Law note · Delaware
Delaware Personal Data Privacy Act (DPDPA), publicly available information exemption
What it asks of an app
- Personal data that is lawfully made available through a government record or that a consumer has lawfully made available to the public through widely distributed media falls outside the DPDPA's definition of personal data, so scraping it does not by itself trigger the Act's duties.
- Delaware's applicability thresholds (35,000 consumers, or 10,000 with 20% of revenue from data sales) are lower than several peer states, so check them separately rather than assuming a threshold that clears elsewhere clears here too.
- Cite the Delaware Personal Data Privacy Act at Title 6, Chapter 12D, never Chapter 12C, which is a different, older website-privacy-policy law.
When LexLint raises it
crawls_webtrains_modelsprocesses_biometrics
What we found
Section 12D-102(21) defines personal data to mean information linked or reasonably linkable to an identified or identifiable individual and expressly excludes de-identified data or publicly available information.
Publicly available information is defined at section 12D-102(28) as information lawfully made available through federal, state, or local government records, or information a controller has a reasonable basis to believe the consumer has lawfully made available to the general public through widely distributed media.
As in Connecticut, the exclusion operates on the definition of personal data itself, so scraped government-record or public-media personal data is outside the DPDPA's scope by definition rather than by a carve-out from an otherwise-applicable duty.
The Act's applicability threshold is notably lower than several peer states: section 12D-103(a) applies the chapter to persons conducting business in Delaware or targeting Delaware residents who, in the preceding calendar year, controlled or processed the personal data of 35,000 or more consumers (excluding payment-transaction data), or 10,000 or more consumers while deriving more than 20% of gross revenue from personal-data sales.
A derived candidate in this corpus cites the DPDPA at Title 6, Chapter 12C; reading both chapters directly at delcode.delaware.gov confirms Chapter 12C is instead the Delaware Online and Personal Privacy Protection Act (website privacy policies and children's book-service-provider disclosures), while Chapter 12D's own text at section 12D-101 states this chapter shall be known and may be cited as the Delaware Personal Data Privacy Act; the correct citation is Chapter 12D and is used here.
DPDPA's general applicability and controller and processor duties took effect January 1, 2025, the same date the chapter's enforcement notice-and-cure window began running.