Delaware
For Delaware, law name and abbreviation is Delaware Personal Data Privacy Act (DPDPA); effective date is January 1, 2025; consumer volume threshold is Controlled or processed the personal data of not less than 35,000 consumers, excluding personal data controlled or processed solely for the purpose of completing a payment transaction; revenue-from-data-sales threshold is Controlled or processed the personal data of not less than 10,000 consumers and derived more than 20% of their gross revenue from the sale of personal data; threshold combination logic is OR — during the preceding calendar year did any of the following, recorded from its source on 2026-08-12.
- State
- Delaware our reading
- Law name and abbreviation
- Delaware Personal Data Privacy Act (DPDPA)
- Effective date
- January 1, 2025
- Consumer volume threshold
- Controlled or processed the personal data of not less than 35,000 consumers, excluding personal data controlled or processed solely for the purpose of completing a payment transaction verified
- Revenue-from-data-sales threshold
- Controlled or processed the personal data of not less than 10,000 consumers and derived more than 20% of their gross revenue from the sale of personal data verified
- Threshold combination logic
- OR — during the preceding calendar year did any of the following verified
- Key exemptions
- State and political subdivision bodies (excluding institutions of higher education); GLBA-regulated financial institutions; national securities associations; nonprofit organizations dedicated to preventing insurance crime
- Enforcement mechanism
- Attorney General (Department of Justice); 60-day cure period (expires December 31, 2025); no private right of action
- Statute citation
- Del. Code Ann. tit. 6, ch. 12D
- Notes
- Delaware has relatively low thresholds: 35,000 consumers (excl. payment data) or 10,000 consumers with 20% revenue from data sales. Unlike many states, Delaware does not broadly exempt all nonprofits — only nonprofits dedicated to preventing insurance crime are exempt. Institutions of higher education are NOT exempt.
Values marked our reading are our classification of what the source says — the source does not print them in those words. The quote below is the evidence for each one; judge it yourself.
What the source says
This chapter applies to persons that conduct business in the State or persons that produce products or services that are targeted to residents of the State and that during the preceding calendar year did any of the following: (1) Controlled or processed the personal data of not less than 35,000 consumers, excluding personal data controlled or processed solely for the purpose of completing a payment transaction. (2) Controlled or processed the personal data of not less than 10,000 consumers and derived more than 20% of their gross revenue from the sale of personal data.
— delcode.delaware.gov, retrieved 2026-08-12
Source
- delcode.delaware.govhttps://delcode.delaware.gov/title6/c012d/index.html