Delaware Has Had a Real Privacy Law Since 2025 — And It's About to Get Stricter
Delaware's Personal Data Privacy Act has been in effect since January 1, 2025. It rarely comes up in the same conversation as California, Virginia, or Colorado, but it's a real, currently enforceable law, and a recently signed amendment is about to make it apply to a meaningfully broader range of businesses.
Today's Thresholds
Currently, through the end of 2026, Delaware's law applies if you process personal data for 35,000 or more Delaware consumers annually, or 10,000 or more consumers while deriving more than 20% of gross revenue from selling personal data. The 35,000-consumer figure sits meaningfully lower than the 100,000 used by many comparable states, a detail easy to miss if you're mentally applying the more common threshold by habit.
Consumer Rights
Delaware grants confirmation and access, correction, deletion, data portability, and opt-out of targeted advertising, sale, and profiling, plus a 60-day appeal process for denied requests. Sensitive data requires opt-in consent before processing.
A Technical Requirement Already in Effect
Since January 1, 2026, Delaware has required businesses to honor universal opt-out signals, the browser-level mechanism like Global Privacy Control that lets a consumer broadcast an opt-out preference automatically, without visiting your site's specific opt-out page. A privacy policy that reads correctly can still leave a business non-compliant here if the underlying technical detection isn't actually built.
The Cure Period Already Expired
Delaware offered a 60-day window to fix a violation before enforcement, but that window was temporary and expired December 31, 2025. Enforcement today proceeds without that grace period, a detail worth knowing if you've been assuming a cure period still applies.
What's Coming in 2027
House Bill 380 was signed September 2, 2026, and takes effect January 1, 2027. It lowers Delaware's thresholds substantially, down to roughly 10,000 consumers on the general path and 5,000 on the revenue-based path, while adding a new third-party data-sharing trigger and a proportionality requirement to how the law is applied. A business safely outside Delaware's scope today, based on the current 35,000-consumer line, could find itself squarely inside it once these lower thresholds take effect.
Enforcement
The Delaware Department of Justice holds exclusive enforcement authority. There is no private right of action.
Check Your Delaware Exposure Now and Ahead of 2027
All information in this article is sourced from Delaware Code Title 6, Chapter 12D, the Delaware Department of Justice's published guidance, and independent legal analysis. Regulens is informational only and this article is not legal advice. Speak to a licensed privacy attorney about your specific compliance situation.
Regulens tracks Delaware as part of its ongoing state-by-state privacy coverage, including its 2027 threshold changes.
Free to check, takes three minutes, no credit card needed. Not legal advice. Informational only.
Check your store's Delaware privacy readiness at getregulens.com
Further Reading
Four States Now Ban Selling Your Customers' Exact Location — Is Yours Next
Virginia, Connecticut, Maryland, and Oregon have each independently banned the sale of precise geolocation data within the same general stretch of time. A pattern like this rarely stays confined to four states for long.
Utah's New Tax Has Nothing to Do With Nexus Thresholds — And That's the Point
As of this month, Utah taxes a specific category of digital content at 2%, tied to age-verification requirements. It's a genuinely different kind of obligation than the nexus thresholds most sellers are used to tracking.