Guide · US state law

DPDPA: the Delaware law that reaches even mid-sized sites

The Delaware Personal Data Privacy Act has been in force since January 1, 2025 and has one of the lowest thresholds in the country. In this guide you will understand who must comply, why nonprofits are covered too, how the universal opt-out signal works and what changes in 2027.

Audit my site for the US Read the guide

✓Based on the Delaware Code and the Department of Justice portal
✓Practical examples for sites with ads
✓Read-only scan, no changes to the site

35,000Delaware consumers per year: the main threshold until the end of 2026

10,000consumers are enough if more than 20% of gross revenue comes from selling data

100,000consumers: beyond that, the company must carry out data protection assessments

$10,000maximum civil penalty per willful violation, under the consumer fraud law

What it is

A small law by name and big in reach

The Delaware Personal Data Privacy Act, or DPDPA, is Delaware's general privacy law. It was passed in 2023, sits in Title 6, Chapter 12D of the Delaware Code, and began to be enforced on January 1, 2025 by the state's Department of Justice.

The model is similar to Connecticut's. Visitors can access, correct, delete and take their data, and can refuse the sale of data, targeted advertising and certain automated profiling. Sensitive data can only be used with consent.

What stands out is the reach. Delaware is a small state, so lawmakers chose low thresholds: data on 35,000 consumers per year is already enough. And, unlike many states, nonprofits are not exempt.

For a content site with visitors from the United States, this changes the math. A news portal, a finance blog or an association with a lot of Delaware traffic can pass the threshold without noticing, because every ad cookie counts as personal data.

Checklist

What you need to meet

If the site exceeds the DPDPA thresholds, this is the basic list, from most urgent to least.

Have a clear, visible opt-out link
The site needs a clear, visible link to a page where the visitor opts out of targeted advertising and sale.
Example
Footer link: Do Not Sell or Share My Personal Information, leading to an opt-out screen.
Accept the browser preference signal
Since January 1, 2026, the site must accept an opt-out sent by a preference signal, such as GPC. The signal cannot be turned on by default.
Example
Visitor with GPC turned on: treat it as if they had clicked the opt-out link.
Get real consent for sensitive data
Sensitive data only with consent. Consent obtained through a misleading default is not valid, and withdrawing must be as easy as giving it.
Example
If the visitor withdraws consent, stop the processing within 15 days.
Protect teens aged 13 to 17
If the company knows, or deliberately ignores, that the visitor is 13 to 17 years old, it cannot use their data for targeted advertising or sell it without consent.
Publish a complete privacy notice
The notice lists the data processed, the purposes, how to exercise rights and appeal, the data shared and the categories of third parties, with an active contact.
Example
Include an active email, such as privacy@yoursite.com, at the end of the notice.
Answer requests without requiring a new account
Respond within 45 days, with one extension of another 45 if you give notice. Do not require a new account and have an appeal process.
Do the data protection assessment
Anyone who processes data of at least 100 thousand consumers assesses in writing the risks of targeted advertising, sale and sensitive data. In 2027, the threshold drops to 50 thousand.
8
Pass the opt-out to Google
Google does not require a CMP for US states. Use the US state regulations message, in Privacy & messaging, or turn on restricted data processing, RDP, in the tag for people who opted out. With GPP, Google reads the US National section for Delaware.
Example
AdSense or Ad Manager: Privacy & messaging, US state regulations card, Create. Then choose the sites and publish.
```
// Só para o visitante que recusou
googletag.pubads().setPrivacySettings({
  restrictDataProcessing: true,
});
```

In practice

Right and wrong

WrongNo opt-out link, only a long text in the policy.
RightClear and visible opt-out link in the footer of every page.
WrongThe site ignores the signal and keeps showing personalized ads.
RightThe browser sends GPC and the site treats it as an opt-out of sale and targeted advertising.
WrongPre-checked boxes or a screen designed to push the visitor to accept.
RightSensitive data options unchecked until the visitor chooses.
WrongPersonalized ad for a teenager the site knows to be 16.
RightNo targeted advertising for a visitor aged 13 to 17 without consent.

Official tools

Certified CMPs and official links

Google does not require a certified CMP or GPP for US state laws. You can use Google's own message or turn on RDP in the tag.

Who must comply

The thresholds that bring your site under the DPDPA

The law applies to anyone who does business in Delaware or offers products and services targeted to residents of the state and, in the previous calendar year, passed one of the thresholds below.

35,000 consumers

Controlled or processed data of at least 35,000 Delaware consumers. Data used only to complete a payment does not count.

10,000 and data sales

Controlled or processed data of at least 10,000 consumers and earned more than 20% of gross revenue from selling personal data.

