Laws
Delaware Personal Data Privacy Act (DPDPA): your rights and how to use them
Quick answer
If you live in Delaware, the Delaware Personal Data Privacy Act lets you ask a covered business to show you, correct or delete the personal data it holds about you, and to stop selling it or using it for targeted ads. Send your request through the method in the company's privacy notice: it has 45 days to answer, and one response a year is free. If the company refuses, appeal to it first, then complain to the Delaware Department of Justice.
All privacy laws“A consumer has the right to do all of the following: ... Delete personal data provided by, or obtained about, the consumer.”
- Applies in
- Delaware
- In force since
- Companies must answer within
- Without undue delay and within 45 days of receiving your request. The business can extend once by 45 more days if it's reasonably necessary and it tells you why within the first 45 days. Appeals get a written answer within 60 days. One response per 12 months is free (6 Del. C. § 12D-104(c)-(d)).
- Last updated
Head of Product & Co-Founder
Reviewed by Ludwig Sandgren
Head of Legal
Serus is a privacy company with paid tools to find and remove your personal data. This page is free and based on official sources.
Sources checked: delcode.delaware.gov, attorneygeneral.delaware.gov
Last verified against the official page:
Delaware residents. Until December 31, 2026 the law applies to businesses that operate in Delaware or target Delawareans and that, in the previous calendar year, handled personal data of at least 35,000 consumers (not counting data used only to complete a payment), or at least 10,000 consumers while earning more than 20% of gross revenue from selling personal data. From January 1, 2027 the thresholds drop to 10,000 consumers, or 5,000 plus more than 20% of revenue from data sales. Government bodies are exempt, but colleges and most nonprofits are covered. Data covered by HIPAA, the Fair Credit Reporting Act, GLBA, FERPA and the Driver's Privacy Protection Act is exempt.
Your rights
-
Confirm and access
Ask a business whether it processes your personal data, and see that data (trade secrets excepted). From January 1, 2027 this also covers inferences drawn from your data and whether it's used for profiling with legal or similarly significant effects (6 Del. C. § 12D-104(a)(1)).
-
Correct
Have inaccurate data fixed. The business can take into account what kind of data it is and why it holds it (6 Del. C. § 12D-104(a)(2)).
-
Delete
Have a business delete data you gave it and data it got about you from somewhere else. If it got your data from a third party, it may keep a minimal record so the data stays deleted, as long as it uses that record for nothing else (6 Del. C. § 12D-104(a)(3), (c)(5)).
-
Get a portable copy
Where the processing is automated, get a copy of your data in a portable, readily usable format (6 Del. C. § 12D-104(a)(4)).
-
See who got your data
Until December 31, 2026 you can get a list of the categories of third parties your data went to. From January 1, 2027 you can get a list of the actual third parties, with limited exceptions (6 Del. C. § 12D-104(a)(5)).
-
Opt out
Stop the business using your data for targeted advertising, selling it, or profiling you for automated decisions with legal or similarly significant effects. An opt-out request doesn't have to be authenticated (6 Del. C. § 12D-104(a)(6), (c)(4)).
-
Use an agent or a browser setting
Name an authorized agent to opt out for you. That agent can be a browser setting, a browser extension or a global device setting (6 Del. C. § 12D-105).
-
Withdraw consent
Where a business relied on your consent, for example for sensitive data, it must give you a way to withdraw it that's at least as easy as giving it, and stop processing within 15 days (6 Del. C. § 12D-106).
-
Appeal
Appeal a refusal. The business must answer in writing within 60 days and, if it still says no, tell you how to complain to the Department of Justice (6 Del. C. § 12D-104(d)).
General information, not legal advice.
How to use it
- 1
Find the request method in the privacy notice
Covered businesses must describe a secure and reliable way to send a request in their privacy notice. Use that channel.
- 2
Say which rights you want to use
Name them plainly: access, correction, deletion, a copy, or an opt-out. A line like "Under the Delaware Personal Data Privacy Act, please delete the personal data you hold about me" is enough to start.
- 3
Turn on an opt-out preference signal
Since January 1, 2026, businesses must honor an opt-out preference signal, such as Global Privacy Control, as an opt-out of targeted advertising and sales. Switch it on in your browser and it goes out to every site you visit. If the signal clashes with a setting you chose, like a loyalty program, the business follows the signal but may ask you to confirm.
