DPDPA requirements
Delaware's law took effect January 1, 2025 and follows the Connecticut model, including opt-in consent for sensitive data, opt-outs of targeted advertising, sale, and profiling, and, since January 1, 2026, a requirement to honor universal opt-out mechanisms. It extends protections to consumers under 18 and unusually covers nonprofits. HB 380, signed September 2, 2026, cuts the applicability threshold from 35,000 consumers to 10,000 on January 1, 2027, the lowest of any state, and adds a right to opt out of automated decisions with significant effects. The Department of Justice enforces. The 60-day cure period ran through the end of 2025; civil penalties of up to $10,000 apply to each willful violation. Delaware is small, which is exactly why it gets missed: a consent configuration built around the big-state list often has no rule for it at all.
Other US State Privacy Laws
See what your sites and apps actually send
Get a free site analysis: every tracker, mapped to the laws that apply to it.