Delaware's DPDPA has the lowest consumer threshold of any East Coast privacy law (35,000 residents), making it relevant to many SMBs with modest national reach.
Last reviewed 2026-06-19 · Risk rating rationale: Low threshold + Delaware's role as corporate registration state means many businesses incorporated there will need to comply even if their physical operations are elsewhere.
Find out in 10 seconds whether your site meets Delaware's requirements
Scantra runs a free, no-account, 9-check audit of your homepage covering privacy policy, contact info, CCPA-style opt-out, security headers, accessibility, and SEO basics. Most Delaware sites we scan fail at least three.
No credit card · Email required so we can send you the full results.
Key Delaware laws affecting websites
The statutes most likely to apply to a commercial website serving Delaware residents. Click a citation to read the official text where available.
DPDPA
— Delaware Personal Data Privacy Act· Effective 2025
Applies to: Entities that conduct business in Delaware or target Delaware residents AND (a) control or process data of 35,000+ Delaware consumers, or (b) control or process data of 10,000+ Delaware consumers AND derive 20%+ revenue from data sale.
What your website must do
Privacy notice with rights enumeration
Opt-in consent for sensitive data including children's data and consumer health data
Opt-out of sale, targeted ads, profiling for significant decisions
Honour Global Privacy Control
Data protection assessments for high-risk processing
Citation: Del. Code Ann. tit. 6 § 12D-101 et seq. · Official source ↗
Delaware compliance by topic
Consumer data protection
State-specific rule applies
What your site has to disclose, ask consent for, and allow consumers to do with their personal information.
DPDPA is a near-clone of the Connecticut framework with lower thresholds.
Practical requirements for your website
Privacy notice + rights enumeration
Honour GPC
Respond to rights requests within 45 days
Cookies and tracking
Federal law applies
When you need consent, opt-outs, or universal-signal honor for cookies and analytics scripts.
No cookie banner mandate.
Practical requirements for your website
Honour GPC
Privacy choices link in footer
Accessibility (ADA + state)
Federal law applies
WCAG conformance expectations and how the state's accessibility cases tend to be litigated.
Federal ADA Title III applies.
Practical requirements for your website
WCAG 2.1 AA conformance
Cybersecurity and breach response
State-specific rule applies
What 'reasonable security' looks like under state law and how fast you have to notify after a breach.
The Delaware Personal Data Privacy Act (effective January 2025) requires controllers to establish, implement, and maintain reasonable administrative, technical, and physical data security practices appropriate to the volume and nature of personal data (6 Del. C. § 12D-107). Delaware's separate breach-notification statute (6 Del. C. § 12B-102) requires notice without unreasonable delay and no later than 60 days after discovery.
Practical requirements for your website
Maintain reasonable administrative, technical, and physical safeguards proportionate to data sensitivity
Conduct data protection assessments for high-risk processing under DPDPA § 12D-108
Notify affected Delaware residents within 60 days of breach discovery
Notify the Delaware Attorney General when 500+ residents are affected
Provide one year of free credit monitoring if Social Security numbers are involved
Email and SMS marketing
Federal law applies
How federal CAN-SPAM and TCPA interact with state-level marketing rules in this jurisdiction.
Federal CAN-SPAM applies.
Practical requirements for your website
Standard CAN-SPAM compliance
AI regulation
Federal law applies
Which AI uses the state has chosen to regulate, who's covered, and what the website has to disclose.
DPDPA covers profiling for significant decisions.
Practical requirements for your website
Profiling opt-out
Frequently asked questions about Delaware website compliance
I incorporated my company in Delaware but operate elsewhere — does DPDPA apply?
DPDPA applies based on whether you process the personal data of Delaware residents above the threshold, not where you're incorporated. Many Delaware-incorporated SaaS businesses with no physical presence still cross the threshold because the consumer count is about who uses the service.
Ready to check your own site against Delaware's requirements?
The same free 9-rule scan, no signup needed. Two of the findings include drafted fixes you can copy/paste; full results (and ongoing monitoring) come with a free account.
Important: Scantra is a software tool and a non-profit publisher, not a law firm. The summaries on this page are written for general business orientation and reflect the editors' reading of the statutes as of 2026-06-19. They are not legal advice and should not be the only source you rely on for compliance decisions. For your specific situation, consult a licensed attorney in Delaware.
