Delaware Site Laws Report: Laws, Updates, and Information That May Affect Your Website

Why Delaware Site Laws Punch Above the State’s Size

Delaware is the second smallest state by area and the sixth smallest by population, yet more than two thirds of Fortune 500 companies are incorporated there, and the state’s courts and regulators carry national weight. On privacy, the General Assembly moved early. The Delaware Online Privacy and Protection Act took effect on January 1, 2016, years before most states required websites to post a privacy policy, and the Delaware Personal Data Privacy Act, signed September 11, 2023, made Delaware the twelfth state with a comprehensive privacy law when the Act took effect on January 1, 2025.

For you, the practical result is that Delaware site laws come in three layers. The Personal Data Privacy Act forms the top layer, and the threshold, which drops sharply on January 1, 2027, decides whether that layer applies. A second layer, made up of the website privacy policy statute, the breach notification law, and the Consumer Fraud Act, applies to nearly every business regardless of size. A third layer of tax rules works differently from every state covered so far in this series, because Delaware has no sales tax at all. The sections below walk through each layer so you can see exactly where your site stands.

The Delaware Personal Data Privacy Act Today

The centerpiece of Delaware site laws, the Delaware Personal Data Privacy Act codified at 6 Del. C. Chapter 12D, applies to any person who conducts business in Delaware or targets Delaware residents and, in the preceding calendar year, controlled or processed the personal data of 35,000 or more consumers, excluding data processed solely to complete a payment transaction, or controlled or processed the personal data of 10,000 or more consumers while deriving more than 20 percent of gross revenue from selling personal data. 

Unlike most state laws, the Act does not exempt nonprofits or institutions of higher education, and the exemption for financial institutions applies only to data regulated under the Gramm-Leach-Bliley Act rather than to the whole entity.

If you cross a threshold under this part of Delaware site laws, you must post a compliant privacy notice, honor requests to access, correct, delete, and port data, provide a list of the categories of third parties to whom you disclosed personal data, allow opt outs of targeted advertising, sales, and profiling, obtain consent before processing sensitive data, and conduct data protection assessments for high risk processing. Since January 1, 2026, you must also honor universal opt out signals such as Global Privacy Control. 

Delaware bars processing the data of a consumer you know is under 18 for targeted advertising or sale without consent, which is a higher age than the 13 or 16 used in most states. The Attorney General enforces the law, the 60 day cure period expired on December 31, 2025, and there is no private right of action.

What Changes on January 1, 2027: House Bill 380

The biggest change to Delaware site laws in years is House Bill 380, sponsored by Representative Krista Griffith and Senator Marie Pinkney, which passed the House in May 2026 and was signed by Governor Meyer on September 2, 2026. Effective January 1, 2027, the Act will apply to any business that controls or processes the personal data of 10,000 or more consumers, down from 35,000, or 5,000 or more consumers while earning more than 20 percent of revenue from data sales, down from 10,000. 

State officials called the result the lowest applicability threshold among comprehensive state privacy laws. A regional eCommerce store, a membership site, or a service business with a modest email list can cross 10,000 Delaware consumers without noticing.

The amendment also expands sensitive data to include national origin, citizenship or immigration status, diagnosis or treatment status, gender identity, neural data, financial account numbers and login credentials, and government issued identification numbers, along with inferences drawn from personal data that reveal any of those categories. 

Selling sensitive data is prohibited unless the consumer specifically requests the sale or the sale is necessary to provide the service, and before disclosing sensitive data to a third party you must give clear notice of the categories disclosed, the purpose, and the identity of each recipient. The bill adds contracting and due diligence duties for any sale or disclosure of personal data, imposes direct obligations on third party recipients, and broadens the right to opt out of profiling used in automated decisions with legal or similarly significant effects, such as loan, housing, and hiring decisions.

For your website, the practical lesson is to count Delaware consumers now rather than in December. If you are anywhere near 10,000, the notice, consent, and consumer request systems you need take months to build, and the cure period is already gone. Businesses that sell or share data with advertising partners should map every recipient and prepare the new third party disclosure before January 1, 2027.

The Website Privacy Policy Law Every Commercial Site Must Follow

Long before the comprehensive privacy law, Delaware site laws required websites to explain their data practices. The Delaware Online Privacy and Protection Act, codified at 6 Del. C. 1201C through 1206C and effective January 1, 2016, requires any operator of a commercial internet website, online service, or mobile application that collects personally identifiable information from Delaware residents to conspicuously post a privacy policy. 

