Delaware

Delaware's "visual depiction" definition, which governs dealing in child sexual abuse material (a class B or class D felony under sec. 1109) and possession of it (a class F felony under sec. 1111), expressly includes "any picture, or computer-generated image or picture, or any other image whether made, stored or produced by electronic, digital, mechanical or other means".

Delaware's "child" definition for these offenses separately extends to any individual the defendant intends to appear 14 years of age or younger. Neither offense requires an actual identifiable child, so a wholly AI-generated depiction is reached on the same terms as a photograph.

Possession under sec. 1111(2) separately reaches any visual depiction "created, adapted, modified or edited so as to appear" that a child is engaged in a prohibited sexual act, covering an AI-altered image built from a real photograph.

House Bill 191's progress status on the General Assembly's own bill tracker reads Signed 4/23/26. It amended Title 24 to add that a nonhuman entity, including an agent powered by artificial intelligence, may not be certified to practice medicine under sec. 1720(k). It may not be licensed as a physician associate under sec. 1773(d). It may not be licensed to practice professional nursing, as an advanced practice registered nurse, or as a practical nurse under sec. 1920(h).

The same sections separately bar such a nonhuman entity or AI agent from using the physician titles Doctor, Dr., Physician, surgeon, Medical doctor, MD, Doctor of osteopathy, and DO under sec. 1720(l). They bar it from using the title physician associate or the abbreviation PA under sec. 1773(d).

They bar it from using the nursing titles Advanced Practice Registered Nurse or APRN, Certified Registered Nurse Anesthetist or CRNA, Clinical Nurse Specialist or CNS, Certified Nurse Practitioner or CNP, Certified Nurse Midwife or CNM, Nurse, Registered Nurse or RN, Licensed Practical Nurse or LPN, and Doctor or Dr. under sec. 1920(i).

A person who practices or attempts to practice medicine contrary to Chapter 17, which reaches the sec. 1720(k)-(l) bar, is guilty of a class F felony under sec. 1766(a), fined not less than $1,000 nor more than $5,000 and imprisoned not more than 3 years, or both. A violation of Chapter 17 for which no other penalty is specified is a class B misdemeanor under sec. 1766(c).

Representing a nonhuman entity as a physician associate contrary to Subchapter VI is separately fined not less than $500 nor more than $2,000 or imprisoned not more than 1 year, or both, under sec. 1774B(b). Using a protected nursing title or abbreviation for an entity not licensed under Chapter 19 is fined not more than $1,000, or imprisoned not more than 1 year, or both, under sec. 1925.

House Bill 353, known as the Amelia Kramer Act and signed October 9, 2024, extended Delaware's existing non-consensual intimate-image regime to a "deep fake," defined as synthetic media created or intentionally manipulated with generative adversarial network techniques or other digital technology that appears to a reasonable person to depict a real individual doing or saying something that did not occur.

Under the criminal offense at Title 11, sec. 1335(a)(9), knowingly disseminating a nonconsensual deep fake or intimate visual depiction of an identifiable person is a class A misdemeanor, elevated to a class G felony where an aggravating factor is proven; sec. 1335(a)(9)g. specifically dispenses with any need to prove the depicted person had a reasonable expectation of privacy where the image is a deep fake.

The parallel civil chapter at Title 10, ch. 78 gives a depicted individual a cause of action against a person who knew or acted with reckless disregard in disseminating or threatening to disseminate the deep fake without consent.

House Bill 316 added this Title 15 provision, approved October 9, 2024. It makes it unlawful for a person to distribute, or contract to distribute, a deep fake depicting a candidate or political party within 90 days of an election, without the depicted individual's consent, if the person knows or reasonably should know the item is a deep fake.

Distribution is not a violation if the synthetic media carries a specified on-screen or spoken disclosure that it has been altered or artificially generated, or if it falls within the exceptions for a bona fide newscast, a news website or periodical that flags the media as inaccurate, or satire or parody; a further exception for a paid broadcaster meeting good-faith verification conditions was itself repealed by its own one-year sunset clause and no longer appears in the current code.

A depicted candidate may bring an expedited action for injunctive relief, damages, and attorney's fees in the Court of Chancery. A violation is a class B misdemeanor, elevated to a class A misdemeanor if committed with intent to cause violence or bodily harm, or on a repeat violation within 5 years.

Notice of a breach of security must be made without unreasonable delay and no later than 60 days after determination of the breach, except in specified situations. If the number of affected Delaware residents exceeds 500, the person required to provide notice must also notify the Attorney General by the time notice is provided to residents. House Bill 381 (153rd General Assembly) was signed on September 2, 2026.

It is Chapter 464 of Volume 85 of the Laws of Delaware and took effect on September 2, 2026. Substitute notice now includes notice of the breach of security to the Attorney General. Where a person could not identify within 60 days that a resident's personal information was in the breach, the person must also notify the Attorney General within 60 days after the determination of the breach, unless the person has provided substitute notice within that period.

A person regulated by state or federal law, including under Health Insurance Portability and Accountability Act (HIPAA) and the Gramm-Leach-Bliley Act, that maintains its regulator's breach procedures is now deemed to comply with section 12B-102(c) if it notifies affected residents under those procedures. The provisions this entry describes came into force on different days.

A licensee must notify the Insurance Commissioner as promptly as possible, and no later than 3 business days after determining that a cybersecurity event has occurred, if either of the two criteria in section 8606(a) has been met. The second criterion in section 8606(a) of title 18 is met where the licensee reasonably believes the nonpublic information involved is about 250 or more consumers and the event meets one of two further conditions.

