Tracks devices, in Delaware

11 Del. C. §§ 2430-2434 · Read the law's page

• Do not install or use a pen register or a trap and trace device without first obtaining a court order under 11 Del. C. § 2433, unless you are a provider of wire or electronic communication service using one to operate, maintain or test your own service, to protect your rights, property or users from abuse or unlawful use, to record that a communication was initiated or completed to protect yourself, another provider, or a user from fraudulent, unlawful or abusive use, or with the consent of the user of that service; a device a provider or its customer uses for billing, or for cost accounting in the ordinary course of business, is not a pen register.

Del. Code Ann. tit. 6, § 1206C · Read the law's page

• If you offer a book service to the public (a service whose primary purpose is to let individuals rent, purchase, borrow, browse or view books electronically or via the Internet), do not knowingly disclose a user's book service information to a government entity, except as the exceptions in section 1206C(a)(1) to (6) allow; a business that sells a variety of consumer products is not a book service provider if its book service sales do not exceed 2 percent of its total annual gross sales of consumer products sold in the United States.
• Do not disclose a user's book service information to any person, private entity or government entity where you are compelled to disclose it, except as the exceptions in section 1206C(a)(1) to (6) allow.
• The bars do not stop a disclosure to a person with the user's informed, affirmative consent in writing to the specific disclosure to the specific person for a particular purpose.
• The bars do not stop a disclosure to a law-enforcement entity by any lawful method or process by which the entity is permitted to obtain the information, on the entity's assertion of imminent danger of death or serious physical injury where there is insufficient time to obtain a court order (a criminal matter then needs a search warrant application within 48 hours, and an oral assertion needs a written statement of the facts within 48 hours), or where you in good faith believe the information is evidence directly related and relevant to a crime against you or the user.
• Disclose a user's book service information to a governmental entity other than a law-enforcement entity only under a court order, and only if the entity gave you timely, reasonable written notice of the proceeding and you hold the information until you have given the user timely, reasonable written notice and the user has had at least 35 days to appear and quash the order.
• Disclose it to a person who is not a governmental entity under a court order only in a pending action brought by or against that person, and only if the court finds a compelling interest and that the information cannot be obtained by less intrusive means, you received reasonable notice of the proceeding, and you hold the information until you have given the user notice and the user has had at least 35 days to appear and quash the order.
• On the written request of a law-enforcement entity, preserve records and other evidence of a user's book service information related to the use of a book or part of a book for 90 days, extended for a further 90 days on a renewed written request.
• Unless disclosure is specifically prohibited by law, prepare a report of the warrants, subpoenas and court orders and the consent-based requests you received, and the disclosures you made, from January 1 to December 31 of the previous year, with the counts the section lists; you need not prepare a report unless you disclosed book service information of more than 30 total users located in Delaware or whose location is unknown, and the reporting duty does not apply to information disclosed to a governmental entity by a book service provider serving a postsecondary educational institution when it is required to disclose the information in order to be reimbursed for the sale or rental of a book that a student purchased or rented using book vouchers or other financial aid subsidies for books.
• Make the report publicly available in an online, searchable format on your website by March 31 of each year; without a website, post it prominently on your premises or send it, on paper and electronically, to the Consumer Protection Unit of the Department of Justice by that date.
• If you are a book service provider subject to section 1205C (you operate a commercial website, service or application that collects personally identifiable information about Delaware users), do one of the following on or before March 1 of each year: link to your latest report in the disclosure section of your privacy policy applicable to the book service, post the report on your website explaining how users' book service information and privacy issues are addressed, or state on your website that no report is available because you are exempt from the reporting requirement.

Del. Code Ann. tit. 6, §§ 1202C, 1203C, 1205C · Read the law's page

• Make a privacy policy conspicuously available if your commercial website, online or cloud computing service, online application or mobile application collects personally identifiable information through the Internet (a first and last name, a physical address, an e-mail address, a telephone number, a Social Security number or any other identifier that permits physical or online contacting of the user) about users who reside in Delaware: post it on the homepage or first significant page, or link to it there with an icon or a text link that contains the word "privacy" or with another functional hyperlink a reasonable individual would notice; for a service that is not a website, any other reasonably accessible and visible means works.
• Identify in the policy the categories of personally identifiable information you collect through the service about its users and the categories of third-party persons with whom you may share it.
• If you maintain a process for a user to review and request changes to the user's personally identifiable information collected through the service, describe that process in the policy.
• Describe in the policy how you notify users of material changes to it, and identify its effective date.
• If you collect personally identifiable information about a user's online activities over time and across third-party websites, services or applications, disclose in the policy how you respond to web browser "do not track" signals or other mechanisms that let users choose; a clear and conspicuous hyperlink in the policy to a description, including the effects, of any program or protocol you follow that offers that choice satisfies this.
• Disclose in the policy whether other parties may collect personally identifiable information about a user's online activities over time and across different websites, services or applications when the user uses your service.
• Follow the section and your own posted privacy policy: a failure to comply is a violation when it is knowing and wilful, or negligent and material.
• Make a missing policy conspicuously available within 30 days after you are notified that it is missing.
• You are not an operator under the chapter if you only operate, host or manage a website, service or application on its owner's behalf, or process information on the owner's behalf, without owning it.

Del. Code Ann. tit. 6, section 12B-100 · Read the law's page

• Implement and maintain reasonable procedures and practices to prevent the unauthorized acquisition, use, modification, disclosure, or destruction of that personal information, collected or maintained in the regular course of business.
• This binds any person, including a government entity, that conducts business in Delaware and owns, licenses, or maintains personal information of a Delaware resident.
• There is no separate compliance runway to build against: the duty has been in force since April 14, 2018, when 81 Del. Laws, c. 129, section 1 took effect 240 days after its August 17, 2017 approval.
• Expect enforcement only from the Delaware Attorney General, through the Director of Consumer Protection, seeking to address a violation and to recover direct economic damages; the chapter does not itself state whether a private plaintiff may also sue.