That policy must identify the categories of personal information you collect, the categories of third parties with whom you share that data, describe any process for reviewing and requesting changes to that data, explain how you notify users of policy changes, disclose whether third parties may collect information across sites, and state how you respond to browser do not track signals.

This piece of Delaware site laws has no size threshold, so a one person consulting site with a contact form is covered just as a national retailer is. The same Act prohibits operators of sites directed at children from marketing alcohol, tobacco, firearms, tanning services, tattoos, and other listed products to users under 18, and bars advertising those products based on a known minor’s personal information. 

A third part of the Act restricts book service providers from disclosing what readers have read or browsed. The Attorney General enforces the Act under the Consumer Fraud Act, and a privacy policy that omits the required elements is the most common Delaware violation I see in site audits.

Breach Notification After House Bill 381

Delaware site laws on data breaches center on the statute at 6 Del. C. 12B-101 through 12B-104 applies to any person who conducts business in Delaware and owns, licenses, or maintains computerized personal information. Personal information means a first name or initial plus last name combined with a Social Security number, driver’s license or state ID number, account or card number with any required access code, passport number, a username or email address with a password or security question, medical history or treatment information, health insurance information, biometric data, or an individual taxpayer identification number.

If unencrypted personal information was or is reasonably believed to have been acquired by an unauthorized person and misuse is reasonably likely, you must notify affected residents without unreasonable delay and no later than 60 days after determining that a breach occurred. 

Before House Bill 381, you also had to notify the Delaware Attorney General only when more than 500 residents were affected. House Bill 381, signed September 2, 2026, and effective on signing, now requires notice to the Delaware Department of Justice within 60 days of determining that a breach occurred, regardless of whether you have confirmed that Delaware residents were affected. If Social Security numbers were involved, you must offer at least one year of credit monitoring at no cost. A separate provision, 6 Del. C. 12B-100, requires you to implement and maintain reasonable procedures to protect personal information, and violations are enforceable by the Attorney General.

The Consumer Fraud Act and Your Online Store

Delaware polices advertising and sales through the Consumer Fraud Act at 6 Del. C. 2511 through 2527 and the Deceptive Trade Practices Act at 6 Del. C. 2531 through 2536. The Consumer Fraud Act prohibits any deception, fraud, false pretense, misrepresentation, or concealment of a material fact in connection with the sale or advertisement of merchandise, and the Attorney General’s Consumer Protection Unit enforces the statute with civil penalties of up to $10,000 per willful violation. Consumers may sue for actual damages, and the Deceptive Trade Practices Act allows treble damages for willful conduct.

For your site, this is the part of Delaware site laws behind the everyday rules. Reference prices that were never charged, timers that reset on every visit, subscription trials that convert without clear disclosure, fees revealed only at checkout, and staff written testimonials all create exposure. Delaware’s automatic renewal provisions at 6 Del. C. 2601 and following sections require clear disclosure of automatic renewal terms in consumer contracts. Treating every product page, pricing table, and review section as regulated advertising is the habit that keeps you clear of both state and federal complaints.

Delaware Site Laws for eCommerce: No Sales Tax, but a Gross Receipts Tax

Delaware is one of five states with no sales tax and one of only two, with Oregon, that has no local sales tax either, so you never collect sales tax on orders shipped to Delaware addresses and Delaware has no economic nexus law or marketplace facilitator law. The state instead imposes a gross receipts tax on the seller, which is a tax on total revenue from goods sold and services rendered in Delaware with no deduction for costs. Rates vary by business activity, and retailers pay roughly 0.7468 percent of gross receipts above a monthly exclusion of $100,000, or $300,000 for quarterly filers.

Under Delaware site laws for sellers, the gross receipts tax applies to businesses with physical presence or activity in Delaware, and the Division of Revenue has not extended the tax to remote sellers whose only contact with the state is shipping orders to Delaware customers. If you have a warehouse, employees, or regular in person sales in Delaware, you must obtain a Delaware business license, which costs $75 for most retailers, and file gross receipts returns. 

If you sell only online from another state, your Delaware tax obligations are usually limited to any franchise tax and annual report for a Delaware corporation or LLC you may have formed, which is a corporate obligation rather than a site obligation.

Chatbots, Minors, and the 2026 Session

The 153rd General Assembly, which adjourned on June 30, 2026, took up several bills that touch websites beyond privacy. House Bill 306, sponsored by Representative Romer, passed the House on May 5, 2026, and would make engaging in a commercial transaction through a chatbot or avatar an unlawful practice unless you tell the consumer they are communicating with a computer, with a safe harbor for a clear statement at the start of each session and a private right of action. 

