Law / United States / 
Delaware
Delaware Personal Data Privacy Act, consent for minors' data
Del. Code tit. 6, ch. 12D, Secs. 12D-101 to 12D-111
In force since .
A social media and minors rule binding private bodies.
- Private right of action
- No
- Age threshold
- 18
- How the hook was established
- express
- What makes it apply
- Operator establishment, Market targeting
- Verification methods
- Parental consent, Self declaration
- Audit expectation
- none
What it requires
- If you are a controller subject to the Delaware Personal Data Privacy Act, the consent rules below apply where you have actual knowledge, or wilfully disregard, that a consumer is a child or is at least 13 but younger than 18.
- Until , obtain consent from a known child's parent or lawful guardian before processing sensitive data concerning the child, a category that includes the child's personal data.
- From , obtain consent from the parent or lawful guardian before processing any personal data of a consumer you know, or wilfully disregard, is a child.
- Until , obtain the consent of a consumer who is at least 13 but younger than 18 before processing that consumer's personal data for targeted advertising or selling it.
- From , obtain the consent of a consumer who is at least 13 but younger than 18 before processing personal data for any purpose in section 12D-104(a)(6): targeted advertising, sale, or profiling in furtherance of automated decisions with legal or similarly significant effects.
These lines are LexLint's reading of the law's text. Also read by: Delaware Department of Justice (guidance, recorded ).
In the frameworks
- NIST Privacy Framework
- CT.PO-P1Policies, processes, and procedures for authorizing data processing (e.g., organizational decisions, individual consent), revoking authorizations, and maintaining authorizations are established and in place.
Our reading of where this law's duties sit in each framework. It never says that running a control meets the law. How we read a framework against the law
Who enforces it
Enforcement body
Delaware Attorney General
Settledness
- As of
- Guidance link
- https://attorneygeneral.delaware.gov/fraud/personal-data-privacy-portal/frequently-asked-questions/
- Guidance body
- Delaware Department of Justice
- Open questions
- What conduct amounts to a controller that 'wilfully disregards' that a consumer is at least 13 years of age but younger than 18 years of age under Del. Code tit. 6, section 12D-106, as distinct from having 'actual knowledge' of it?
- Does the opt-in consent that the Department's FAQ describes for a consumer 'under 18 years old' before a controller sells personal data or processes it for targeted advertising reach a consumer younger than 13, or does the parental consent rule for a known child in section 12D-106 govern that consumer alone?
What it makes you log
Logging duty
The minors consent rules in sections 12D-104(a)(6) and 12D-106 require consent before processing and name no log or record of it. The chapter-wide data protection assessment duty and the Attorney General access to assessments are in section 12D-108, which is not about minors and is not coded to this row.
- Kind
- None
- As of
What this law does
A child is a child as defined in the federal Children's Online Privacy Protection Act. Until , a controller may not process sensitive data concerning a known child without first obtaining consent from the child's parent or lawful guardian. Sensitive data includes the personal data of a known child.
Until , a controller may not process a consumer's personal data for targeted advertising, or sell it, without the consumer's consent where the controller has actual knowledge or wilfully disregards that the consumer is at least 13 years of age but younger than 18. From , a controller may not process any personal data of a consumer it has actual knowledge, or wilfully disregards, is a child without first obtaining consent from the child's parent or lawful guardian.
From , the same consent rule for a consumer at least 13 but younger than 18 covers every purpose listed in section 12D-104(a)(6). Those purposes are targeted advertising, the sale of personal data, and profiling in furtherance of automated decisions that produce legal or similarly significant effects.
Until , the Act applies to a person that controlled or processed the personal data of not less than 35,000 consumers in the preceding calendar year, or not less than 10,000 consumers while deriving more than 20% of gross revenue from the sale of personal data. From , those thresholds are 10,000 consumers, and 5,000 consumers where more than 20% of gross revenue comes from the sale of personal data.
House Bill 380 of the 153rd General Assembly was signed on . The amending act, chapter 463 of volume 85 of the Laws of Delaware, takes effect on .
When LexLint raises it
When your app profile says your app serves under-18s.
Back to the example · Lint your app
Page updated .