Delaware Personal Data Privacy Act (DPPA)

Overview

The Delaware Personal Data Privacy Act (DPPA), codified as Title 6, Chapter 12D of the Delaware Code (6 Del. C. §§12D-101 through 12D-111), was signed into law by Governor John Carney on September 11, 2023 (HB 154). The DPPA became effective on January 1, 2025. Delaware is notable for having the lowest applicability threshold of any comprehensive US state privacy law — requiring only that a controller process the personal data of 35,000 Delaware consumers (with no revenue-from-sale threshold) — making it the broadest in scope of the state privacy laws enacted through 2023.

Key distinguishing features of the DPPA:

• Lowest consumer threshold: 35,000 consumers (no revenue alternative needed)
• No cure period: Unlike many states, the DPPA provides no mandatory cure period; the AG has discretion
• Broad sensitive data definition: Includes immigration/citizenship status
• Universal opt-out recognition: Required from January 1, 2026
• Minor protections: Heightened requirements for known child data processing (under 18)
• Targeted advertising consent for minors: Explicit opt-in required for consumers known to be 13-17

Applicability (§12D-103)

The DPPA applies to persons that conduct business in Delaware or produce products or services targeted to Delaware residents AND during the preceding calendar year either: