DPDPA Consumer Rights: Delaware Data Privacy

Under the Delaware Personal Data Privacy Act (DPDPA), Del. Code tit. 6, ch. 12D, a Delaware resident can confirm whether a business is processing their personal data and access it, correct inaccuracies, delete data, obtain a portable copy, get a list of the categories of third parties that received their data, and opt out of targeted advertising, the sale of personal data, and certain profiling. These rights are set out in § 12D-104(a) and took effect January 1, 2025.

A controller must respond to a rights request within 45 days under § 12D-104(c), with one 45-day extension when reasonably necessary, and must offer an appeal process under § 12D-104(d). As of January 1, 2026, controllers must also honor a universal opt-out preference signal such as Global Privacy Control under § 12D-106(e). The Delaware Department of Justice enforces these rights, and there is no private right of action.

Jurisdiction scope: This covers Delaware's Personal Data Privacy Act (Del. Code tit. 6, ch. 12D). It is general legal information, not legal advice.

The five core data rights

The DPDPA grants Delaware consumers a full slate of data rights in § 12D-104(a). These rights apply to covered controllers, meaning businesses that meet the applicability thresholds in § 12D-103.

The right to access, in § 12D-104(a)(1), lets a consumer confirm whether a controller is processing the consumer's personal data and access that data, unless the confirmation or access would require the controller to reveal a trade secret. The right to correct, in § 12D-104(a)(2), lets a consumer correct inaccuracies, taking into account the nature of the personal data and the purposes of processing.

The right to delete, in § 12D-104(a)(3), is broad: a consumer may delete personal data provided by or obtained about the consumer. That reaches beyond data the consumer supplied directly to data the business obtained from other sources. The right to data portability, in § 12D-104(a)(4), lets a consumer obtain a copy of their personal data in a portable and, to the extent technically feasible, readily usable format, though here too the controller is not required to reveal any trade secret.

For the full controller obligations behind these rights, see the Delaware data privacy laws parent page.

The categories-of-third-parties list right

A distinct DPDPA right lets consumers see where their data has traveled. Under § 12D-104(a)(5), a consumer may obtain a list of the categories of third parties to which the controller has disclosed the consumer's personal data.

This is a category-level disclosure. A controller discloses groups of recipients, such as advertising networks, analytics providers, or payment processors, rather than every individually named company. Even so, it gives consumers a structured view of the controller's data sharing and forces businesses to track and maintain their disclosure categories.

To answer these requests accurately, a controller needs a data map that records which categories of vendors and partners receive which data. Businesses that have not inventoried their downstream sharing will struggle to respond within the statutory deadline.

The three opt-out rights

Section 12D-104(a)(6) gives consumers three opt-out rights. Under § 12D-104(a)(6)a., a consumer may opt out of the processing of personal data for purposes of targeted advertising. Under § 12D-104(a)(6)b., a consumer may opt out of the sale of personal data, except as provided in § 12D-106(b). That subsection does not require a controller to provide a product or service that needs personal data it does not collect or maintain, and it lets a controller offer a different price, rate, level, quality, or selection of goods or services, including for no fee, in connection with a consumer's voluntary participation in a bona fide loyalty, rewards, premium features, discounts, or club card program. Under § 12D-104(a)(6)c., a consumer may opt out of profiling in furtherance of solely automated decisions that produce legal or similarly significant effects.

The profiling opt-out is narrow by design. It reaches automated decisions with legal or similarly significant effects, such as decisions affecting access to financial services, housing, employment, or similar outcomes. Routine ad personalization that does not produce such effects falls under the targeted-advertising opt-out instead.

Delaware's definition of "sale" is broad. It covers the exchange of personal data for monetary or other valuable consideration, which means data sharing that produces non-cash value can still count as a sale and trigger the opt-out.

Response deadlines, extensions, and authentication

A controller must respond to a consumer rights request promptly. Under § 12D-104(c)(1), the controller must respond without undue delay and in any case not later than 45 days after receiving the request. The controller may extend that period by an additional 45 days when reasonably necessary, considering the complexity and number of requests, as long as it informs the consumer of the extension and the reason for it within the initial 45-day window.

If a controller declines to act, it must tell the consumer why within that response period and explain how to appeal. Under § 12D-104(c)(4), a controller that cannot authenticate a request to exercise the rights in § 12D-104(a)(1) through (a)(5) using commercially reasonable efforts is not required to comply, but it must notify the consumer that it could not authenticate the request and may ask for additional information reasonably necessary to do so. That authentication exception does not reach opt-out requests. The same paragraph provides that a controller is not required to authenticate an opt-out request and may deny one only on a good faith, reasonable, and documented belief that the request is fraudulent, in which case it must send the requester a notice stating that belief, why it holds it, and that it will not comply.

Responses must generally be provided free of charge, once per consumer during any 12-month period, under § 12D-104(c)(3). If requests are manifestly unfounded, excessive, or repetitive, the controller may charge a reasonable fee or decline to act, and it bears the burden of demonstrating that character.

The appeal process

The DPDPA requires controllers to build an appeal path for consumers whose requests are denied. Under § 12D-104(d), a controller must establish a process for a consumer to appeal the controller's refusal to take action on a request. The appeal process must be conspicuously available and similar to the process for submitting the original request.

