Delaware

Delaware's "visual depiction" definition, which governs dealing in child sexual abuse material (a class B or class D felony under sec. 1109) and possession of it (a class F felony under sec. 1111), expressly includes "any picture, or computer-generated image or picture, or any other image whether made, stored or produced by electronic, digital, mechanical or other means".

Delaware's "child" definition for these offenses separately extends to any individual the defendant intends to appear 14 years of age or younger. Neither offense requires an actual identifiable child, so a wholly AI-generated depiction is reached on the same terms as a photograph.

Possession under sec. 1111(2) separately reaches any visual depiction "created, adapted, modified or edited so as to appear" that a child is engaged in a prohibited sexual act, covering an AI-altered image built from a real photograph.

House Bill 191's progress status on the General Assembly's own bill tracker reads Signed 4/23/26. It amended Title 24 to add that a nonhuman entity, including an agent powered by artificial intelligence, may not be certified to practice medicine under sec. 1720(k). It may not be licensed as a physician associate under sec. 1773(d). It may not be licensed to practice professional nursing, as an advanced practice registered nurse, or as a practical nurse under sec. 1920(h).

The same sections separately bar such a nonhuman entity or AI agent from using the physician titles Doctor, Dr., Physician, surgeon, Medical doctor, MD, Doctor of osteopathy, and DO under sec. 1720(l). They bar it from using the title physician associate or the abbreviation PA under sec. 1773(d).

They bar it from using the nursing titles Advanced Practice Registered Nurse or APRN, Certified Registered Nurse Anesthetist or CRNA, Clinical Nurse Specialist or CNS, Certified Nurse Practitioner or CNP, Certified Nurse Midwife or CNM, Nurse, Registered Nurse or RN, Licensed Practical Nurse or LPN, and Doctor or Dr. under sec. 1920(i).

A person who practices or attempts to practice medicine contrary to Chapter 17, which reaches the sec. 1720(k)-(l) bar, is guilty of a class F felony under sec. 1766(a), fined not less than $1,000 nor more than $5,000 and imprisoned not more than 3 years, or both. A violation of Chapter 17 for which no other penalty is specified is a class B misdemeanor under sec. 1766(c).

Representing a nonhuman entity as a physician associate contrary to Subchapter VI is separately fined not less than $500 nor more than $2,000 or imprisoned not more than 1 year, or both, under sec. 1774B(b). Using a protected nursing title or abbreviation for an entity not licensed under Chapter 19 is fined not more than $1,000, or imprisoned not more than 1 year, or both, under sec. 1925.

House Bill 353, known as the Amelia Kramer Act and signed October 9, 2024, extended Delaware's existing non-consensual intimate-image regime to a "deep fake," defined as synthetic media created or intentionally manipulated with generative adversarial network techniques or other digital technology that appears to a reasonable person to depict a real individual doing or saying something that did not occur.

Under the criminal offense at Title 11, sec. 1335(a)(9), knowingly disseminating a nonconsensual deep fake or intimate visual depiction of an identifiable person is a class A misdemeanor, elevated to a class G felony where an aggravating factor is proven; sec. 1335(a)(9)g. specifically dispenses with any need to prove the depicted person had a reasonable expectation of privacy where the image is a deep fake.

The parallel civil chapter at Title 10, ch. 78 gives a depicted individual a cause of action against a person who knew or acted with reckless disregard in disseminating or threatening to disseminate the deep fake without consent.

House Bill 316 added this Title 15 provision, approved October 9, 2024. It makes it unlawful for a person to distribute, or contract to distribute, a deep fake depicting a candidate or political party within 90 days of an election, without the depicted individual's consent, if the person knows or reasonably should know the item is a deep fake.

Distribution is not a violation if the synthetic media carries a specified on-screen or spoken disclosure that it has been altered or artificially generated, or if it falls within the exceptions for a bona fide newscast, a news website or periodical that flags the media as inaccurate, or satire or parody; a further exception for a paid broadcaster meeting good-faith verification conditions was itself repealed by its own one-year sunset clause and no longer appears in the current code.

A depicted candidate may bring an expedited action for injunctive relief, damages, and attorney's fees in the Court of Chancery. A violation is a class B misdemeanor, elevated to a class A misdemeanor if committed with intent to cause violence or bodily harm, or on a repeat violation within 5 years.

Notice of a breach of security must be made without unreasonable delay and no later than 60 days after determination of the breach, except in specified situations. If the number of affected Delaware residents exceeds 500, the person required to provide notice must also notify the Attorney General by the time notice is provided to residents. This provision is in force under the current codified text; no dated original commencement is established, so no effective date is recorded here.

DPDPA governs private-sector processing of Delaware consumers' personal data. It is codified at Del. Code Ann. tit. 6, ch. 12D; Chapter 12C, sometimes cited for the DPDPA, is a different Delaware statute. Enacted as H.B. 154, 152nd General Assembly, effective January 1, 2025. Controller duties are allocated at sections 12D-104 through 12D-108 and processor duties at section 12D-109.

