Ships a mobile app, in Delaware

Del. Code Ann. tit. 6, §§ 1202C, 1203C, 1205C · Read the law's page

• Make a privacy policy conspicuously available if your commercial website, online or cloud computing service, online application or mobile application collects personally identifiable information through the Internet (a first and last name, a physical address, an e-mail address, a telephone number, a Social Security number or any other identifier that permits physical or online contacting of the user) about users who reside in Delaware: post it on the homepage or first significant page, or link to it there with an icon or a text link that contains the word "privacy" or with another functional hyperlink a reasonable individual would notice; for a service that is not a website, any other reasonably accessible and visible means works.
• Identify in the policy the categories of personally identifiable information you collect through the service about its users and the categories of third-party persons with whom you may share it.
• If you maintain a process for a user to review and request changes to the user's personally identifiable information collected through the service, describe that process in the policy.
• Describe in the policy how you notify users of material changes to it, and identify its effective date.
• If you collect personally identifiable information about a user's online activities over time and across third-party websites, services or applications, disclose in the policy how you respond to web browser "do not track" signals or other mechanisms that let users choose; a clear and conspicuous hyperlink in the policy to a description, including the effects, of any program or protocol you follow that offers that choice satisfies this.
• Disclose in the policy whether other parties may collect personally identifiable information about a user's online activities over time and across different websites, services or applications when the user uses your service.
• Follow the section and your own posted privacy policy: a failure to comply is a violation when it is knowing and wilful, or negligent and material.
• Make a missing policy conspicuously available within 30 days after you are notified that it is missing.
• You are not an operator under the chapter if you only operate, host or manage a website, service or application on its owner's behalf, or process information on the owner's behalf, without owning it.

Del. Code Ann. tit. 6, section 12B-100 · Read the law's page

• Implement and maintain reasonable procedures and practices to prevent the unauthorized acquisition, use, modification, disclosure, or destruction of that personal information, collected or maintained in the regular course of business.
• This binds any person, including a government entity, that conducts business in Delaware and owns, licenses, or maintains personal information of a Delaware resident.
• There is no separate compliance runway to build against: the duty has been in force since April 14, 2018, when 81 Del. Laws, c. 129, section 1 took effect 240 days after its August 17, 2017 approval.
• Expect enforcement only from the Delaware Attorney General, through the Director of Consumer Protection, seeking to address a violation and to recover direct economic damages; the chapter does not itself state whether a private plaintiff may also sue.