A licensee must notify each affected consumer without unreasonable delay and no later than 60 days after determining that the event occurred, where the event has a reasonable likelihood of materially harming a consumer and is one for which notice to the Commissioner is required. If a cybersecurity event includes a Social Security number, the licensee must offer each affected consumer credit monitoring services at no cost for a period of 1 year.

A licensee acting as an assuming insurer must notify its affected ceding insurers and the Commissioner of its state of domicile within 3 business days of determining that a cybersecurity event has occurred, where the event involves nonpublic information the assuming insurer uses or holds without a direct contractual relationship with the affected consumer.

Chapter 86 of title 18 establishes the exclusive state standards for data security and for the investigation of, and notification to, the Commissioner and consumers when a cybersecurity event involving a licensee occurs. Chapter 86 of title 18 may not be construed to create or imply a private cause of action for a violation of its provisions. A licensee that violates chapter 86 of title 18 may be subject to penalties under section 329 of title 18.

The Insurance Commissioner may impose an administrative penalty of up to $50,000 per violation on an insurance company or other person licensed under title 18 of the Delaware Code that violates a provision of that title.

A licensee must maintain records concerning a cybersecurity event for at least 5 years from the date of the event and must produce those records upon the Commissioner's demand. Where a cybersecurity event has or may have occurred in a system a third-party service provider maintains, the licensee must complete the investigation steps in subsection (b) or make reasonable efforts to confirm and document that the provider has completed them.

A licensee is a person licensed, authorized to operate, or registered, or required to be, under the insurance laws of Delaware.

DPDPA governs private-sector processing of Delaware consumers' personal data. It is codified at Del. Code Ann. tit. 6, ch. 12D; Chapter 12C, sometimes cited for the DPDPA, is a different Delaware statute. Enacted as H.B. 154, 152nd General Assembly, effective January 1, 2025. Controller duties are allocated at sections 12D-104 through 12D-108 and processor duties at section 12D-109.

House Bill 380 (153rd General Assembly) was signed by the Governor on September 2, 2026 as Chapter 463 of Volume 85 of the Laws of Delaware, and its amendments take effect on January 1, 2027. They lower the applicability thresholds from 35,000 consumers to 10,000 consumers, and from 10,000 consumers to 5,000 consumers where more than 20% of gross revenue comes from the sale of personal data, and extend the Act to third parties who acquire personal data from a controller.

They also remove the employment-context exclusion for personal data processed in connection with profiling and reports under section 12D-106(f). In the definition of publicly available information, the widely-distributed-media limb no longer reaches biometric data that can be associated with a specific consumer and was collected without the consumer's consent.

From January 1, 2027, section 12D-103(b) excludes an insurer, insurance company, insurance producer, surplus lines broker, third-party administrator of self-insurance, health carrier, health services corporation, insurance-support organization or insurance agent, a federal or state-chartered bank, credit union or savings association, and an agent, broker-dealer, investment adviser or investment adviser representative regulated by the Delaware Investor Protection Unit or the Securities and Exchange Commission.

Until December 31, 2026, section 12D-103(b)(2) excludes any financial institution or affiliate of a financial institution, as defined in section 6809 of title 15 of the United States Code, to the extent it is subject to Title V of the Gramm Leach Bliley Act. From January 1, 2027, an affiliate or subsidiary of an insurer or bank is excluded only if it is principally engaged in financial activities as described in section 1843(k) of title 12 of the United States Code.

Data subject to Title V of the Gramm Leach Bliley Act remains excluded as data under section 12D-103(c)(14). Until December 31, 2026, section 12D-108 requires a data protection assessment from a controller that controls or processes the data of not less than 100,000 consumers.

From January 1, 2027, section 12D-108 reaches a controller that processes the data of not less than 50,000 consumers, and requires it to conduct and document a data protection assessment for each processing activity that presents a heightened risk of harm to a consumer, including targeted advertising, sale, certain profiling and the processing of sensitive data.

From January 1, 2027, a controller of that size must also conduct and document an impact assessment if it engages in profiling in furtherance of automated decisions that produce legal or similarly significant effects concerning a consumer. From January 1, 2027, section 12D-106 requires a controller to limit its processing of personal data to what is reasonably necessary and proportional to the disclosed purposes.

From January 1, 2027, a controller must enter into a binding contract with each third party to which it discloses personal data, including in a sale or for targeted advertising, that limits the disclosure to specified purposes and obliges the third party to comply with the Act and provide the same level of privacy protection.

From January 1, 2027, a controller must also conduct reasonable due diligence of those third parties, which involves at a minimum assessing the third party through questionnaires and review of its relevant documents. From January 1, 2027, a contract between a controller and a processor must require the processor to identify each limited and specific purpose for which it processes personal data, described with specificity and particularity rather than in generic terms.

From January 1, 2027, a third party that receives personal data from a controller or processor and has no contract required by the chapter may not further process the personal data, and must comply with the terms of any contract the chapter requires.

From January 1, 2027, a controller that discloses to a third party a report for use in a decision that produces legal or similarly significant effects concerning a resident must contract with the third party to give the resident notice of any adverse action based on the report, and must give the resident on request, within 30 days, the personal data it maintains, the source of the personal data used in profiling and the third parties that obtained a report within the previous 24 months.

From January 1, 2027, evidence or lack of evidence of proactive anti-bias testing or a similar effort to avoid processing personal data in violation of the laws of this State is relevant to any claim for a violation of those laws and to any available defense.

DPDPA gives a Delaware consumer the right to confirm processing, access, correct, delete, obtain a portable copy, and opt out of targeted advertising, sale, and profiling in furtherance of decisions that produce legal or similarly significant effects. Until December 31, 2026, the profiling opt-out reaches only solely-automated decisions. From January 1, 2027, the profiling opt-out reaches decisions that are automated, not only those that are solely automated.