House Bill 326 would create a felony for theft by impersonating a family member, a response to AI voice cloning scams. As of this update, HB 306 has not been signed into law, so check the bill’s status before treating chatbot disclosure as a legal requirement in Delaware, although disclosure is already a best practice and may be required under the Consumer Fraud Act if a chatbot could mislead a customer.

On minors, Governor Meyer signed Senate Bills 142 and 143 in 2025, which increase safeguards against exploitation and support parental access to a deceased child’s digital accounts. Delaware has not enacted a general age verification mandate for adult content websites, a social media age law, or an age appropriate design code, so a typical business site is not forced into age gating. The Personal Data Privacy Act’s rule against targeted advertising to known users under 18 without consent remains the main minors’ protection. Federal COPPA rules still apply if your site is directed at children under 13.

What You Should Do Now

You do not need a compliance department to satisfy Delaware site laws, but you do need a short list of concrete tasks that reflect the September 2, 2026 amendments and the rules already in force. Each step below addresses a current or scheduled obligation, and each also positions you well for the January 1, 2027 threshold change.

1. Count the Delaware consumers whose data you controlled or processed in 2025 and so far in 2026, and if you are near 10,000, begin building the privacy notice, consent flows, and consumer request systems the Personal Data Privacy Act requires.
2. Audit your privacy policy against the six required elements of the Delaware Online Privacy and Protection Act, including your response to do not track signals.
3. Map every place you store personal information, confirm encryption, and update your breach plan so the Delaware Department of Justice receives notice within 60 days of any breach determination.
4. Review pricing displays, subscription flows, and reviews against the Consumer Fraud Act and FTC guidance.
5. Add a clear disclosure at the start of any chatbot session, and map every third party that receives personal data ahead of the new disclosure and contracting duties.

Once those tasks are done, you will be current on every one of the Delaware site laws covered in this report, so put January 1, 2027, on your calendar for the House Bill 380 effective date, and plan a second check when the 154th General Assembly convenes in January 2027. Representative Griffith has said the privacy law took two sessions to pass and three years to strengthen, so further amendments are likely.

Key Takeaways

• The Delaware Personal Data Privacy Act applies today at 35,000 consumers, or 10,000 with data sales, and on January 1, 2027, drops to 10,000, or 5,000 with data sales, under HB 380 signed September 2, 2026.
• The Delaware Online Privacy and Protection Act has required a privacy policy on every commercial website collecting personal information since January 1, 2016.
• Breach notices are due within 60 days, and HB 381 now requires notice to the Department of Justice within 60 days of any breach determination.
• Delaware has no sales tax and no economic nexus law; businesses with physical activity in the state pay a gross receipts tax instead.
• HB 306, a chatbot disclosure bill, passed the House on May 5, 2026, but has not been enacted as of this update.

Frequently Asked Questions About Delaware Site Laws

Does the Delaware Personal Data Privacy Act apply to my small business?

Today, only if you conduct business in Delaware or target Delaware residents and processed the personal data of 35,000 or more consumers, or 10,000 or more while earning more than 20 percent of revenue from data sales. Beginning January 1, 2027, those figures fall to 10,000 and 5,000, which will cover many small businesses.

Do Delaware site laws apply to my business if I am located in another state?

Yes, in most cases. The privacy law reaches any business that targets Delaware residents and meets a threshold, the website privacy policy law covers any commercial site collecting personal information from Delaware residents, the breach statute covers anyone holding Delaware residents’ data, and the Consumer Fraud Act reaches sales to Delaware residents.

Do Delaware site laws require age verification on my website?

No. Delaware has no general age verification mandate, social media age law, or design code. The Personal Data Privacy Act bars targeted advertising to users you know are under 18 without consent, and federal COPPA rules apply if your site is directed at children under 13.

Do Delaware site laws require me to collect sales tax on orders shipped to Delaware?

No. Delaware has no state or local sales tax and no economic nexus law for remote sellers. Businesses with physical presence or activity in Delaware pay a gross receipts tax on revenue instead.

Do Delaware site laws require me to disclose AI chatbots on my website?

Not yet by statute. House Bill 306, which would require a disclosure that the consumer is communicating with a computer, passed the House on May 5, 2026, but has not been enacted as of this update. A disclosure at the start of each session is already a best practice and reduces risk under the Consumer Fraud Act.

