Law / United States / 
Delaware
Delaware Online Privacy and Protection Act: privacy policy posting and contents
Del. Code Ann. tit. 6, §§ 1202C, 1203C, 1205C
In force since .
A privacy notice rule binding private bodies.
- Obligation class
- Disclosure
- Audit expectation
- none
As of .
What it requires
- Make a privacy policy conspicuously available if your commercial website, online or cloud computing service, online application or mobile application collects personally identifiable information through the Internet (a first and last name, a physical address, an e-mail address, a telephone number, a Social Security number or any other identifier that permits physical or online contacting of the user) about users who reside in Delaware: post it on the homepage or first significant page, or link to it there with an icon or a text link that contains the word "privacy" or with another functional hyperlink a reasonable individual would notice; for a service that is not a website, any other reasonably accessible and visible means works.
- Identify in the policy the categories of personally identifiable information you collect through the service about its users and the categories of third-party persons with whom you may share it.
- If you maintain a process for a user to review and request changes to the user's personally identifiable information collected through the service, describe that process in the policy.
- Describe in the policy how you notify users of material changes to it, and identify its effective date.
- If you collect personally identifiable information about a user's online activities over time and across third-party websites, services or applications, disclose in the policy how you respond to web browser "do not track" signals or other mechanisms that let users choose; a clear and conspicuous hyperlink in the policy to a description, including the effects, of any program or protocol you follow that offers that choice satisfies this.
- Disclose in the policy whether other parties may collect personally identifiable information about a user's online activities over time and across different websites, services or applications when the user uses your service.
- Follow the section and your own posted privacy policy: a failure to comply is a violation when it is knowing and wilful, or negligent and material.
- Make a missing policy conspicuously available within 30 days after you are notified that it is missing.
- You are not an operator under the chapter if you only operate, host or manage a website, service or application on its owner's behalf, or process information on the owner's behalf, without owning it.
These lines are LexLint's reading of the law's text, as of .
If you get it wrong
Private right of actionNo
Penalty structure
Section 2522(b) of title 29 requires a court to order a person found to have committed a wilful violation, in a proceeding the Attorney General or the Director brings under section 2522(a), to pay the State a civil penalty of not more than $10,000 for each violation. Chapter 12C states no penalty of its own and names this subchapter for its enforcement in section 1203C.
- Rule
- Per violation only
- As of
- Currency
- USD
- Per violation unit
- Violation
- Per violation amount
- 10,000
Who enforces it
Enforcement body
Consumer Protection Unit of the Delaware Department of Justice, which has enforcement authority over the chapter and may investigate and prosecute violations in accordance with subchapter II of chapter 25 of title 29 (6 Del. C. section 1203C).
What this law does
An operator of a commercial internet website, online or cloud computing service, online application or mobile application that collects personally identifiable information through the Internet about individual users residing in Delaware must make its privacy policy conspicuously available on it. An operator is in violation of that duty only if it fails to make its privacy policy conspicuously available within 30 days after being notified of noncompliance.
Personally identifiable information means information about a user collected online by the operator from that user and maintained in an accessible form, including a first and last name, a physical address, an e-mail address, a telephone number, a Social Security number, or any other identifier that permits the physical or online contacting of the user.
An operator is a person who owns the website, service or application, and does not include a third party that operates, hosts or manages it on the owner's behalf, or processes information on the owner's behalf, without owning it. The policy must identify the categories of personally identifiable information the operator collects through the service and the categories of third-party persons with whom the operator may share that information.
The policy must describe any process the operator maintains for a user to review and request changes to the user's personally identifiable information, describe how the operator notifies users of material changes to the policy, and identify the policy's effective date.
The policy must disclose how the operator responds to web browser do not track signals or other mechanisms that let users choose whether personally identifiable information about their online activities over time and across third-party sites and services is collected, if the operator engages in that collection, and whether other parties may collect that information when a user uses the operator's service.
An operator that collects personally identifiable information from users who reside in Delaware is in violation of the section if it fails to comply with the section or with its posted privacy policy either knowingly and wilfully or negligently and materially. The Consumer Protection Unit of the Department of Justice has enforcement authority over the chapter and may investigate and prosecute violations in accordance with the provisions of subchapter II of chapter 25 of title 29.
Section 2522 of title 29, in the subchapter that the chapter names for its enforcement, provides that a person found in a court proceeding to have committed a wilful violation must be ordered to pay the State a civil penalty of not more than $10,000 for each violation.
When LexLint raises it
When your app profile says your app deploys a chatbot, sends automated outreach, operates a social platform, operates an app store, ships a mobile app or tracks devices.