A controller must respond without undue delay and no later than 45 days after receipt, with one 45-day extension available. From January 1, 2027, the right to confirm and access also reaches any inferences about the consumer derived from the personal data, and whether a controller or processor is processing the consumer's personal data for profiling to make a decision that produces a legal or similarly significant effect concerning the consumer.

Until December 31, 2026, a consumer may obtain a list of the categories of third parties to which the controller has disclosed the consumer's personal data.

From January 1, 2027, a consumer may obtain a list of the third parties to which the controller has disclosed the consumer's personal data, unless the data is pseudonymous, the controller cannot compile the list with reasonable effort and so must disclose all third parties to which it discloses personal data, or listing a third party would reveal a trade secret.

From January 1, 2027, a controller may not disclose in response to an access request the consumer's Social Security number, driver's license, state identification card or other government-issued identification number, financial account number, health insurance or medical identification number, account password, security question or answer, or biometric data, and may only inform the consumer, with sufficient particularity, that it processes them.

Under section 1761(c) of title 24, when a patient changes from one person certified to practice medicine to another, the former physician must transfer a copy of the patient's records to the current physician on the request of either the current physician or the patient.

Under section 1761(d) of title 24, patients, on their own behalf, have the right to obtain a copy of their medical records from any person certified to practice medicine according to a payment schedule the Board of Medical Licensure and Discipline establishes.

Under section 1761(l) of title 24, a person certified to practice medicine has 45 days from the closure of the record or the assembly of a complete record to fulfill a request for medical records unless a faster response is medically necessary.

Under section 1761(c) of title 24, if a patient changes care to another physician and fails to notify the former physician, or fails to request the transfer of records, the former physician must maintain the patient's records for 7 years from the last entry date, after which the records may be permanently disposed of in a manner that insures confidentiality of the records. Section 1 of chapter 161 of volume 84 of the Laws of Delaware amended section 1761 of title 24.

Chapter 161 of volume 84 of the Laws of Delaware was approved August 9, 2023 and took effect 6 months after its enactment, on February 9, 2024.

Since February 9, 2024, section 1761(a) requires the notice to patients about a physician's discontinuation of services to include how the patient can obtain the patient's records, the name, phone number and address of other health-care providers in the area who may be available to accept new patients, and the date the physician will discontinue services, and to be provided by an electronic message through any electronic medical record system in which the patient is enrolled and by a letter sent by first class mail.

Since February 9, 2024, section 1761(a)(5) requires a physician who is closing a medical practice, when patient medical records will no longer be available at the physician's place of business, to give the Board of Medical Licensure and Discipline notice of how former patients may obtain medical records.

A person certified to practice medicine who violates section 1761 of title 24 may be found by the Board to have committed unprofessional conduct, and an aggrieved patient or the patient's personal representative may bring a civil action for damages or injunctive relief, or both, against the violator.

The Delaware Department of Justice has authority to enforce DPDPA; a violation is deemed an unlawful practice under the Delaware Consumer Fraud Act, Del. Code tit. 6, section 2513, and is enforced solely by the Department of Justice. A cure notice was mandatory through December 31, 2025; from January 1, 2026 the Department may consider listed factors in deciding whether to offer a cure. The chapter creates no private right of action.

An operator of a commercial internet website, online or cloud computing service, online application or mobile application that collects personally identifiable information through the Internet about individual users residing in Delaware must make its privacy policy conspicuously available on it. An operator is in violation of that duty only if it fails to make its privacy policy conspicuously available within 30 days after being notified of noncompliance.

Personally identifiable information means information about a user collected online by the operator from that user and maintained in an accessible form, including a first and last name, a physical address, an e-mail address, a telephone number, a Social Security number, or any other identifier that permits the physical or online contacting of the user.

An operator is a person who owns the website, service or application, and does not include a third party that operates, hosts or manages it on the owner's behalf, or processes information on the owner's behalf, without owning it. The policy must identify the categories of personally identifiable information the operator collects through the service and the categories of third-party persons with whom the operator may share that information.

The policy must describe any process the operator maintains for a user to review and request changes to the user's personally identifiable information, describe how the operator notifies users of material changes to the policy, and identify the policy's effective date.

The policy must disclose how the operator responds to web browser do not track signals or other mechanisms that let users choose whether personally identifiable information about their online activities over time and across third-party sites and services is collected, if the operator engages in that collection, and whether other parties may collect that information when a user uses the operator's service.

An operator that collects personally identifiable information from users who reside in Delaware is in violation of the section if it fails to comply with the section or with its posted privacy policy either knowingly and wilfully or negligently and materially. The Consumer Protection Unit of the Department of Justice has enforcement authority over the chapter and may investigate and prosecute violations in accordance with the provisions of subchapter II of chapter 25 of title 29.

Section 2522 of title 29, in the subchapter that the chapter names for its enforcement, provides that a person found in a court proceeding to have committed a wilful violation must be ordered to pay the State a civil penalty of not more than $10,000 for each violation.

In subchapter II of chapter 12 of title 16, protected health information means information, in any form, that relates to an individual's past, present or future physical or mental health status, condition, treatment, service, products purchased, or provision of care and that reveals the identity of the individual or could reasonably be used to reveal it.

Under section 1211 of title 16, protected health information collected by the Department of Health and Social Services or its agencies, and by three named review commissions, must be used solely for legitimate public health purposes. Under section 1211 of title 16, the State may not use protected health information for commercial purposes, and protected health information whose use no longer furthers the legitimate public health purpose for which it was acquired must be expunged.