H.B. 380 (153rd General Assembly), which would extend the Act to employee, applicant, and contractor data used in consequential employment decisions and lower applicability thresholds, passed the General Assembly on June 16, 2026 but its gubernatorial signature status was unconfirmed as of the date shown; it is not recorded as its own instrument pending that confirmation.

DPDPA gives a Delaware consumer the right to confirm processing, access, correct, delete, obtain a portable copy, and opt out of targeted advertising, sale, and profiling in furtherance of solely-automated decisions with legal or similarly significant effects. A controller must respond without undue delay and no later than 45 days after receipt, with one 45-day extension available.

The Delaware Department of Justice has authority to enforce DPDPA; a violation is deemed an unlawful practice under the Delaware Consumer Fraud Act, Del. Code tit. 6, section 2513, and is enforced solely by the Department of Justice. A cure notice was mandatory through December 31, 2025; from January 1, 2026 the Department may consider listed factors in deciding whether to offer a cure. The chapter creates no private right of action.

DPDPA classifies data revealing racial or ethnic origin, religious beliefs, mental or physical health condition or diagnosis (including pregnancy), sex life, sexual orientation, transgender or nonbinary status, citizenship or immigration status, genetic or biometric data, a known child's data, and precise geolocation data as sensitive data.

'Biometric data' means data from automatic measurement of biological characteristics used to identify a person, such as a fingerprint or voiceprint, and the raw recording is excluded, but data generated from it is covered once generated to identify a specific individual, matching the Connecticut, Oregon, Montana, and Nebraska structure.

Section 932 provides that a person is guilty of the computer crime of unauthorized access to a computer system when, knowing that the person is not authorized to do so, the person accesses or causes to be accessed any computer system without authorization, near-verbatim identical to Connecticut's statute and sharing the same undefined authorization concept the Computer Fraud and Abuse Act (CFAA) carries.

Section 939 grades penalties by dollar value and section 939(h) fixes the value of private personal data at $500 for grading purposes, a lower figure than Connecticut's $1,500.

Distinctively, section 941 creates an express civil right of action for any aggrieved person, recoverable in the Court of Chancery (injunction, restitution, receivership) or at law (actual damages, damages for unjust enrichment, and treble damages where there has been a showing of wilful and malicious conduct), plus attorney's fees to a prevailing plaintiff, with a three-year discovery-based limitations period.

This private right of action is broader than the parallel Connecticut statute, which carries no equivalent civil-remedy section, and it means a scraper defeating a technical access control in Delaware faces private civil exposure, not only prosecutorial risk.

Sections 931-941 were enacted together by 64 Del. Laws c. 438, approved July 20, 1984; the enrolled act's own text of section 932 reads identically in substance to the current codification (only a later gender-neutral pronoun update was made), so the section dates to its original 1984 commencement.

Section 12D-102(21) defines personal data to mean information linked or reasonably linkable to an identified or identifiable individual and expressly excludes de-identified data or publicly available information.

Publicly available information is defined at section 12D-102(28) as information lawfully made available through federal, state, or local government records, or information a controller has a reasonable basis to believe the consumer has lawfully made available to the general public through widely distributed media.

As in Connecticut, the exclusion operates on the definition of personal data itself, so scraped government-record or public-media personal data is outside the DPDPA's scope by definition rather than by a carve-out from an otherwise-applicable duty.

The Act's applicability threshold is notably lower than several peer states: section 12D-103(a) applies the chapter to persons conducting business in Delaware or targeting Delaware residents who, in the preceding calendar year, controlled or processed the personal data of 35,000 or more consumers (excluding payment-transaction data), or 10,000 or more consumers while deriving more than 20% of gross revenue from personal-data sales.

Chapter 12D's own text at section 12D-101 states this chapter shall be known and may be cited as the Delaware Personal Data Privacy Act; Chapter 12C is instead the Delaware Online and Personal Privacy Protection Act (website privacy policies and children's book-service-provider disclosures). DPDPA's general applicability and controller and processor duties took effect January 1, 2025, the same date the chapter's enforcement notice-and-cure window began running.

Any person, including a government entity, who conducts business in Delaware and owns, licenses, or maintains personal information must implement and maintain reasonable procedures and practices to prevent the unauthorized acquisition, use, modification, disclosure, or destruction of that personal information, collected or maintained in the regular course of business.

The duty was added to the Computer Security Breaches chapter by 81 Del. Laws, c. 129, section 1, alongside that chapter's breach-notification amendments; the Act was approved August 17, 2017 and, by its own Section 2, became effective 240 days later, on April 14, 2018.

The Attorney General, through the Director of Consumer Protection of the Department of Justice under Title 29, Chapter 25, may bring an action in law or equity to address a violation of the chapter and to recover direct economic damages resulting from a violation, or both; the chapter states no fixed civil penalty or statutory damages figure for this duty and creates no criminal offense.

Requires a business to obtain verifiable parental consent before processing the personal data of a known child under 13, and the teen's own consent for a consumer age 13 to 17, before using that data for targeted advertising, sale, or certain profiling.