Delaware
Delaware privacy law: the signal beats your loyalty program
Delaware's thresholds are among the lowest in the country, and from January 1, 2026 a browser-level opt-out signal has to be honored — even when it contradicts a customer's setting in your rewards program.
At a glance
- Applies if
- You conduct business in Delaware or supply products or services targeted to Delaware residents and, during the preceding calendar year, you controlled or processed personal data of not less than 35,000 consumers (excluding data processed solely to complete a payment transaction); or not less than 10,000 consumers and derived more than 20 percent of gross revenue from the sale of personal data (§12D-103(a)). There is no standalone dollar-revenue threshold.
- Opt-out signal
- Required. Not later than January 1, 2026 you must let a consumer opt out of targeted advertising or sale through an opt-out preference signal sent, with the consumer's consent, by a platform, technology, or mechanism (§12D-104(e)(1)a). The signal must not unfairly disadvantage another controller. If it conflicts with a loyalty, rewards, or club-card setting, you must comply with the signal, though you may tell the consumer and offer the chance to confirm the program (§12D-104(e)(1)b).
- Response deadline
- Not later than 45 days after receipt, extended by 45 additional days when reasonably necessary with timely notice (§12D-104(c)(1)). A mandatory appeals process applies, with a decision not later than 60 days after receipt of an appeal (§12D-104(d)).
- Right to cure
- Discretionary. Beginning January 1, 2026 the Department of Justice may consider statutory factors when granting a cure opportunity (§12D-111(c)). The earlier conditional cure — 60 days after notice — applied only from January 1 to December 31, 2025 (§12D-111(b)).
- Max penalty
- Enforced exclusively by the Department of Justice, with no private right of action (§12D-111(a), (d), (e)). Penalties are assessed under the consumer fraud provisions that §12D-111 incorporates rather than a dollar figure stated in this chapter.
- Consumer rights
- access · correction · deletion · portability · categories of third-party recipients · opt out of sale · opt out of targeted advertising · opt out of solely-automated decisions producing legal or similarly significant effects · consent for sensitive data
Delaware Personal Data Privacy Act, 6 Del. C. ch. 12D, §§12D-101–12D-111 — in force January 1, 2025.
The signal is the job
Posting an opt-out link is not enough in Delaware. When a visitor's browser sends a qualifying opt-out preference signal, it has to be treated as a valid opt-out of sale and targeted advertising (§12D-104(e)(1)a). And if that signal contradicts a setting inside your loyalty program, the signal wins — you may notify the customer and offer to confirm the program, but you cannot simply let the program setting override it (§12D-104(e)(1)b).
Two low thresholds
35,000 consumers is a modest number for a chain or an online brand, and payment-only records do not count toward it. The second door is easier to trip than it looks: 10,000 consumers plus more than 20 percent of gross revenue from selling personal data (§12D-103(a)). A lead-generation site selling leads can be covered well below 35,000 people.
What else Delaware requires
- Consent before processing sensitive data, with parental consent for a known child (§12D-106(a)(4)).
- A list of the categories of third-party recipients on request (§12D-104(a)(5)).
- Sale is defined to include monetary or other valuable consideration, subject to enumerated exclusions (§12D-102(29)).
- Individuals acting in a commercial or employment context are outside the definition of consumer (§12D-102(8)).
Where Delaware sites usually break
Dealership leads, loyalty records, and identifiable website visitors can all enter the coverage count, while payment-only records are excluded from the first threshold (§12D-103(a)). Advertising pixels and lead transfers implicate the opt-out duties subject to the sale exclusions (§12D-104(a)(6)), and applicant screening in an employment context falls outside consumer scope while consumer-facing automated decisions stay in (§§12D-102(8), 12D-104(a)(6)).
No guaranteed chance to fix it
Delaware's mandatory cure entitlement expired at the end of 2025; from January 1, 2026 a cure opportunity is something the Department of Justice may grant, weighing statutory factors (§12D-111(b)–(c)). Finding and documenting a broken opt-out yourself, on a monthly cycle, is the practical substitute.
Primary sources
Everproof provides compliance software and operations support. It is not a law firm and does not provide legal advice. Using Everproof does not guarantee compliance or prevent fines.