Under section 1212 of title 16, protected health information is not public information and may not be disclosed without the informed consent of the individual who is the subject of the information, except as the statute expressly provides. Under section 1212(g) of title 16, no person to whom protected health information has been disclosed under the subchapter may disclose it to another person except as the subchapter authorizes.

Under section 1212(h) of title 16, on the written request of an individual, a medical laboratory must provide a copy of the results of that individual's laboratory examination, and may require a reasonable copying fee. Chapter 329 of volume 75 of the Laws of Delaware, approved June 30, 2006, added the medical laboratory copy provision, then as subsection (h) of section 1232 of title 16.

The Department of Health and Social Services enforces subchapter II of chapter 12 of title 16 and promulgates the forms and regulations needed for that purpose.

An operator of an internet website, online or cloud computing service, online application or mobile application directed to children may not market or advertise on it a product or service listed in subsection (f) of section 1204C. Children means individuals under the age of 18 who are residents of Delaware.

A service is directed to children when it is targeted or intended to reach an audience composed predominantly of children, and it is not directed to children solely because it refers or links to another service directed to children by using information location tools.

An operator that has actual knowledge that a child is using its service may not market or advertise a listed product or service to that child if the marketing or advertising is directed to the child based upon information specific to that child, and the operator is deemed to comply if it takes reasonable actions in good faith designed to avoid doing so.

An operator directed to children, or with actual knowledge that a child is using its service, shall not knowingly use, disclose or compile, or allow another person to use, disclose or compile, the child's personal information if it has actual knowledge that the information will be used for the purpose of marketing or advertising a listed product or service to the child.

An operator directed to children whose marketing or advertising is provided by an advertising service need not comply with the marketing bar for that advertising and must instead notify the advertising service that its service is directed to children. An advertising service that has received that notice may not market or advertise a listed product or service on the service directed to children.

The listed products and services include alcoholic liquor, tobacco products, tobacco substitutes, and firearms and ammunition, among others. The section does not require an operator to collect age information about users.

A book service provider shall not knowingly disclose to any government entity, or be compelled to disclose to any person, private entity or government entity, any book service information about a user, except under the circumstances the section lists.

Book service information is information that identifies, relates to, describes or is associated with a particular user, a unique identifier or internet protocol address used to identify or be associated with a particular user or book, and information that relates to a user's access to or use of a book service or a book.

A book service is a service by which an entity, as its primary purpose, provides individuals with the ability to rent, purchase, borrow, browse or view books electronically or via the Internet. A book service provider is a commercial entity offering a book service to the public, except that a commercial entity that sells a variety of consumer products is not one if its book service sales do not exceed 2 percent of its total annual gross sales of consumer products sold in the United States.

A provider may disclose a user's book service information to a law-enforcement entity pursuant to any lawful method or process by which a law-enforcement entity is permitted to obtain such information. A provider may disclose a user's book service information to a person if the user has given informed, affirmative consent in writing to the specific disclosure to the specific person for a particular purpose.

A provider may disclose a user's book service information to a person who is not a governmental entity only pursuant to a court order in a pending action brought by or against the person, and only if the conditions the section lists are met. A provider may disclose a user's book service information to a governmental entity other than a law-enforcement entity only pursuant to a court order, and only if the conditions the section lists are met.

A provider must, on the written request of a law-enforcement entity, preserve records and other evidence of a user's book service information for 90 days, extended for a further 90 days on a renewed written request. Reasonable reliance by a provider on a warrant or court order, or on any of the enumerated exceptions, is a complete defense to any action for a violation of the section.

Unless disclosure is specifically prohibited by law, a provider must prepare a report of the demands and requests it received, and the disclosures it made, in the previous calendar year. A provider is not required to prepare that report unless it has disclosed book service information of more than 30 total users located in Delaware or whose location is unknown and cannot be determined.

DPDPA classifies data revealing racial or ethnic origin, religious beliefs, mental or physical health condition or diagnosis (including pregnancy), sex life, sexual orientation, transgender or nonbinary status, citizenship or immigration status, genetic or biometric data, a known child's data, and precise geolocation data as sensitive data.

'Biometric data' means data from automatic measurement of biological characteristics used to identify a person, such as a fingerprint or voiceprint, and the raw recording is excluded, but data generated from it is covered once generated to identify a specific individual, matching the Connecticut, Oregon, Montana, and Nebraska structure.

From January 1, 2027, the definition of sensitive data, renumbered as section 12D-102(33), also includes inferences made based on personal data, alone or in combination with other data, that are used to reveal or identify any listed category. From January 1, 2027, the first category reaches data that reveals or identifies racial, national or ethnic origin, and a mental or physical health condition, diagnosis, treatment or status, and treatment or status as transgender or nonbinary.

From January 1, 2027, the definition adds neural data that is generated by measuring the activity of an individual's central nervous system.

From January 1, 2027, the definition also adds a consumer's financial account number, financial account log-in information, or credit card or debit card number that would allow access to a financial account, and a government-issued identification number, including a Social Security number, passport number, state identification card number or driver's license number, that applicable law does not require to be publicly displayed.

From January 1, 2027, the definition of biometric data is renumbered as section 12D-102(4). From January 1, 2027, section 12D-106(a)(4) bars a controller from processing sensitive data unless the consumer consents and the processing is reasonably necessary and proportionate to the disclosed purposes for processing it.

From January 1, 2027, section 12D-106(a)(12) bars a controller from disclosing sensitive data in a sale of personal data unless the disclosure is strictly necessary to provide or maintain a product or service the consumer affirmatively requested, the controller gives clear and conspicuous notice before the sale, obtains the consumer's consent and keeps a record of the consent for 5 years.