Within 60 days of receiving an appeal, the controller must inform the consumer in writing of any action taken or not taken in response, along with a written explanation of the reasons. If the controller denies the appeal, it must also provide the consumer with a way to contact the Delaware Department of Justice to submit a complaint.

That referral to the regulator is a practical backstop. A consumer who believes a controller wrongly denied a rights request can escalate the matter to the enforcer rather than relying only on the controller's internal review.

The universal opt-out mechanism, effective January 1, 2026

Delaware requires controllers to honor a browser-level or device-level opt-out signal. Under § 12D-106(e), not later than January 1, 2026, a controller that processes personal data for targeted advertising or sells personal data must allow consumers to opt out through an opt-out preference signal sent by a platform, technology, or mechanism, such as Global Privacy Control.

The universal opt-out mechanism lets a consumer set a single signal in their browser or device that automatically communicates an opt-out to every site they visit, rather than clicking an opt-out link on each one. As of 2026, this requirement is in force, so covered businesses must detect and respect the signal.

When the signal conflicts with a setting the consumer affirmatively chose, the law allows the controller to notify the consumer and let them confirm the conflicting choice, but the default is to treat a recognized signal as a valid opt-out.

Teen protections for ages 13 to 17

The DPDPA adds a protection for older minors that goes beyond the general opt-in for children's data. Under § 12D-106(a)(7), where a controller has actual knowledge, or willfully disregards, that a consumer is at least 13 but younger than 18 years of age, the controller may not process that consumer's personal data for purposes of targeted advertising, or sell that personal data, without the consumer's consent.

This shifts the default for the 13-to-17 age band from opt-out to opt-in for targeted advertising and sale. A business that knows a user is a teenager, or that ignores clear signs of it, cannot rely on the teen's failure to opt out. It must obtain affirmative consent first.

This is separate from the rule for known children under 13, whose sensitive data and personal data are governed by the consent requirements in § 12D-106(a)(4) and related federal children's privacy law.

Rights and deadlines at a glance

Related guides

• Delaware data privacy laws parent hub
• What is the DPDPA?
• DPDPA compliance checklist
• State data privacy law comparison
• What is the CCPA?

More Delaware Laws

• Delaware Deepfake Laws
• Delaware Employee Monitoring Laws
• Delaware GPS Tracking Laws
• Delaware Recording Laws

Frequently Asked Questions

What rights do Delaware consumers have under the DPDPA?

Under section 12D-104(a), Delaware consumers can confirm and access their personal data, correct inaccuracies (access and portability are each subject to the controller not having to reveal a trade secret), delete data provided by or obtained about them, obtain a portable copy, get a list of the categories of third parties to which the controller disclosed their data, and opt out of targeted advertising, the sale of personal data, and profiling that produces legal or similarly significant effects. These rights took effect January 1, 2025.

How long does a business have to respond to a DPDPA request?

Under section 12D-104(c)(1), a controller must respond without undue delay and not later than 45 days after receiving the request. The controller may extend that period by an additional 45 days when reasonably necessary, as long as it notifies the consumer of the extension and the reason within the first 45 days.

Can I find out who received my data under the DPDPA?

Yes, at the category level. Under section 12D-104(a)(5), a Delaware consumer may obtain a list of the categories of third parties to which the controller has disclosed the consumer's personal data, such as advertising networks or analytics vendors. Delaware discloses categories of recipients rather than every individually named company.

How do I opt out of targeted advertising or the sale of my data in Delaware?

Under section 12D-104(a)(6), you may submit an opt-out request to the controller for targeted advertising, the sale of personal data, and significant-effect profiling. As of January 1, 2026, under section 12D-106(e), controllers that run targeted advertising or sell data must also honor a universal opt-out preference signal such as Global Privacy Control sent automatically by your browser or device.

What is the universal opt-out mechanism in Delaware?

It is a browser or device signal, such as Global Privacy Control, that automatically tells every website you visit that you are opting out of targeted advertising and the sale of your data. Under section 12D-106(e), controllers must recognize this opt-out preference signal as of January 1, 2026, so you can set one signal instead of clicking an opt-out on each site.

Can I appeal if a business denies my DPDPA request?

Yes. Under section 12D-104(d), controllers must provide a conspicuous appeal process similar to the original request process. The controller must respond to an appeal within 60 days with a written explanation, and if it denies the appeal it must give you a way to submit a complaint to the Delaware Department of Justice.

Does the DPDPA protect teenagers?

Yes. Under section 12D-106(a)(7), where a controller has actual knowledge or willfully disregards that a consumer is at least 13 but younger than 18, it may not use that consumer's data for targeted advertising or sell the data without consent. This makes the default for 13-to-17-year-olds opt-in rather than opt-out for those activities.

Can I sue a business under the DPDPA?

No. Under section 12D-111(d), the DPDPA does not create a private right of action. Under section 12D-111(e), a violation of the chapter is deemed an unlawful practice under section 2513 of Title 6 and is enforced solely by the Delaware Department of Justice. Section 12D-111 itself sets no penalty amount. The civil penalty comes from the Consumer Fraud Act: under section 2522(b) of Title 6, the Attorney General may petition for a penalty of not more than $10,000 for each violation, but only where a court finds the violation was wilful, meaning the violator knew or should have known the conduct was of the nature prohibited. Consumers who believe their rights were violated can submit a complaint to the Department of Justice.