- 4
Confirm your identity if asked
For access, correction, deletion and a copy, the business may ask for information that's reasonably necessary to confirm it's you. It can't demand that for an opt-out.
- 5
Wait up to 45 days
The business has 45 days to respond, or 90 if it tells you within the first 45 days that it needs more time and why. If it refuses, it must explain why within 45 days and tell you how to appeal.
- 6
Appeal if the business refuses
Use the business's appeal process. It must decide in writing within 60 days.
- 7
Complain to the Delaware Department of Justice
If the business doesn't respond or you want to challenge its decision, the Department of Justice says to send a complaint to privacy@delaware.gov. Its consumer page also has a Submit Privacy Complaint button that opens the privacy complaint form. You can't sue a business under this law yourself: the Department of Justice enforces it.
No answer in time? Complain to Delaware Department of Justice, Fraud and Consumer Protection Division .
Who has to follow the DPDPA
The law covers businesses that operate in Delaware or target Delaware residents and that handled personal data of at least 35,000 consumers in the previous calendar year. Data used only to complete a payment doesn't count toward that number. A smaller business is covered too if it handled data of at least 10,000 consumers and earned more than 20% of its gross revenue from selling personal data.
Unlike some states, Delaware doesn't exempt nonprofits in general, and colleges and universities are covered.
What changes on January 1, 2027
An amendment (85 Del. Laws c. 463) takes effect on January 1, 2027:
- The thresholds drop to 10,000 consumers, or 5,000 consumers plus more than 20% of revenue from data sales.
- Third parties that acquire personal data from a business are covered.
- Your access right includes inferences drawn from your data.
- You can get a list of the specific third parties that received your data, not only the categories.
Why a company can say no
Some organizations and some data sit outside the law. State and local government bodies are exempt, as are financial institutions covered by the Gramm-Leach-Bliley Act (GLBA) and registered securities and futures associations. Data covered by federal laws is exempt too, including HIPAA (health), the Fair Credit Reporting Act (credit reports), GLBA (banking), FERPA (school records) and the Driver's Privacy Protection Act. Employment records are also outside it.
So if a company tells you your data falls under the FCRA or GLBA, that's the likely reason it's declining. You can still appeal, and complain to the Department of Justice if you think the refusal is wrong. Our guide on what to do when a company won't delete your account covers the next steps.
Where Serus fits
The DPDPA works one company at a time, and you first have to know which companies hold your data. Serus finds the data brokers that operate where you live, sends the deletion and opt-out requests for you, and checks whether your data shows up again. The steps above are free if you'd rather do them yourself.
Data brokers that list people in United States
Each guide shows how to opt out of that site, step by step.
- Remove yourself from CourtRecords.us
- Remove yourself from TruePeopleSearch
- Remove yourself from Spokeo
- Remove yourself from LexisNexis
- Remove yourself from TruthFinder
- Remove yourself from FastPeopleSearch
- Remove yourself from BeenVerified
- Remove yourself from Intelius
Let Serus send the requests for you
Serus finds the data brokers that list you where you live and removes you from them.
Related
Frequently asked
When did the Delaware privacy law take effect?
January 1, 2025. The browser opt-out signal rule applies from January 1, 2026, and an amendment (85 Del. Laws c. 463) takes effect on January 1, 2027.
Can I sue a company under the DPDPA?
No. The law says it doesn't create a private right of action. The Delaware Department of Justice enforces it, so complaints go there.
What changes on January 1, 2027?
The thresholds drop to 10,000 consumers, or 5,000 plus more than 20% of revenue from data sales. Third parties that acquire personal data are covered too, and you can see inferences drawn about you and a list of the specific third parties that got your data. An access response may not hand back sensitive numbers such as your Social Security number; the business only says it holds one.
Does the law cover nonprofits and colleges?
Generally yes. Only nonprofits dedicated exclusively to preventing and addressing insurance crime are exempt, and colleges and universities are not excluded.
Is teenagers' data protected?
Yes. A business that knows, or wilfully disregards, that you're 13 to 17 needs your consent before it uses your data for targeted advertising, sells it or profiles you.
Can a business charge me for a request?
Not for one request in any 12-month period. It may charge a reasonable fee for, or refuse, requests that are manifestly unfounded, excessive or repetitive.
Sources
Something wrong or out of date? Tell us and we'll re-check it.