No person may obtain genetic information about an individual without first obtaining informed consent from the individual. No person may retain an individual's genetic information without informed consent unless one of the exceptions in section 1203(a) applies. The sample from which genetic information has been obtained must be destroyed promptly unless one of the exceptions in section 1203(b) applies.

An individual may, promptly upon request, inspect, request correction of and obtain genetic information from the records of that individual. A person may not disclose, or be compelled to disclose, the identity of an individual on whom a genetic test has been performed, or genetic information about the individual in a manner that permits identification, unless section 1205(a) allows it. Chapter 458 of volume 71 of the Laws of Delaware was approved July 17, 1998.

The disclosure bar in section 1205 of title 16 applies to any subsequent disclosure by any person after another person has disclosed the information. Subchapter I of chapter 12 of title 16 applies only to genetic information or samples that can be identified as belonging to an individual or family.

A person who wilfully retains genetic information or a sample in violation of subchapter I of chapter 12 of title 16 is fined not less than $1,000 and not more than $10,000, and a person who wilfully obtains or discloses genetic information in violation is fined not less than $5,000 and not more than $50,000.

A person who wilfully discloses an individual's genetic information in violation of subchapter I of chapter 12 of title 16 is liable to the individual for all actual damages, including damages for economic, bodily or emotional harm proximately caused by the disclosure.

Section 711(f) of title 19 makes it an unlawful employment practice for an employer, employment agency, labor union or joint labor-management committee controlling apprenticeship or other training to intentionally collect, directly or indirectly, any genetic information concerning an employee or applicant for employment, or a member of their family.

The bar in section 711(f) of title 19 does not apply where the information is job-related and consistent with business necessity, or is sought in connection with the retirement policy or system of an employer or the underwriting or administration of a bona fide employee welfare or benefit plan. Chapter 457 of volume 71 of the Laws of Delaware, which inserted the genetic information collection limit into section 711 of title 19, was approved July 17, 1998.

In subchapter II of chapter 7 of title 19, genetic information means the results of a genetic test as defined in section 2317(a)(3) of title 18. In subchapter II of chapter 7 of title 19, job related and consistent with business necessity means the condition in question renders the individual unable to perform the essential functions of the position that the individual holds or desires.

In subchapter II of chapter 7 of title 19, an employer is any person employing 4 or more employees within the State at the time of the alleged violation, including the State or any political subdivision or board, department, commission or school district of the State. A person claiming to be aggrieved must first file a charge of discrimination with the Department of Labor within 300 days of the alleged unlawful employment practice or its discovery.

Subchapter II of chapter 7 of title 19 affords the sole remedy for claims alleging a violation of the chapter, to the exclusion of all other remedies. In a civil action under sections 714 and 715 of title 19, the Superior Court may order a respondent to pay compensatory damages, punitive damages, special damages including back pay and interest on back pay, and front pay, and to pay the costs of litigation and reasonable attorney's fees to the prevailing party.

Under section 715(c) of title 19, compensatory and punitive damages together may not exceed $50,000 for a respondent with 4 through 14 employees, rising in steps to $500,000 for a respondent with more than 500 employees.

A person engaged in the business of life insurance may not, based solely on a genetic characteristic or genetic information contained in the result of a genetic test, deny, refuse to issue, refuse to renew, cancel or otherwise terminate a policy or restrict coverage. Chapter 481 of volume 84 of the Laws of Delaware, known as The Ericka Byler Act, was approved October 9, 2024.

The bar in section 2317A(b) of title 18 does not apply to a genetic characteristic, genetic information or genetic test result that is in an individual's medical record or pertinent family history. A person engaged in the business of life insurance may not require or request that an individual or a member of the individual's family take a genetic test.

A person engaged in the business of life insurance may not require or request that an individual provide genetic information received from an entity providing direct-to-consumer genetic testing. A person engaged in the business of life insurance cannot attempt to obtain, or obtain, information from an entity providing direct-to-consumer genetic testing without the individual's written informed consent as required under section 1202 of title 16.

Direct-to-consumer genetic testing means a consumer-initiated genetic testing product or service offered directly to a consumer, or the collection, use or analysis of genetic data collected or derived from such a product or service and directly provided by a consumer. The Insurance Commissioner may impose an administrative penalty of up to $50,000 per violation on an insurance company or other person licensed under title 18 of the Delaware Code that violates a provision of that title.

Section 2317(b) of title 18 bars a person from discriminating against any individual in the issuance, denial or renewal of, or in the fixing of the rates, terms or conditions for, insurance based on any genetic characteristic or genetic information. In section 2317 of title 18, insurance means health insurance as defined in section 3602 of that title and does not include disability insurance or long-term care insurance.

In section 2317 of title 18, genetic information means information about inherited genes or chromosomes, and of alterations thereof, whether obtained from an individual or family member, that is scientifically or medically believed to predispose an individual to disease, disorder or syndrome, or believed to be associated with a statistically significant increased risk of development of a disease, disorder or syndrome.

Under section 2317(c) of title 18, no cause of action in the nature of defamation, invasion of privacy or negligence arises against any person for disclosing personal or privileged information in accordance with the section, no person violates the section by receiving genetic information or test results through inadvertent disclosure by a medical professional, and the section gives no immunity for disclosing or furnishing false information with malice or wilful intent to injure any person.

Chapter 457 of volume 71 of the Laws of Delaware added section 2317 to title 18. Chapter 457 of volume 71 of the Laws of Delaware was approved July 17, 1998. Chapter 481 of volume 84 of the Laws of Delaware amended section 2317 of title 18. The Insurance Commissioner may impose an administrative penalty of up to $50,000 per violation on an insurance company or other person licensed under title 18 of the Delaware Code that violates a provision of that title.

