Delaware Privacy Policy
Delaware has a comprehensive privacy law, the Delaware Personal Data Privacy Act, in force since January 1, 2025, and it is about to reach many more businesses. On January 1, 2027 the applicability threshold drops from 35,000 Delaware consumers to 10,000. A separate statute requires any commercial site or app that collects personal information from Delaware residents to post a privacy policy, with no size threshold.
What Delaware law does to this document
Who is covered through December 31, 2026
The Act applies to persons that conduct business in Delaware or target products or services to its residents and that, in the prior calendar year, controlled or processed the personal data of at least 35,000 consumers. Data processed solely to complete a payment transaction is not counted. The Act also applies at 10,000 consumers if more than 20 percent of gross revenue comes from the sale of personal data.
6 Del. C. § 12D-103(a) (effective until January 1, 2027)Lower thresholds from January 1, 2027
The amended section applies the Act at 10,000 consumers, or at 5,000 consumers with more than 20 percent of gross revenue from the sale of personal data. It also reaches third parties who acquire personal data from a controller. A business that counted its Delaware users in 2025 and found itself below 35,000 needs to count again.
6 Del. C. § 12D-103(a) (effective January 1, 2027)What the privacy notice must contain
A controller must provide a reasonably accessible, clear and meaningful privacy notice. It must state the categories of personal data processed, the purposes of processing, and how consumers exercise their rights and appeal a decision. It must also list the categories of data shared with third parties, the categories of those third parties, and an active email address or other online contact mechanism. From January 1, 2027 the notice must also identify the controller and describe the consumer rights.
6 Del. C. § 12D-106(c)Consumer rights and response times
Delaware consumers may access, correct and delete their personal data and obtain a portable copy. They may opt out of targeted advertising, sale and certain profiling. The controller must respond within 45 days, may extend once by 45 days, and must explain how to appeal a refusal. Through 2026 a consumer may obtain a list of the categories of third parties that received the data, and from January 1, 2027 the right is to a list of the third parties themselves, with limited exceptions.
6 Del. C. § 12D-104Sensitive data, teenagers and opt-out signals
A controller may not process sensitive data without the consumer's consent. Sensitive data includes genetic or biometric data, precise geolocation and the personal data of a known child, along with categories such as health diagnoses and immigration status. Consent is also required to sell the data of a consumer known to be at least 13 and under 18, or to use it for targeted advertising. Since January 1, 2026 controllers must honor opt-out preference signals for targeted advertising and sales.
6 Del. C. §§ 12D-102, 12D-106(a)(4), (a)(7), (e)The older rule: every commercial site must post a policy
Separately, an operator of a commercial website, online service or app that collects personally identifiable information from Delaware residents must make its privacy policy conspicuously available. The policy must identify the categories of information collected and the categories of third parties it may be shared with. It must state its effective date, describe how users are told of material changes, and disclose how the operator responds to do-not-track signals. An operator violates the posting duty only if it fails to post the policy within 30 days after being notified of noncompliance.
6 Del. C. § 1205CWhere people go wrong in Delaware
- Measuring the business against the 35,000-consumer threshold after January 1, 2027, when the figure is 10,000.
- Assuming a small site owes Delaware nothing, when the online privacy policy statute applies to any commercial site or app that collects personal information from Delaware residents.
- Publishing the generator's draft unedited for Delaware: its rights section offers the categories of third parties where Delaware gives a right to the list of third parties from January 1, 2027, its opt-in language for minors stops at age 15 where Delaware requires consent through age 17, and it does not address browser do-not-track signals under 6 Del. C. § 1205C.
How the generator works
A single privacy policy that covers the ~20-state U.S. privacy patchwork, adds CCPA/CPRA specifics, and can extend to EU/UK visitors. Answer a short interview and the draft assembles as you go, with Delaware already set as the governing state. Download it as PDF or Word. No fee. No account.