.com/us/mtcdpa/)
- [TDPSA (Texas)](https://usercentrics.com/us/tdpsa/)
- [TCF v2.4 (IAB)](https://usercentrics.com/us/cmp-for-publishers/)
- [Google Consent Mode (EU)](https://usercentrics.com/us/usercentrics-cmp-and-google-consent-mode-v2/)
- [Microsoft UET Consent Mode (EU)](https://usercentrics.com/us/usercentrics-cmp-and-microsoft-consent-mode/)
- [View all regulations](https://usercentrics.com/us/regulations-and-frameworks/)

### Resources
- [Blog](https://usercentrics.com/us/knowledge-hub/)
- [Guides](https://usercentrics.com/us/guides/)
- [Checklists](https://usercentrics.com/us/checklists/)
- [Whitepapers](https://usercentrics.com/us/whitepapers/)
- [Case studies](https://usercentrics.com/us/customer-stories/)
- [Magazine](https://usercentrics.com/magazine/)
- [Events](https://usercentrics.com/us/webinar/)
- [TV Show](https://usercentrics.com/privacy-led-marketing-show/)
- [State of Digital Trust 2026](https://usercentrics.com/us/resources/state-of-digital-trust-report-2026/)
- [Privacy-Led Marketing](https://usercentrics.com/us/privacy-led-marketing/)
- [Courses](https://courses.usercentrics.com)
- [RFI template](https://usercentrics.com/us/resources/usercentrics-rfi-template/)
- [ROAS calculator](https://usercentrics.com/us/roas-calculator/)
- [Ad revenue calculator](https://usercentrics.com/us/ad-revenue-loss-calculator/)
- [Developer documentation](https://usercentrics.com/docs/)
- [Release notes](https://releases.usercentrics.com/en)
- [Support](https://support.usercentrics.com/hc/en-us)
- [All resources](https://usercentrics.com/us/resources/)

### Company
- [About us](https://usercentrics.com/us/about-us/)
- [Press](https://usercentrics.com/us/press/)
- [Our offices](https://usercentrics.com/us/contact/)
- [Careers](https://usercentrics.com/us/career/)
- [Diversity and inclusion](https://usercentrics.com/us/dei/)
- [Trust center](https://trust.usercentrics.com/)
- [Open positions](https://apply.workable.com/usercentrics/)

### Support
- [General support](https://support.usercentrics.com/hc/en-us)
- [Contact sales](https://usercentrics.com/us/book-a-consultation/)
- [Technical support](https://support.usercentrics.com/hc/en-us/requests/new)
- [Suggest a feature](https://support.usercentrics.com/hc/en-us/requests/new?ticket_form_id=10610312381340)
- [Billing and account](https://support.usercentrics.com/hc/en-us/categories/12253804608156-Account-and-billing)
- [Partner login](https://partnerportal.usercentrics.com/)
- [Partner program](https://usercentrics.com/us/partner-program-overview/)
- [Affiliate program](https://usercentrics.com/us/affiliates/)