In chapter 74 of title 18, an insurer is any individual, corporation, association, partnership, fraternal benefit society or other entity engaged in the insurance underwriting business, except insurance agents and brokers, and includes medical service plans, hospital plans, health maintenance organizations and health service corporations.

An insurer may not request or require that an applicant submit to an HIV test unless the insurer first obtains the applicant's prior written informed consent, reveals to the applicant the use to which the results may be put and the entities to whom they may be disclosed, and provides the applicant with written information the Department of Health and Social Services approves.

Under section 7403(c) of title 18, no positive ELISA test result may be used for any purpose unless a Western Blot Assay or an equivalent or more accurate confirmatory test has confirmed it.

Under section 7404(a) of title 18, on the basis of the applicant's written informed consent, an insurer may disclose an applicant's HIV test result to its reinsurers or to contractually retained medical personnel and insurance affiliates, excluding agents and brokers, involved in underwriting or claims decisions on the application, where the disclosure is necessary to make those decisions.

Under section 7404(c) of title 18, insurers must maintain strict confidentiality regarding HIV test results, which may not be disclosed outside the insurer except as sections 7404 and 7405 provide. An insurer that fails to issue a policy because of the results of HIV testing must notify the applicant in writing of an adverse underwriting decision but may not disclose the specific results of the examination and testing to the applicant.

An insurer that violates a provision of title 18 of the Delaware Code may be subject to an administrative penalty the Insurance Commissioner imposes, up to $50,000 per violation for insurance companies and other persons licensed under the title.

Section 717(a) of title 16 bars any person from disclosing, or being compelled to disclose, the identity of any person upon whom an HIV-related test is performed, or the results of the test in a manner that permits identification of the subject of the test, except to the persons it lists. Chapter 336 of volume 66 of the Laws of Delaware was approved July 11, 1988.

Under section 717(b) of title 16, a person to whom the results of an HIV-related test have been disclosed under subsection (a) may not disclose the results to another person except as subsection (a) authorizes. In subchapter II of chapter 7 of title 16, HIV-related tests means HIV tests, CD4 cell count tests, viral load tests, or any other tests related to HIV.

Under section 718(a) of title 16, a person aggrieved by a violation of the subchapter has a right of action in the Superior Court and may recover damages of $1,000 or actual damages, whichever is greater, from a person who negligently violates it, damages of $5,000 or actual damages, whichever is greater, from a person who intentionally or recklessly violates it, reasonable attorneys' fees, and other relief including an injunction.

Under section 718(c) of title 16, the Attorney General may maintain a civil action to enforce the subchapter, in which a court may order any relief section 718(a) authorizes. Under section 718(b) of title 16, an action under the subchapter is barred unless it is commenced within 3 years after the cause of action accrues.

An operator is any person other than the Department, school districts or schools who operates a website, online or cloud computing service, online application or mobile application with actual knowledge that it is used primarily for K-12 school purposes and was designed and marketed for them, or who collects, maintains or uses student data in a digital or electronic format for K-12 school purposes.

An operator must implement and maintain reasonable security procedures and practices appropriate to the nature of the student data. An operator must delete a student's data within a reasonable timeframe not to exceed 45 calendar days if a school district or school requests deletion of data under its control. An operator may not knowingly engage in targeted advertising based on student data or on identifiers acquired through a covered service.

An operator may not knowingly use information gathered by a covered service to amass a profile about a student except in furtherance of K-12 school purposes. An operator may not knowingly sell student data, except in the purchase, merger or other acquisition of the operator by another entity that continues to be subject to the chapter. An operator may not knowingly disclose student data except for the reasons section 8105A(4) lists.

Chapter 81A of title 14 is not to be construed to apply to general audience websites, online or cloud computing services, online applications or mobile applications, even if login credentials created for an operator's service may be used to access them. The Consumer Protection Unit of the Department of Justice has enforcement authority over chapter 81A of title 14 and may investigate and prosecute violations in accordance with subchapter II of chapter 25 of title 29 of the Delaware Code.

Section 931 defines access as instructing, communicating with, storing data in or retrieving data from a computer, computer system or computer network, and defines no term for authorization. Section 932 provides that a person is guilty of the computer crime of unauthorized access to a computer system when, knowing that the person is not authorized to do so, the person accesses or causes to be accessed any computer system without authorization.

Section 933 punishes accessing or using a computer system with intent to obtain unauthorized computer services, software or data, section 934 punishes intentionally or recklessly disrupting or degrading computer services without authorization, and section 935(1) punishes a person who, as a result of accessing a computer system, intentionally makes an unauthorized display, use, disclosure or copy of data residing in, communicated by or produced by a computer system.

Section 939 grades penalties by the damage to or value of the property or computer services affected, from a class D felony above $10,000 to a class A misdemeanor under $1,500, and section 939(h) fixes the value of private personal data at $500 for grading purposes.

Section 941 creates an express civil right of action for any aggrieved person, recoverable in the Court of Chancery (injunction, restitution, receivership) or at law (actual damages, damages for unjust enrichment, and treble damages where there has been a showing of wilful and malicious conduct), plus reasonable costs and attorney's fees to a prevailing plaintiff, with no criminal action required first and a three-year discovery-based limitations period.

So a person who violates section 932 faces private civil exposure, not only prosecution.

The offenses and the civil remedy were enacted together by chapter 438 of volume 64 of the Laws of Delaware (Senate Bill 492), approved July 20, 1984, with the civil remedy then numbered section 939; the enrolled act's own text of section 932 reads identically in substance to the current codification (only a later gender-neutral pronoun update was made), so the section dates to its original 1984 commencement.

Section 12D-102(21) defines personal data to mean information linked or reasonably linkable to an identified or identifiable individual and expressly excludes de-identified data or publicly available information.

