Delaware Data Privacy Law (DPDPA): What Delaware Residents Need to Know

Delaware's Personal Data Privacy Act (DPDPA) took effect January 1, 2025. It has one of the lowest applicability thresholds of any state privacy law — a deliberate choice given Delaware's small population. Here is what residents need to know.

What Is the Delaware Personal Data Privacy Act?

Governor John Carney signed the Delaware Personal Data Privacy Act on September 11, 2023. It became effective January 1, 2025, giving businesses roughly 15 months to comply. Delaware's law came later than most and shows it — it absorbed lessons from earlier state laws' gaps and edge cases.

The DPDPA applies to businesses that conduct business in Delaware or produce products or services targeted to Delaware residents, and during the prior calendar year either: controlled or processed personal data of at least 35,000 Delaware consumers, excluding data processed solely for completing a payment transaction; or controlled or processed personal data of at least 10,000 Delaware consumers and derived more than 20% of gross revenue from the sale of personal data.

These thresholds are calibrated to Delaware's population. With under one million residents, 35,000 consumers is roughly 3.5% of the state — proportionally similar to California's 100,000-consumer threshold against 40 million residents. The design covers a broad range of businesses processing Delaware consumer data, not just the largest national players.

Your Rights Under the DPDPA

Delaware residents have five privacy rights under the DPDPA:

Controllers must respond to authenticated consumer rights requests within 45 days, with an available extension of up to 45 additional days when reasonably necessary with proper advance notice to the consumer. Consumers may submit requests free of charge; however, businesses may charge a reasonable fee for excessive or repetitive requests. Retaliation for exercising rights is prohibited.

Delaware's Universal Opt-Out Requirement

Like California, Colorado, Connecticut, and New Jersey, Delaware's DPDPA requires covered businesses to honor universal opt-out mechanisms — including browser-based signals such as the Global Privacy Control (GPC). When a Delaware consumer uses a browser with GPC enabled, covered businesses must treat the GPC signal as a valid opt-out request for data sales and targeted advertising.

GPC lets you opt out at scale without navigating each site individually. With GPC enabled, the opt-out is automatically asserted on every covered site you visit. It is available in Firefox (Settings > Privacy and Security > Tell websites not to sell or share my data) and enabled by default in Brave.

How the DPDPA Compares to CCPA

What Data Brokers Must Do Under the DPDPA

Covered data controllers operating in Delaware must fulfill extensive obligations under the DPDPA:

• Publish a clear and accessible privacy notice that explains the categories of personal data processed, the purposes of processing, consumer rights and how to exercise them, the categories of data disclosed to third parties, and whether personal data is sold or used for targeted advertising.
• Honor universal opt-out signals (GPC and equivalents) as valid opt-out requests for data sales and targeted advertising. This requirement took effect with the law on January 1, 2025.
• Obtain consent before processing sensitive data, including data concerning racial or ethnic origin, religious beliefs, mental or physical health conditions, sexual orientation, citizenship status, biometric data, precise geolocation, and data of individuals known to be under 18 (Delaware extends sensitive data protections to minors up to age 18, broader than most state laws).
• Conduct data protection assessments for high-risk processing activities before initiating such processing. These assessments must be produced to the Delaware AG upon request.
• Process deletion requests within 45 days, including instructing processors and subprocessors to delete the same personal data. Standard exceptions apply for legal compliance, ongoing transactions, and security purposes.
• Provide a meaningful appeals process for denied consumer requests, with a required response within 60 days of the appeal.

Step-by-Step: How to Submit a DPDPA Deletion Request

1. 1. Enable Global Privacy Control in your browser. Delaware businesses must honor GPC signals. Enable it in Firefox (Settings > Privacy and Security > Tell websites not to sell or share my data) or use Brave, which enables GPC by default. This automatically asserts your opt-out rights on covered sites.
2. 2. Locate the data broker's privacy notice. Look in the site footer for "Privacy Policy," "Delaware Privacy Rights," or "Your Privacy Rights." The DPDPA requires this to be clearly accessible. Search "[company name] Delaware privacy request" if you cannot find it easily.
3. 3. Submit your deletion request. Use the company's designated mechanism. State that you are a Delaware resident exercising your rights under the Delaware Personal Data Privacy Act. Request deletion of all personal data the company holds about you and opt out of data sales and targeted advertising.
4. 4. Provide identity verification if requested. The company may request verification before processing. Respond promptly and note that companies cannot require you to create an account solely for this purpose.
5. 5. Track the 45-day window. Document your submission date and any confirmation received. If the company extends the response period, they must notify you within the initial 45-day window.
6. 6. Appeal or escalate if necessary. If your request is denied, use the appeals mechanism described in the denial notice. If the appeal fails, file a complaint with the Delaware Department of Justice at attorneygeneral.delaware.gov.

Delaware is a small state that hosts a disproportionate number of corporations, banks, and financial services firms — so it makes sense that its privacy law casts a wide net. The low consumer threshold, GPC compliance requirement, and $10,000 penalty give the law real reach. For more on how state privacy laws affect data broker removal, see our guide to California's CCPA or automate your data removal with GhostVault.

Frequently Asked Questions