Instruments
Each one links to its
LexLint note, which carries what it requires and what it flags on.
Adult content age verification (AV)
Would have required a commercial entity that knowingly publishes material harmful to minors online to verify a visitor's age using a government issued ID or comparable method, with civil penalties and liability for a minor's access. Cleared the Delaware House in June 2024 but died in the Senate Executive Committee (last action June 18, 2024) when the 152nd General Assembly adjourned.
Note and primary source →
Breach notification
Notice of a breach of security must be made without unreasonable delay and no later than 60 days after determination of the breach, except in specified situations. If the number of affected Delaware residents exceeds 500, the person required to provide notice must also notify the Attorney General by the time notice is provided to residents.
This provision is in force under the current codified text; the underlying research did not establish a dated original commencement, so no effective_date is recorded here.
What it asks of an app →
Comprehensive regime
DPDPA governs private-sector processing of Delaware consumers' personal data. It is codified at Del. Code Ann. tit. 6, ch. 12D, correcting a chapter-number error carried in a prior corpus record, which cited the DPDPA against Chapter 12C, a different Delaware statute. Enacted as H.B. 154, 152nd General Assembly, effective January 1, 2025. Controller duties are allocated at sections 12D-104 through 12D-108 and processor duties at section 12D-109.
H.B. 380 (153rd General Assembly), which would extend the Act to employee, applicant, and contractor data used in consequential employment decisions and lower applicability thresholds, passed the General Assembly on June 16, 2026 but its gubernatorial signature status was unconfirmed as of this document's as_of_date; it is not recorded as its own instrument pending that confirmation.
What it asks of an app →
Data subject rights
DPDPA gives a Delaware consumer the right to confirm processing, access, correct, delete, obtain a portable copy, and opt out of targeted advertising, sale, and profiling in furtherance of solely-automated decisions with legal or similarly significant effects. A controller must respond without undue delay and no later than 45 days after receipt, with one 45-day extension available.
What it asks of an app →
Enforcement supervision
The Delaware Department of Justice has authority to enforce DPDPA; a violation is deemed an unlawful practice under the Delaware Consumer Fraud Act, Del. Code tit. 6, section 2513, and is enforced solely by the Department of Justice. A cure notice was mandatory through December 31, 2025; from January 1, 2026 the Department may consider listed factors in deciding whether to offer a cure. The chapter creates no private right of action.
What it asks of an app →
Sensitive categories
DPDPA classifies data revealing racial or ethnic origin, religious beliefs, mental or physical health condition or diagnosis (including pregnancy), sex life, sexual orientation, transgender or nonbinary status, citizenship or immigration status, genetic or biometric data, a known child's data, and precise geolocation data as sensitive data.
'Biometric data' means data from automatic measurement of biological characteristics used to identify a person, such as a fingerprint or voiceprint, and the raw recording is excluded, but data generated from it is covered once generated to identify a specific individual, matching the Connecticut, Oregon, Montana, and Nebraska structure.
What it asks of an app →
Social media and minors
Requires a business to obtain verifiable parental consent before processing the personal data of a known child under 13, and the teen's own consent for a consumer age 13 to 17, before using that data for targeted advertising, sale, or certain profiling.
Note and primary source →