Publicly available information is defined at section 12D-102(28) as information lawfully made available through federal, state, or local government records, or information a controller has a reasonable basis to believe the consumer has lawfully made available to the general public through widely distributed media.

The exclusion operates on the definition of personal data itself, so scraped government-record or public-media personal data is outside the DPDPA's scope by definition rather than by a carve-out from an otherwise-applicable duty; in the version effective January 1, 2027 the widely-distributed-media limb does not include biometric data that can be associated with a specific consumer and was collected without the consumer's consent.

Until January 1, 2027, section 12D-103(a) applies the chapter to persons conducting business in Delaware or targeting Delaware residents who, in the preceding calendar year, controlled or processed the personal data of 35,000 or more consumers (excluding payment-transaction data), or 10,000 or more consumers while deriving more than 20% of gross revenue from personal-data sales; from that date the counts are 10,000 consumers, or 5,000 with that revenue share, and third parties who acquire personal data from a controller are covered too.

Chapter 12D's own text at section 12D-101 states this chapter shall be known and may be cited as the Delaware Personal Data Privacy Act. During calendar year 2025 the Department of Justice had to issue a notice of violation and allow 60 days to cure where a cure was possible, and from January 1, 2026 it may weigh listed factors in deciding whether to offer a cure.

The Department of Technology and Information has the power to develop and implement a comprehensive information security program that applies personnel, process, and technology controls to protect the State's data, systems, and infrastructure, within the State's computing environment and on partner systems. All systems that connect to the State network must comply with the State Information Security Program.

The Department has the power to establish a central Security Operations Center to direct statewide cyber defense and cyber threat mitigation. The Department must have the full cooperation of state agencies in identifying compliance requirements or industry standards.

The Department may temporarily disrupt the exposure of an information system or information technology infrastructure that one or more state agencies own, lease, outsource, or share, in order to isolate the source of, or stop the spread of, an information security breach or other similar information security incident. Chapter 185 of volume 82 of the Laws of Delaware, approved August 5, 2019, added section 9011C.

A licensee must develop, implement, and maintain a comprehensive, written information security program that is based on its risk assessment and contains administrative, technical, and physical safeguards for the protection of nonpublic information and the licensee's information system.

A licensee is a person who is licensed, authorized to operate, or registered, or required to be licensed, authorized, or registered, under the insurance laws of Delaware, other than a purchasing group or risk retention group chartered and licensed in another state and a licensee acting as an assuming insurer domiciled in another state or jurisdiction.

A licensee must establish a written incident response plan designed to promptly respond to, and recover from, a cybersecurity event that compromises the confidentiality, integrity, or availability of its nonpublic information, its information system, or the continuing functionality of any aspect of its business or operations.

A licensee that learns a cybersecurity event has or may have occurred must conduct a prompt investigation, or have an outside vendor or service provider designated to act on its behalf conduct one. An insurer domiciled in Delaware must submit annually to the Commissioner a written statement, by February 15, certifying that the insurer complies with section 8604. A licensee with fewer than 15 employees is exempt from section 8604.

A licensee that is subject to the federal health privacy law and maintains an information security program under it is considered to meet section 8604 if it is compliant and submits a written statement certifying its compliance. A licensee that violates the chapter may be subject to penalties under section 329 of title 18 of the Delaware Code.

The Insurance Commissioner may impose an administrative penalty of up to $50,000 per violation on an insurance company, an insurance holding company or another person licensed under title 18 of the Delaware Code. The Act took effect on enactment, July 31, 2019, and a licensee had 1 year from that date to implement section 8604 and 2 years from that date to implement section 8604(f).

Any person, including a government entity, who conducts business in Delaware and owns, licenses, or maintains personal information must implement and maintain reasonable procedures and practices to prevent the unauthorized acquisition, use, modification, disclosure, or destruction of that personal information, collected or maintained in the regular course of business.

The duty was added to the Computer Security Breaches chapter by 81 Del. Laws, c. 129, section 1, alongside that chapter's breach-notification amendments; the Act was approved August 17, 2017 and, by its own Section 2, became effective 240 days later, on April 14, 2018.

The Attorney General, through the Director of Consumer Protection of the Department of Justice under Title 29, Chapter 25, may bring an action in law or equity to address a violation of the chapter and to recover direct economic damages resulting from a violation, or both; the chapter states no fixed civil penalty or statutory damages figure for this duty and creates no criminal offense.

Delaware makes it a computer crime, without authorization, to intentionally or recklessly distribute unsolicited bulk commercial electronic mail to a receiving address or account under the control of an authorized user of a computer system. This offense does not reach mail sent between individuals, mail the recipient requested, mail an organization sends to its own members, or mail sent where a preexisting business relationship exists.

It is also a computer crime to use a computer or computer network without authority to falsify or forge electronic mail transmission information in connection with sending unsolicited bulk electronic mail. A separate computer crime is failing to stop sending commercial electronic mail to a receiving address or account after being asked to.

Every item of commercial electronic mail sent to a Delaware receiving address must tell the recipient how to unsubscribe or stop receiving further commercial electronic mail from the sender. These crimes are graded by the dollar value of the damage or of the property or computer services affected, which may be aggregated over one scheme or course of conduct. Fourth degree, a class A misdemeanor, applies when the damage or value, if any, is under $1,500.

Where that value cannot be satisfactorily ascertained, it is deemed to be $250. Third degree, a class G felony, applies when that value is $1,500 or more. Second degree, a class E felony, applies when that value exceeds $5,000. First degree, a class D felony, applies when that value exceeds $10,000. An aggrieved person may sue for an injunction, restitution, or the appointment of a receiver.