Conclusion

Delaware site laws in 2026 reward the owner who counts customers early. The Personal Data Privacy Act reaches 35,000 consumers today and will reach 10,000 on January 1, 2027, under House Bill 380, which Governor Meyer signed on September 2, 2026, alongside House Bill 381’s tighter breach reporting. 

The Delaware Online Privacy and Protection Act has required a privacy policy on every commercial site since 2016, the 60 day breach statute and the Consumer Fraud Act apply regardless of size, and the absence of a sales tax replaces collection with a gross receipts tax for businesses with a physical footprint. The chatbot disclosure bill remains unfinished. Finish the five tasks above this fall and you will meet every current requirement while staying ready for the lowest privacy threshold in the country.

Updates

NEWEST UPDATE

10/17/2026: Delaware Computer Security Breach Notification Law — House Bill 381 (85 Del. Laws, ch. 464)

Status: Effective

Delaware’s breach-notice amendment is in effect, but its Attorney General notice requirement is narrower than a blanket notice rule for every incident. House Bill 381 requires an entity that is otherwise required to notify residents, but cannot through reasonable diligence identify within 60 days which Delaware residents’ information was involved, to notify the Attorney General within 60 days of determining the breach, unless substitute notice applies. The preexisting rule still requires Attorney General notice when more than 500 Delaware residents must be notified. Businesses should update incident-response procedures to evaluate both triggers, document resident-identification efforts, and continue resident notice without unreasonable delay and generally within 60 days where notice is required.

Sources: Official or supporting source | Official or supporting source | Official or supporting source

PRIOR UPDATE

09/21/2026: House Bill 381 / Delaware Computer Security Breaches Law

Status: Effective

House Bill 381 took effect on September 2, 2026, but its Attorney General reporting change is narrower than a universal breach-reporting rule. The amendment requires notice to the Attorney General within 60 days after a breach determination when a business, despite reasonable diligence, cannot identify within that period whether particular Delaware residents’ personal information was included. It also adds Attorney General notice to the substitute-notice provisions. The statute’s existing rule requiring Attorney General notice when more than 500 Delaware residents must be notified otherwise remains in place. Website operators and online businesses should therefore update incident-response procedures to preserve the 60-day resident-notification deadline, the over-500-resident Attorney General trigger, and the new Attorney General notice requirement for breaches with unresolved Delaware-resident identification.

Sources: Official or supporting source | Official or supporting source | Official or supporting source

PRIOR UPDATE

09/21/2026: Delaware Personal Data Privacy Act amendments (House Bill 380) and Computer Security Breach amendments (House Bill 381)

Status: Effective

Delaware’s enacted 2026 amendments warrant two clarifications for online businesses. Effective January 1, 2027, House Bill 380 applies the Delaware Personal Data Privacy Act at 10,000 Delaware consumers, or 5,000 consumers when more than 20% of gross revenue comes from selling personal data. It also requires qualifying controllers to use specified third-party contracts and reasonable due diligence, lowers the general data-protection-assessment trigger from 100,000 to 50,000 consumers, and adds profiling-related assessment requirements. The heightened notice, consent, five-year recordkeeping, and necessity conditions for sensitive data apply to a sale of sensitive data; they do not by their terms apply to every third-party disclosure. House Bill 381, effective September 2, 2026, adds Attorney General notice within 60 days when a business cannot reasonably identify affected Delaware residents within that period; the separate notice requirement when more than 500 Delaware residents must be notified remains in the breach statute.

Sources: Official or supporting source | Official or supporting source | Official or supporting source | Official or supporting source | Official or supporting source

PRIOR UPDATE

09/21/2026: Delaware Personal Data Privacy Act (HB 380 / 85 Del. Laws, c. 463)

Status: Amended

Effective January 1, 2027, the Delaware Personal Data Privacy Act will cover not only controllers meeting the 10,000-consumer or 5,000-consumer/data-sale thresholds, but also third parties that acquire personal data from a controller. A third party that receives data without the contract required by the Act may not further process it and must comply with required contract terms. Controllers disclosing data to third parties—including for targeted advertising—must use binding agreements and conduct documented due diligence. For sales of sensitive data, disclosure must be strictly necessary for a product or service affirmatively requested by the consumer; the controller must give specified pre-sale notice, obtain consent, and retain consent records for five years. Website businesses should identify data recipients and revisit advertising, analytics, and data-sharing contracts before the effective date.

Sources: Official or supporting source | Official or supporting source