Nonprofits too

The law applies to companies and to nonprofits. The only exempt entity of this kind is one dedicated to fighting insurance fraud.

Exemptions by type of data

There are exceptions for financial and health data governed by federal laws. The Department of Justice itself recommends checking with a lawyer whether any of them applies.

Lower thresholds in 2027

A law passed in 2026, HB 380, lowers the thresholds from January 1, 2027: 10,000 consumers, or 5,000 with more than 20% of revenue from selling data.

Third parties that buy data

Also from 2027, third parties that acquire personal data from a controller are covered, with no numeric threshold.

Definitions

The words of the law, in plain site-owner language

The definitions are in section 12D-102 and are similar to those of Connecticut and Oregon, with a longer list of sensitive data.

Personal data

Any data linked, or that can be linked, to a person: name, address, email, device identifiers, precise location and unique identifiers, such as those used by ad cookies.

Sensitive data

Racial or ethnic origin, religious belief, health condition including pregnancy, sex life, sexual orientation, transgender or nonbinary status, immigration status, genetic and biometric data, children's data and precise geolocation.

Sale

The exchange of personal data for money or other valuable consideration with a third party. Transfers to processors and to companies in the same group are left out.

Targeted advertising

An ad chosen based on data obtained or inferred from the visitor's activities over time on other companies' sites and apps. An ad based on the context of a search does not count.

People's rights

What a Delaware resident can ask for

The response must go out within 45 days, with an extension of another 45 days if needed and communicated within the initial period. The company must have an appeal process.

Confirm and access

Find out whether the company processes their data and get access to that data.

Correct and delete

Correct wrong data and ask for personal data to be deleted.

Portability

Receive a copy of the data in a format that is easy to take to another service.

List of third parties

Receive the list of categories of third parties that received the data. From 2027, the list will name the specific third parties, with some exceptions.

Refuse targeted ads and sale

Ask that the data not be used for targeted advertising and not be sold. This is the right that matters most for sites with ads.

Refuse automated profiling

Refuse profiling done only by machines that leads to decisions with legal or similarly significant effects.

Site obligations

What a covered site must have working

Full privacy noticeThe notice must list the categories of data processed, the purposes, how to exercise rights and appeal, the categories of data shared with third parties, the categories of those third parties and an active email or other online contact.
Disclose sale and targeted adsIf the site sells data or uses data for targeted advertising, it must say so clearly and visibly and explain how to opt out.
Collect only what is neededCollection must be adequate, relevant and reasonably necessary for the purposes disclosed to the visitor.
Consent for sensitive dataSensitive data only with consent, which the visitor can withdraw as easily as they gave it.
Protection for teenagersIf the company knows, or willfully disregards, that the visitor is between 13 and 17 years old, it cannot use their data for targeted advertising or sell it without consent.
Data protection assessmentAnyone who controls or processes data of at least 100,000 consumers must assess in writing the risks of targeted advertising, sale, profiling and sensitive data. In 2027 this threshold drops to 50,000 in certain cases.

Enforcement and fines

Who enforces it and what changed with the cure period

Only the Delaware Department of Justice enforces the DPDPA. Consumers cannot sue a company under this law.

Mandatory cure period ended

In 2025, the Department had to notify the company and give it 60 days to fix the issue before acting. That mandatory period ended on December 31, 2025.

Now it is the agency's decision

Since 2026, whether to grant a cure period is the Department's choice, and it considers the number of violations, the size of the company, the risk to the public and whether the mistake was human or technical.

Unlawful trade practice

A DPDPA violation is treated as an unlawful practice under Delaware's consumer fraud law, with that law's investigative tools.

Up to $10,000 per violation

If the court finds the violation was willful, the civil penalty can reach $10,000 per violation.

Timeline

DPDPA dates

Delaware has already changed its own law once. As of November 2026, the 2025 rules are in effect and the 2027 rules are on the way.

2023
Law passed
Delaware passes the Personal Data Privacy Act.
January 1, 2025
Enforcement begins
The Department of Justice starts enforcing the law, with a mandatory 60-day cure period.
December 31, 2025
End of the mandatory cure period
The period in which the Department had to notify and wait 60 days before acting ends.
January 1, 2026
Universal signal required
The site must honor the opt-out of sale and targeted advertising sent by a preference signal, such as the GPC.
2026
HB 380 passed
Delaware passes changes that lower thresholds, expand sensitive data and require a list of the specific third parties.
January 1, 2027
New rules take effect
The thresholds of 10,000 and 5,000 consumers and the other HB 380 changes come into force.

