DPDPA Compliance: The Delaware Personal Data Privacy Act, Handled
Delaware's law has one of the lowest thresholds in the country — 35,000 consumers — and even covers many nonprofits. ConsentPixel makes compliance a one-pixel install.
The Delaware Personal Data Privacy Act (DPDPA) gives Delaware residents rights over their personal data — and because it carries one of the lowest applicability thresholds in the country, it reaches many small and mid-sized businesses. ConsentPixel — Privacy · Verified handles opt-outs, universal opt-out signals, privacy documents, and audit-ready logs so DPDPA compliance is one pixel away.
What is the DPDPA?
The Delaware Personal Data Privacy Act took effect on January 1, 2025. It grants Delaware residents comprehensive privacy rights and imposes obligations on businesses that handle their personal data. The DPDPA is notable for its low thresholds, its inclusion of many nonprofits, and an expansive definition of sensitive data.
The DPDPA's 35,000-consumer threshold is among the lowest of any US state privacy law — a reflection of Delaware's small population. That means businesses far smaller than those covered by laws with 100,000-consumer thresholds can fall within scope. The law follows an opt-out model for general personal data and requires opt-in consent for sensitive data.
Who must comply
- Businesses that conduct business in Delaware or target Delaware residents and, in the preceding year, either:
- Controlled or processed the personal data of at least 35,000 consumers (excluding data used solely to complete a payment transaction); or
- Controlled or processed the personal data of at least 10,000 consumers and derived more than 20% of gross revenue from the sale of personal data.
- Unlike many state laws, the DPDPA applies to many nonprofits and institutions of higher education.
- Standard exemptions apply (GLBA-covered financial institutions, certain HIPAA data).
What the DPDPA requires
- Privacy notice: Provide a clear, accessible privacy notice covering data practices and consumer rights.
- Consumer rights: Honor access, correction, deletion, portability, and opt-out of sale, targeted advertising, and certain profiling.
- Opt-out mechanisms & universal opt-out: Provide clear opt-outs and recognize universal opt-out preference signals.
- Sensitive data consent: Obtain opt-in consent before processing sensitive personal data.
- Data minimization & security: Limit collection to what's necessary; protect what you hold.
- Data protection assessments: Conduct assessments for higher-risk processing.
The Delaware Department of Justice enforces the law. Civil penalties can reach up to $10,000 per violation. The initial cure period sunset at the end of 2025, after which cure opportunities are discretionary. There is no private right of action.
How ConsentPixel makes you DPDPA-compliant
ConsentPixel — Privacy · Verified sits between your visitors and your trackers. It detects what's running, presents a geo-aware consent banner, enforces the visitor's choice, and keeps an immutable record of every decision. Here's how that maps to your obligations:Geo-aware opt-out model. Delaware visitors get the opt-out experience the DPDPA requires, with sensitive data gated behind opt-in consent and GPC honored as a universal opt-out preference signal.
Auto-detecting scanner finds every cookie and tracker on your site, so your disclosures and consent categories are complete and accurate — not guesswork.
Signal passthrough drives Google Consent Mode v2, Microsoft UET, Meta Pixel, and IAB TCF 2.3 from a single consent event, so every platform respects the same choice.
GPC honoring recognizes Global Privacy Control opt-out signals and applies them automatically.
Document generator auto-creates Privacy Policy, Cookie Policy, Terms, and DPA documents to support your transparency obligations.
Immutable, tamper-evident logs record every consent decision — audit-ready proof of what each visitor saw and chose.
One pixel, under 5 minutes. Everything above ships from a single pixel install, with a public trust badge and verification page.
Why ConsentPixel
- Auto-detection ensures opt-outs actually suppress the right trackers.
- One pixel handles opt-outs, GPC, documents, and signals together.
- Audit-ready logs give defensible proof for DOJ enforcement.
- Multi-regulation: the same install covers other state laws your visitors fall under.
Frequently asked questions
Does the DPDPA apply to small businesses?
It can. With a 35,000-consumer threshold — among the lowest nationwide — the DPDPA reaches smaller businesses than many other state laws, and it also covers many nonprofits.
Do I have to honor GPC under the DPDPA?
The DPDPA requires recognition of universal opt-out preference signals. ConsentPixel honors Global Privacy Control automatically to support that obligation.
What are the penalties under the DPDPA?
The Delaware Department of Justice can seek civil penalties of up to $10,000 per violation. The initial right-to-cure period sunset at the end of 2025; cure opportunities are now at the DOJ's discretion.
Does the DPDPA cover nonprofits?
Yes, in large part. Unlike many state privacy laws, the DPDPA applies to many nonprofit organizations, so don't assume nonprofit status alone exempts you.
Is there a private right of action?
No. Enforcement is handled exclusively by the Delaware Department of Justice.
The bottom line
Delaware's tiny population produces an outsized reach: a 35,000-consumer threshold plus nonprofit coverage pulls in organizations that escape most other state laws. If you serve a national audience, you likely cross it — so plan for the DPDPA rather than assuming you're too small.
Make DPDPA compliance a one-pixel job
Install ConsentPixel to serve Delaware visitors the right opt-out model, honor GPC, generate your privacy documents, and keep audit-ready logs.
Scan your site free Start free trialThis page is informational and is not legal advice. The DPDPA is a Delaware state law; consult qualified counsel for advice on your specific obligations.