What are the Delaware Personal Data Privacy Act (DPDPA) compliance deadlines?

Jan 1, 2025: DPDPA takes effect. Dec 31, 2025: Mandatory 60-day cure period expires. Jan 1, 2026: Opt-out preference signals must be honored. Jan 1, 2027: Amended thresholds and third-party duties take effect.

When does Delaware Personal Data Privacy Act (DPDPA) take effect?

Delaware Personal Data Privacy Act (DPDPA) took effect on Jan 1, 2025. The next milestone is Jan 1, 2027: Amended thresholds and third-party duties take effect.

Who does Delaware Personal Data Privacy Act (DPDPA) apply to?

Until Jan 1, 2027: persons doing business in Delaware or targeting residents that controlled or processed personal data of 35,000+ consumers (excluding payment-only data), or 10,000+ consumers and derived over 20% of gross revenue from selling personal data. From Jan 1, 2027: 10,000+ consumers, or 5,000+ consumers and over 20% of gross revenue from sale, plus third parties that acquire personal data from a controller.

What are the penalties under Delaware Personal Data Privacy Act (DPDPA)?

Violations are unlawful practices under 6 Del. C. 2513 and subchapter II of chapter 25 of Title 29, enforced by the Department of Justice (civil penalties up to $10,000 per willful violation under Delaware consumer fraud law). Mandatory 60-day cure ran Jan 1 - Dec 31, 2025; from Jan 1, 2026 cure is at DOJ discretion.

Delaware Personal Data Privacy Act (DPDPA)

Amended Delaware · In force Jan 1, 2025 · next deadline Jan 1, 2027 (in 2 months)

Official text

Add to calendar

Apple Calendar or Outlook Google Calendar Download .ics

Deadlines

Coming up

Takes effectJan 1, 2027 · in 2 months · Source

Amended thresholds and third-party duties take effectApplicability drops to 10,000 consumers (or 5,000 + 20% revenue from sale) and new third-party duties (12D-107A) apply.

Already passed

ComplianceJan 1 · 10 months ago · Source

Opt-out preference signals must be honoredControllers must allow opt-out of targeted advertising and sale via opt-out preference signals (12D-106).

EnforcementDec 31, 2025 · 10 months ago · Source

Mandatory 60-day cure period expiresMandatory notice-and-cure ends Dec 31, 2025; from Jan 1, 2026 DOJ decides whether to offer a cure using statutory factors.

Takes effectJan 1, 2025 · 22 months ago · Source

DPDPA takes effectConsumer rights and controller duties apply; 60-day mandatory cure period begins.

Summaries for reference, not legal advice. Check the official text.

What it does

Comprehensive privacy law with low applicability thresholds and no exemption for nonprofits. Grants rights to access, correct, delete, port, and opt out of targeted advertising, sale and profiling, and requires honoring opt-out preference signals from Jan 1, 2026. A 2026 amendment (85 Del. Laws c. 463) lowers thresholds further and adds third-party duties from Jan 1, 2027.

Who it applies to: Until Jan 1, 2027: persons doing business in Delaware or targeting residents that controlled or processed personal data of 35,000+ consumers (excluding payment-only data), or 10,000+ consumers and derived over 20% of gross revenue from selling personal data. From Jan 1, 2027: 10,000+ consumers, or 5,000+ consumers and over 20% of gross revenue from sale, plus third parties that acquire personal data from a controller.
Penalties: Violations are unlawful practices under 6 Del. C. 2513 and subchapter II of chapter 25 of Title 29, enforced by the Department of Justice (civil penalties up to $10,000 per willful violation under Delaware consumer fraud law). Mandatory 60-day cure ran Jan 1 - Dec 31, 2025; from Jan 1, 2026 cure is at DOJ discretion.
Enforced by: Delaware Department of Justice (Attorney General)
Official name: Delaware Personal Data Privacy Act (HB 154), 6 Del. C. ch. 12D
Citation: HB 154 (152nd GA), 84 Del. Laws c. 197; amended by 85 Del. Laws c. 463; 6 Del. C. 12D-101 to 12D-111
Topics: Privacy, Children

Verified 2026-09-22

Research notes

The 2026 amending act is cited in the Delaware Code as 85 Del. Laws c. 463; the underlying bill number and signing date were not verified. The per-violation penalty amount comes from Delaware's general consumer fraud enforcement law (the DPDPA itself does not state a dollar figure) and was not re-verified on the official code page.