Sites with AdSense and Ad Manager

Required GPC and the opt-out path to Google

Since January 1, 2026, a site covered by the DPDPA must honor the opt-out sent by a preference signal, with the visitor's consent. The most common example is the Global Privacy Control, or GPC, which some browsers and extensions send. For a visitor with GPC turned on, the site must act as if they had clicked the opt-out link.

In AdSense and Ad Manager, under Privacy & messaging, Google offers a US state regulations message, and Delaware is among the states covered. The message shows the Do Not Sell or Share link. When the visitor opts out, Google turns on restricted data processing, called RDP, and stops using past behavior to choose ads.

On the GPC, Google says the partner that implemented the signal can choose to turn on RDP when it receives an opt-out GPC. In other words, the decision and the setup are up to the site or the CMP. One way is through the tag: the restrictDataProcessing parameter in GPT or the data-restrict-data-processing attribute in AdSense.

If you use GPP, you should know that there is a specific Delaware section, but it is not on the list of sections Google accepts. For Google, the path is the US National section, where refusing sale, sharing or targeted advertising turns on RDP.

In practice

What is and is not allowed in Delaware

Examples for a site with Delaware traffic that monetizes with programmatic ads.

Allowed

Show contextual ads to people who opted out or arrived with GPC turned on
Use Google's state regulations message to offer the opt-out link
Apply the same GPC handling to all US traffic, to keep things simple
Use the US National section of the GPP to tell Google about the opt-out
Keep a single privacy notice for the US, as long as it includes the contact email and everything Delaware requires

Not allowed

Ignore the GPC and keep requesting personalized ads for that visitor
Assume your association or nonprofit is exempt just because it is not for profit
Use data of teenagers aged 13 to 17 for targeted ads without consent
Publish a privacy policy without an active contact email or form
Count on an automatic 60-day period to fix things: it ended in 2025

Common errors

Where sites trip up with the DPDPA

The low threshold makes Delaware reach sites that never thought about US state laws.

Underestimating volume

The site counts only registered users. But cookies and ad identifiers of anonymous visitors are also personal data and count toward the 35,000.

GPC ignored

The CMP does not read the GPC or only reads it for California. Since 2026, Delaware also requires the signal to be honored.

Opt-out that does not change the ads

The visitor opts out, but ad requests continue without RDP and without an opt-out in the GPP string.

Policy without a list of third parties

The privacy page does not say which categories of third parties, such as ad networks and measurement partners, receive the data.

State section that Google does not read

The CMP sends only the Delaware section in the GPP and leaves out the US National one. Google does not receive the opt-out.

Forgetting 2027

The company is below 35,000 consumers and relaxes, but with the new 2027 thresholds it ends up within the law.

In ConsentMode

What the audit checks for Delaware

Opens the site as a visitor from the United States and looks for the opt-out link in the footer, the menu and the privacy message.
Turns on the GPC signal in the audit browser and compares the page and the ad requests with and without the signal.
Reads the GPP string and checks that the US National section exists and records the opt-out.
Identifies the CMP or Google's message from the page code.
Checks that the privacy page includes data categories, purposes, third parties, rights, appeal and a contact email.

Run an audit See everything that is checked

Frequently asked questions

How do I know if I pass 35,000 Delaware consumers?

Look at the geography report in Analytics or Ad Manager and count unique Delaware visitors in the previous calendar year. Because cookies and ad identifiers are personal data, anonymous visitors count too. Data used only for payment is left out.

My organization is a nonprofit. Am I exempt?

Not necessarily. In Delaware, nonprofits must comply with the law if they pass the thresholds. The only exception of this kind is for entities dedicated to fighting insurance fraud.

Do I have to honor the GPC?

Yes, if the law applies to your site. Since January 1, 2026, the opt-out of sale and targeted advertising sent by a preference signal must be honored.

What changes in 2027?

HB 380 lowers the thresholds to 10,000 consumers, or 5,000 with more than 20% of revenue from selling data, expands the list of sensitive data and gives consumers the right to know which specific third parties received their data.

Do I need a cookie banner for Delaware?

The law works on an opt-out model, so it does not require asking for consent before ordinary ads. The exceptions are sensitive data and teenagers aged 13 to 17, which require consent.

Does ConsentMode make my site compliant?

ConsentMode is not a CMP or a law firm. The audit shows what the site actually does with the opt-out link, the GPC, the GPP and the privacy page, so you can fix it with your vendor and your lawyer.

Library

Official sources

This guide was written from these official pages. Read them directly at the source:

See whether your site honors the GPC in Delaware

The audit opens the site as a US visitor, with and without GPC, and shows what to fix, without changing anything.

Start the audit