Delaware Governor John Carney has signed the Delaware Personal Data Privacy Act (DPDPA), or House Bill 154, into law, making Delaware the 13th state to enact a comprehensive privacy law, joining California, Virginia, Colorado, Connecticut, Utah, Iowa, Indiana, Tennessee, Montana, Florida, Texas, and Oregon.

The law does not provide consumers with a private right of action, similar to most other states, and enforcement is entirely in the hands of the Delaware Department of Justice (DOJ). The law will take effect on January 01, 2025, with a DOJ outreach period beginning July 01, 2024, to inform consumers and businesses.

Delaware’s law is broader in scope than other states; it applies to companies doing business in Delaware that control the data of at least 35,000 consumers or derive 20% of gross revenues from the sale of personal data of 10,000 consumers. In comparison, Virginia’s CDPA applies to businesses that control the data of at least 100,000 residents or derive 50% of revenue from the sale of 50,000 residents.

The requirements and consumer rights under the DPDPA are similar to other US state privacy laws. Consumers are granted the right to know whether businesses possess their personal data, to correct inaccuracies, to request deletion, to obtain a copy of their data, and to obtain a list of all third parties that have access to the data. The law also allows consumers to opt out of targeted advertising.