EnactedAlabama

Alabama Personal Data Protection Act (APDPA)Alabama's comprehensive privacy law, enacted April 2026, grants rights to confirm, correct, delete, port and opt out of targeted advertising, sale and profiling. Unusually, it does not require data protection assessments, generally excludes analytics and certain marketing disclosures from 'sale', and broadly exempts small businesses that don't sell data.Next: May 1, 2027 APDPA takes effect · in 6 months

In forceArkansas

Arkansas COPPA 2.0State COPPA-style law that extends protections to teens. Operators of sites and apps directed to children or teens, or with knowledge of their age, face limits on collecting and using their personal information and on targeted advertising.In effect since Jul 1, 2026

AmendedCalifornia

CCPA / CPRAGives California residents (including employees and B2B contacts) rights to know, delete, correct, and opt out of sale/sharing of personal information and to limit use of sensitive personal information. CPPA regulations approved Sept 22, 2025 (effective Jan 1, 2026) add automated decisionmaking technology (ADMT) rights, mandatory risk assessments with submissions to the agency, and annual independent cybersecurity audits. AB 566 (2025) requires browsers to offer an opt-out preference signal from Jan 1, 2027.Next: Jan 1, 2027 ADMT requirements compliance date · in 2 months

In forceCalifornia

California AB 2013 (AI training data transparency)Developers of generative AI systems made publicly available to Californians must post documentation of the training data on their websites. It must cover a high-level summary of the datasets, their sources and owners, the number of data points, the types of data, whether the data includes copyrighted material or personal information, whether it was licensed or purchased, cleaning and processing steps, collection periods, and whether synthetic data was used.In effect since Jan 1, 2026

In forceCalifornia

California Delete Act / DROPRequires data brokers to register annually with the California Privacy Protection Agency and to process consumer deletion requests submitted through the agency's Delete Request and Opt-out Platform (DROP). DROP opened to consumers Jan 1, 2026; from Aug 1, 2026 brokers must pull and process requests at least every 45 days. Brokers face independent compliance audits every three years from 2028.Next: Jan 31, 2027 Annual data broker registration deadline · in 3 months

EnactedCalifornia

California Digital Age Assurance ActOperating system providers must ask for a user's birth date or age at device account setup and send an age-bracket signal to apps through an API. App developers must request that signal when an app is downloaded and launched. The signal may only be used for age compliance and not shared for other purposes.Next: Jan 1, 2027 Age signal duties begin · in 2 months

In forceCalifornia

California SB 243 (companion chatbots)Operators of companion chatbot platforms must clearly disclose that the chatbot is AI where a user could reasonably think they are talking to a human. They must keep and publish protocols that prevent suicidal-ideation and self-harm content and refer users to crisis services. For known minors, operators must disclose AI use, remind them every three hours to take a break, and block sexually explicit content. Annual reports to the Office of Suicide Prevention begin July 1, 2027.Next: Jul 1, 2027 First annual report to Office of Suicide Prevention · in 8 months

In forceCalifornia

California SB 976 addictive feedsBars addictive, personalized feeds for known minors without verifiable parental consent, and limits notifications to minors at night and during school hours. From 2027 operators must reasonably determine a user is not a minor before serving an addictive feed. The Attorney General must adopt age assurance and parental consent rules.Next: Jan 1, 2027 Age assurance duty and AG rules · in 2 months

Questions about Delaware Personal Data Privacy Act (DPDPA)

What are the Delaware Personal Data Privacy Act (DPDPA) compliance deadlines?: Jan 1, 2025: DPDPA takes effect. Dec 31, 2025: Mandatory 60-day cure period expires. Jan 1, 2026: Opt-out preference signals must be honored. Jan 1, 2027: Amended thresholds and third-party duties take effect.
When does Delaware Personal Data Privacy Act (DPDPA) take effect?: Delaware Personal Data Privacy Act (DPDPA) took effect on Jan 1, 2025. The next milestone is Jan 1, 2027: Amended thresholds and third-party duties take effect.
Who does Delaware Personal Data Privacy Act (DPDPA) apply to?: Until Jan 1, 2027: persons doing business in Delaware or targeting residents that controlled or processed personal data of 35,000+ consumers (excluding payment-only data), or 10,000+ consumers and derived over 20% of gross revenue from selling personal data. From Jan 1, 2027: 10,000+ consumers, or 5,000+ consumers and over 20% of gross revenue from sale, plus third parties that acquire personal data from a controller.
What are the penalties under Delaware Personal Data Privacy Act (DPDPA)?: Violations are unlawful practices under 6 Del. C. 2513 and subchapter II of chapter 25 of Title 29, enforced by the Department of Justice (civil penalties up to $10,000 per willful violation under Delaware consumer fraud law). Mandatory 60-day cure ran Jan 1 - Dec 31, 2025; from Jan 1, 2026 cure is at DOJ discretion.

Deadlines

What it does

Related