Consumer Data Privacy
Delaware Consumer Data Privacy Law: Thresholds, Consumer Rights & Deadlines
What Delaware’s consumer data privacy law requires, maintained by Stauss PLLC. Last reviewed July 2026.
What You Need to Know
The law is one of the more consumer-friendly laws passed to date. It applies to entities that process the personal data of 35,000 consumers. The law also applies to nonprofits, with a couple of exceptions. There is no HIPAA-covered entity exemption, but there are data-level health data exemptions. The law adds the right to obtain a list of categories of third parties to which the controller has disclosed the consumer's personal data. The law requires opt-in consent for targeted advertising or sale of personal data of minors under 18.
Official law text
Who the law applies to
| Threshold | Requirement |
|---|---|
| Effective until December 31, 2026 | |
| Annual gross revenue | N/A |
| Consumers whose data is processed | 35,000 consumers 3.33% of state's 1.05 million population |
| Revenue from sale of personal data | Derives more than 20% of gross revenue from sale of personal data and controls or processes personal data of not less than 10,000 consumers. |
| Effective January 1, 2027 | |
| Annual gross revenue | N/A |
| Consumers whose data is processed | 10,000 consumers 0.95% of state’s 1.05 million population |
| Revenue from sale of personal data | Derives more than 20% of gross revenue from sale of personal data and controls or processes personal data of not less than 5,000 consumers. |
| Other conditions |
|
Consumer rights under Delaware's law15
| Right | Provided? |
|---|---|
| Know | Yes |
| Access | Yes |
Obtain list of third parties to which personal data was disclosednoteConsumers can obtain a list of third parties to which the controller has disclosed the consumer’s personal data unless any of the following apply: a. The disclosed personal data is pseudonymous data. b. The controller cannot compile such a list with reasonable effort, in which case the controller must disclose all third parties to which the controller discloses personal data. c. The listing of a third party would reveal a trade secret. | Partial |
| Data portability | Yes |
| Delete | Yes |
| Correct inaccuracies | Yes |
| Not be discriminated against for exercising rights | Yes |
| Opt-out of sale | Yes |
| Opt-out of targeted advertising/sharing | Yes |
| Opt-out of certain types of profiling | Yes |
| Opt-out of ADMT | No |
| Recognize opt-out signals | Yes |
| Revoke consent | Yes |
| Not process data in discriminatory manner | No |
| Appeal | Yes |
Categories treated as sensitive data17
- Racial or ethnic origin
- National origin
- Religious beliefs
- Mental or physical health diagnosis
- Mental or physical health condition
- Mental or physical health treatment
- Mental or physical health status (including pregnancy)
- Sexual orientation
- Sex life
- Status as transgender or nonbinary
note
Includes treatment or status as transgender or nonbinary. - Citizenship or immigration status
- Genetic or biometric data
note
Delaware, Maryland, and Oregon's definitions of sensitive data do not state that biometric data must be used to identify individuals. However, this requirement is found in each law's definition of biometric data. - Personal data of known child
- Precise geolocation
note
Connecticut, Maryland, Oregon, and Virginia ban the sale of precise geolocation data. - Government-issued identification #, including, but not limited to, Social Security #, passport #, state identification card # or driver's license #, that applicable law does not require to be publicly displayed
- Financial account number, financial account log-in information or credit card or debit card number that, in combination with any required access or security code, password or credential, would allow access to a consumer's financial account
- Neural data
How sensitive data must be treated3
- Obtain Consent to Process and Processing is Reasonably Necessary and Proportionate to Disclosed Purposes for Processing Sensitive Data
- Cannot Sell Sensitive Data Unless Specific Conditions are Met
note
Delaware prohibits the sale of sensitive data unless all of the following apply: (a) the disclosure of sensitive data is strictly necessary to provide or maintain a product or service affirmatively requested by the consumer to whom the sensitive data pertains; (b) the controller provides a clear and conspicuous notice of the sale of personal data before the sale of personal data, which must include the specific categories of sensitive data to be disclosed, the purpose of the disclosure, and identifies the third parties to which sensitive data will be disclosed; (c) the controller obtains the consumer's consent; (d) the controller maintains a record of the consumer's consent for a period of 5 years; (e) the record of consent of Delaware consumers is provided with any data protection assessment produced upon request by the attorney general. - Conduct Data Protection or Risk Assessment
Requirements for minors' data2
- Process personal data of children under 13 in accordance with COPPA or parental/legal guardian consent
- Opt-in for targeted advertising or sale of personal data of children ages 13-17
Activities that trigger a risk or impact assessment6
- Targeted advertising (“sharing”)
- Sale of personal data
- Processing of sensitive data
- Processing personal data for purposes of profiling where it presents reasonably foreseeable risk of unfair or deceptive treatment of, or unlawful disparate impact on, consumers; financial, physical, or reputational injury to consumers; physical or other intrusion upon the solitude or seclusion, or the private affairs or concerns, of consumers, where such intrusion would be offensive to a reasonable person; other subject injury to consumers
- Any processing activities involving personal data that present a heightened risk of harm to consumers
- Profiling for purposes of making a decision that produces any legal or similarly significant effect concerning a consumer
2 notes
As amended and effective January 1, 2027.Decision that produces any legal or similarly significant effect means any decision made by the controller, or on behalf of the controller, that results in the provision or denial by the controller of any financial or lending service, any housing, any insurance, any education enrollment or opportunity, any criminal justice, any employment or any health care service.
Other notable provisions8
- Definition of “Sale” Includes “Other Valuable Consideration”
- Applies to Nonprofits
- Data Processing Agreements
- Privacy Policy
- Implement Reasonable Data Security Measures
- Duty to Avoid Secondary Use
- Data Minimization
- Attorney General Enforcement
Key dates2
| Date | What happens |
|---|---|
| January 1, 2025 | Delaware's consumer data privacy law takes effect |
| January 1, 2027 | Delaware's amended thresholds take effect — dropping to 10,000 consumers (or a 20%-revenue/5,000-consumer sale-based test) |
Questions about Delaware’s privacy law?
Stauss PLLC advises companies on state privacy, AI, and data broker compliance.
Contact Stauss PLLCThis page is provided for general informational purposes only, is not legal advice, and does not create an attorney-client relationship. State laws change frequently; coverage reflects this tool’s most recent update. Contact Stauss PLLC to confirm how these requirements apply to your organization.