Delaware Personal Data Privacy Act (DPDPA) Reference Guide

Through December 31, 2026, the DPDPA generally reaches persons doing business in Delaware or offering products or services targeted to its residents who, in the preceding calendar year, processed data of at least 35,000 consumers, excluding data used solely to complete payment transactions. It also reaches those processing data of at least 10,000 consumers while earning more than 20% of gross revenue from personal-data sales. These are alternatives; Delaware incorporation alone is not the test. Delaware Code: Title 6, Chapter 12D

A consumer is a Delaware resident acting in a personal or household context; the definition excludes the specified employment and commercial roles. The DOJ says both for-profit and nonprofit organizations can be covered. Certain government bodies, specified financial institutions, a narrow class of nonprofits, and defined categories of data are excluded. Exemptions should be assessed against the statute and the actual data flow. Delaware Code: Title 6, Chapter 12D Delaware DOJ: business guidance

Starting January 1, 2027, HB 380 lowers the primary threshold to 10,000 consumers and the alternative to 5,000 consumers plus more than 20% of gross revenue from sales of personal data. It also adds a separate third-party acquisition provision and revises some financial-sector exemptions. These rules are not yet effective as of this review. Delaware Code: Title 6, Chapter 12D Delaware General Assembly: HB 380

A website with a small Delaware audience should assess both current coverage and its 2027 position. Technical testing can examine the website’s opt-out path, but it cannot determine whether the organization meets either threshold.

Residents may confirm processing, access, correct, delete, and obtain a portable copy of covered data. Today they can request the categories of third parties to which their data was disclosed, and opt out of sales, targeted advertising, and qualifying solely automated profiling. From January 2027, the amended third-party right generally extends to a list of specific third parties, subject to stated exceptions. Delaware Code: Title 6, Chapter 12D

Controllers ordinarily respond within 45 days; a qualifying extension of up to 45 more days requires notice in the initial period. Denied requests must have an appeal process. The DPDPA requires an accessible privacy notice and a clear web opt-out link for targeted advertising and sales. The legal team owns rights handling and notices; the site team owns the functioning controls. Delaware Code: Title 6, Chapter 12D Delaware DOJ: DPDPA FAQs

Delaware defines personal data broadly as information linked or reasonably linkable to an identifiable person. A sale includes exchange for money or other valuable consideration, with statutory exceptions. Targeted advertising concerns ads selected from behavior across unaffiliated sites or apps over time. Contextual advertising and processing solely to measure advertising frequency, performance, or reach are excluded from that definition. These distinctions require a data-use analysis; vendor names alone are insufficient. Delaware Code: Title 6, Chapter 12D

Ad pixels, embedded widgets, direct scripts, and tag-manager rules can keep transmitting identifiers after a visitor rejects optional tracking. A consent interface does not prove the recipient stopped receiving information. Inventory each script and endpoint, then verify the post-choice network and cookie behavior.

Since January 1, 2026, covered controllers must allow opt-outs of sale and targeted advertising through a qualifying user-selected preference signal. The statutory criteria include an affirmative choice and a mechanism that lets the controller reasonably determine Delaware residency and the legitimacy of the request. A supported GPC signal can be an implementation path; the legal and technical teams should check that the received signal meets the statutory conditions. Delaware Code: Title 6, Chapter 12D Delaware DOJ: DPDPA FAQs

The statute says a qualifying opt-out signal takes precedence if it conflicts with a site-specific setting or loyalty program, although the controller may notify the visitor of the conflict and offer a choice to confirm that setting. A signal does not by itself resolve access, deletion, or separate consent questions. Delaware Code: Title 6, Chapter 12D

The Delaware Department of Justice exclusively enforces the DPDPA. DOJ guidance describes penalties of up to $10,000 per violation and says the statute does not create a private cause of action. The mandatory 60-day cure notice for violations the DOJ considered curable applied through December 31, 2025. Since January 1, 2026, DOJ considers statutory factors when deciding whether to offer a chance to cure; one is not guaranteed. Delaware Code: Title 6, Chapter 12D Delaware DOJ: DPDPA FAQs

HB 380, signed September 2, 2026, becomes effective January 1, 2027. It lowers coverage and assessment thresholds, adds duties concerning third-party transfers and diligence, and changes some rights and duties. The public page is a preparation guide for those future rules; its in-force scanning claims refer to today’s opt-out duties. Delaware Code: Title 6, Chapter 12D Delaware General Assembly: HB 380

The privacy team decides which Delaware duties apply to each data flow. The engineering team implements the resulting choices across every tag and vendor. A shared data inventory lets both teams examine the same evidence.

Use separate browser sessions to compare the site’s initial behavior, its response to a direct opt-out, and its response to Global Privacy Control where relevant to your review. Record the page URL, test time, browser settings and exact choice made so the result can be reproduced.

Inspect cookies and network requests before and after each choice. Record which requests continue, their destinations and the controls involved. Browser evidence can help diagnose an implementation; it cannot establish statutory applicability, the legal purpose of every transfer or organization-wide compliance.

Legal interpretation, applicability, exemptions, privacy notices, vendor contracts, rights-request procedures, sensitive-data obligations, and organizational governance should be handled by qualified privacy counsel.

This guide distinguishes the code provisions in effect through December 2026 from the amended provisions effective January 2027. The Delaware DOJ FAQ explains current law but may not yet reflect the newly enacted HB 380 changes; the enacted code controls where they differ. Legal claims link to Delaware primary sources.

Prepared by Etalon Editorial Team. Last reviewed September 27, 2026. Material corrections may be sent to contact@etalondata.com.

Etalon is not a law firm and does not provide legal advice. A passing scan or certificate does not guarantee that an organization satisfies every legal obligation.

Technical testing records observable website tracking: visitor choice, browser privacy signals, cookies, scripts, tags, and network requests. Your legal and privacy team remains responsible for interpretation, applicability, exemptions, vendor relationships, notices, contracts, rights requests, assessments, security, and governance.