Serves under-18s, in Delaware

Del. Code Ann. tit. 6, § 1204C · Read the law's page

• If your website, online or cloud computing service, online application or mobile application is directed to children (targeted or intended to reach an audience composed predominantly of individuals under 18 who reside in Delaware), do not market or advertise on it any product or service listed in section 1204C(f), among them alcoholic liquor, tobacco products, tobacco substitutes, firearms and ammunition, fireworks, tanning equipment, lottery and internet gaming, tattoos, body piercing, drug paraphernalia and certain sexually oriented material that appeals to the prurient interest of minors.
• Whatever your audience, if you have actual knowledge that a child is using your service, do not market or advertise a listed product or service to that child when the marketing is directed to the child based upon information specific to that child, including the child's profile, activity, address or location sufficient to establish contact (but not an IP address or product identification numbers for the operation of a service); reasonable actions in good faith designed to avoid it count as compliance.
• If your service is directed to children, or you have actual knowledge that a child is using it, do not knowingly use, disclose or compile a child's personal information, or allow another person to, if you have actual knowledge that the child's personally identifiable information will be used to market or advertise a listed product or service to the child.
• If your service is directed to children and an advertising service provides its marketing or advertising, notify that advertising service, in the manner it directs, that your service is directed to children; you then need not comply with the marketing bar for that advertising.
• If you run an advertising service and an operator has notified you that its service is directed to children, do not market or advertise a listed product or service on that service.
• You are not required to collect age information about users, and the marketing bar does not apply to the incidental placement of products or services embedded in content that is not distributed by or at your direction primarily to market or advertise a listed product or service.

Del. Code Ann. tit. 6, section 12B-100 · Read the law's page

• Implement and maintain reasonable procedures and practices to prevent the unauthorized acquisition, use, modification, disclosure, or destruction of that personal information, collected or maintained in the regular course of business.
• This binds any person, including a government entity, that conducts business in Delaware and owns, licenses, or maintains personal information of a Delaware resident.
• There is no separate compliance runway to build against: the duty has been in force since April 14, 2018, when 81 Del. Laws, c. 129, section 1 took effect 240 days after its August 17, 2017 approval.
• Expect enforcement only from the Delaware Attorney General, through the Director of Consumer Protection, seeking to address a violation and to recover direct economic damages; the chapter does not itself state whether a private plaintiff may also sue.

Del. Code tit. 6, ch. 12D, Secs. 12D-101 to 12D-111 · Read the law's page

• If you are a controller subject to the Delaware Personal Data Privacy Act, the consent rules below apply where you have actual knowledge, or wilfully disregard, that a consumer is a child or is at least 13 but younger than 18.
• Until December 31, 2026, obtain consent from a known child's parent or lawful guardian before processing sensitive data concerning the child, a category that includes the child's personal data.
• From January 1, 2027, obtain consent from the parent or lawful guardian before processing any personal data of a consumer you know, or wilfully disregard, is a child.
• Until December 31, 2026, obtain the consent of a consumer who is at least 13 but younger than 18 before processing that consumer's personal data for targeted advertising or selling it.
• From January 1, 2027, obtain the consent of a consumer who is at least 13 but younger than 18 before processing personal data for any purpose in section 12D-104(a)(6): targeted advertising, sale, or profiling in furtherance of automated decisions with legal or similarly significant effects.