Privacy Law Library

Delaware Online Privacy and Protection Act

DOPPA

Children · Marketing · Other

Delaware's online privacy law has three parts: it bars marketing listed adult products (alcohol, tobacco, firearms, lottery, tattoos, sexually oriented material, and others) to children under 18 on child-directed services and restricts use of children's personal information for such marketing; it requires any commercial website or app collecting personal information from Delaware users to post a conspicuous privacy policy; and it limits disclosure of e-book and book-service user records.

Where
Delaware
Citation
6 Del. C. §§ 1201C to 1206C (Title 6, Chapter 12C)
Status
In force
In force since
2016-01-01
Last amended
2025-02-01
Enforced by
Consumer Protection Unit, Delaware Department of Justice (1203C)
People can sue
No
Penalties
Enforced by the Department of Justice under 29 Del. C. ch. 25, subch. II (1203C); the statute sets no specific penalty amount. A privacy-policy posting violation arises only if the policy is not made conspicuously available within 30 days after notice of noncompliance (1205C(a)).
Applies to
  • Operators of commercial websites, online or cloud services, and online or mobile apps that collect personally identifiable information from Delaware users (1205C)
  • Operators of sites or apps directed to children (under 18) or with actual knowledge a child is using them, and advertising services notified that a site is child-directed (1204C)
  • Commercial book service providers (primary purpose of renting, selling, lending, or displaying books electronically), excluding general retailers whose book sales are 2% or less of U.S. consumer product sales (1202C(5), 1206C)

What a privacy notice must say

  • The privacy policy must list categories of PII collected and third parties it is shared with, any review-and-correct process, how material changes are notified, its effective date, how the operator responds to Do Not Track signals, and whether other parties collect cross-site activity data.6 Del. C. § 1205C(b)
  • Operators that collect personally identifiable information from Delaware users must make a privacy policy conspicuously available on the site or app.6 Del. C. § 1205C(a)

Practices it requires

  • Operators of child-directed sites or apps may not market or advertise listed products or services (such as alcohol, tobacco, firearms, fireworks, tanning, lottery, tattoos, sexually oriented material) to users under 18.6 Del. C. § 1204C(a), (f)
  • Operators must follow their posted privacy policy; knowing and wilful, or negligent and material, noncompliance is a violation.6 Del. C. § 1205C(c)
  • Book service providers may not disclose user book-service information except to law enforcement by lawful process, by court order with notice and a 35-day chance for the user to quash, with the user's written consent, or in emergencies.6 Del. C. § 1206C(a)
  • Operators with actual knowledge a specific child is using the service may not target that child with ads for listed products based on the child's profile, activity, or location, and may not knowingly use or disclose the child's personal information for such marketing.6 Del. C. § 1204C(b)-(c)

Other duties

  • Book service providers that disclosed information on more than 30 users must publish an annual transparency report of demands and disclosures by March 31.6 Del. C. § 1206C(e) · Only if: Disclosures about more than 30 users in the prior year

Sources

Checked against these sources on 2026-09-25 by research agent (Claude), primary sources.

Unverified: 80 Del. Laws c. 335 also amended § 1204C; its date and content were not reviewed.

Research reference, not legal advice.