Delaware Personal Data Privacy Act and Delaware Online Privacy Rules

Delaware's Online and Personal Privacy Protection Act reaches operators of commercial websites, online services, apps, and mobile apps that collect personally identifiable information from Delaware consumers. It requires a conspicuously posted privacy policy and requires that policy to disclose key items such as the effective date, how the operator responds to web browser Do Not Track signals, and whether other parties may collect personally identifiable information about a user's online activities over time and across different sites, services, or applications.

That is already more specific than many generic privacy templates assume. A business can be focused on newer omnibus state laws and miss the older Delaware website disclosure requirements if the page never addresses browser settings, cross site collection, or the operator's own posting obligations clearly enough.

The Delaware Personal Data Privacy Act adds the now-familiar omnibus-law structure for covered businesses. The privacy notice has to describe the categories of personal data processed, the purposes for processing, how consumers exercise their rights, the categories of personal data shared with third parties, the categories of third parties, and whether personal data is sold or used for targeted advertising and how a consumer may opt out.

That means Delaware can change the page even for businesses that already thought they had a compliant website privacy policy. The older website disclosure law and the newer privacy act can both shape the same page, and the page has to carry both sets of information when both laws apply.

Delaware is one of the states where readability and accessibility move closer to the legal text instead of remaining design preferences. The Delaware Department of Justice explains that a covered notice should be reasonably accessible, easy to understand, and free from unnecessary legal or technical jargon. It also says the notice should be readable on smaller screens and available in the languages in which your business provides other consumer-facing materials such as contracts or sales announcements.

A privacy page can still fall short when the legal topics are technically present but the writing is dense or the page does not work well on smaller screens. Delaware brings that readability issue into the legal review.

The Delaware Personal Data Privacy Act is enforced by the Delaware Department of Justice. The statute also says the chapter may not serve as the basis for, or be subject to, a private right of action under Delaware law. Delaware is therefore a state enforcement and notice quality issue, and the article should be framed that way.

The strongest Delaware risk comes from the public page, the opt out path, the rights workflow, and your ability to support the disclosures it publishes.

A Delaware review should start with the older website operator disclosures and then move into the newer omnibus law requirements. The point is to make sure the page reflects both layers where they apply.