Independent of that remedy, any person who suffers injury to person, business or property may sue for actual damages, damages for unjust enrichment, and treble damages on a showing of wilful and malicious conduct. The court awards reasonable costs and attorney's fees to any aggrieved person who prevails.

The bar on falsifying or forging electronic mail transmission information is framed as a rule against deception, the kind of state email rule the CAN-SPAM Act's preemption clause leaves in force for a statute that expressly regulates commercial email. Its unsolicited-bulk-mail ban and its unsubscribe and stop-sending duties are not framed that way.

Delaware codifies the whole statute inside its computer-crime chapter, and the same federal clause does not preempt a state law to the extent it relates to acts of fraud or computer crime. The sections this entry groups came into force on different days.

Delaware bars any person, not only a peace officer, from installing or using a pen register or a trap and trace device without first obtaining a court order under section 2433 of Title 11. A pen register does not include a device a provider or customer of a wire or electronic communication service uses for billing, or recording incident to billing, or for cost accounting or similar purposes in the ordinary course of its business.

That prohibition does not reach a provider of wire or electronic communication service using such a device to operate, maintain or test its own service or protect its rights, property or users from abuse or unlawful use, to record that a communication was initiated or completed in order to protect the provider, another provider, or a user from fraudulent, unlawful or abusive use, or with the consent of the user of that service. A violation is a class A misdemeanor and is fined not more than $5,000.

Delaware makes it a crime, except as authorized by law, to trespass on property intending to subject anyone to eavesdropping or other surveillance in a private place. It is also a crime to install, in a private place, a device for observing, photographing, recording, amplifying or broadcasting sounds or events there, without the consent of the person or persons entitled to privacy there.

The same is true of installing or using, outside a private place, a device for hearing, recording, amplifying or broadcasting sounds originating in that place that would not ordinarily be audible or comprehensible outside, without that consent. Delaware's wiretap and eavesdropping chapter permits a person to intercept a wire, oral or electronic communication where the person is a party to it or one of the parties has given prior consent.

This violation-of-privacy statute instead requires the consent of all parties to intercept a message by telephone, telegraph, letter or other means of communicating privately, including a private conversation. It also bars divulging the existence or contents of such a message without the sender's and the receiver's consent, by a person who knows it was unlawfully intercepted or who learned of it through employment with an agency that transmits such messages.

The statute does not reach overhearing messages through a regularly installed instrument on a telephone party line or an extension or any other regularly installed instrument or equipment, acts by the telephone company or its subscribers under the company's own rules, telephone or telegraph carrier personnel performing their duties, divulging a message's existence under a subpoena, or acts by police officers under other named sections of this title. A violation of any of paragraphs (a)(1) through (a)(5) is a class A misdemeanor.

Delaware bars any person from intentionally intercepting, endeavoring to intercept, or procuring another to intercept a wire, oral or electronic communication, and from intentionally disclosing or using its contents knowing or having reason to know they were obtained by an interception that violates the chapter.

Interception is lawful where the person is a party to the communication or one of the parties has given prior consent, unless the interception is for the purpose of a criminal or tortious act. Violating this prohibition is a class E felony punishable by a fine of not more than $10,000. An oral communication is protected only where the speaker exhibits an expectation that it is not subject to interception under circumstances justifying that expectation.

An electronic communication does not include a tone-only paging communication or a communication from a tracking device. Telephone equipment furnished by a provider, or by the subscriber for connection to the service, and used in the ordinary course of business is not an intercepting device.

It is also lawful to intercept or access an electronic communication made through a system configured so that it is readily accessible to the general public, and for a provider of electronic communication service to record that a communication was initiated or completed to protect itself, another provider or a user from fraudulent, unlawful or abusive use.

A provider's switchboard operator, officer, employee or agent may intercept, disclose or use a communication in the normal course of employment where necessarily incident to its service or protecting its rights or property, though a provider of wire communications service to the public may not use service observing or random monitoring except for mechanical or service-quality checks, and law enforcement may intercept under a court order or the chapter's other listed exceptions.

A person or entity providing an electronic communication service to the public may not intentionally divulge the contents of a communication while in transmission on that service to anyone other than an addressee, an intended recipient or their agent, except as federal or state law authorizes, to a person forwarding it to its destination, or, for contents inadvertently obtained that appear to pertain to a crime, to a law-enforcement agency.

Violating the provider-divulgence duty is generally a class F felony with a fine of not more than $10,000. A person whose wire, oral or electronic communication is intercepted, disclosed or used in violation of the chapter has a civil action for actual damages, but not less than liquidated damages of $100 a day of violation or $1,000, whichever is higher, plus punitive damages and a reasonable attorney's fee and litigation costs.

Delaware's harassment statute makes it a crime, with intent to harass, annoy or alarm another person, to communicate with the person by telephone, telegraph, mail or another form of written or electronic communication in a manner the actor knows is likely to cause annoyance or alarm, and the statute names an intrastate telephone call initiated by a vendor to sell goods or services as an example of covered conduct.

It is also a crime to knowingly permit a telephone under one's control to be used for a purpose this section prohibits. Making repeated or anonymous telephone calls to a person, whether or not a conversation results, while knowing the person is thereby likely to suffer annoyance or alarm, is also a crime under this section. Harassment is a class A misdemeanor. The provisions this entry describes came into force on different days.

Telemarketing is an organized activity, program or campaign by one or more telemarketers to solicit a sale of merchandise by telephone, and a telemarketer is a natural person who, from any location, initiates or receives telephone calls to or from a customer located in Delaware in connection with it.

Delaware requires a seller or telemarketing business, unless exempted, to obtain a certificate of registration from the Director of the Consumer Protection Unit before transacting business with a Delaware customer through telemarketing. Every registrant must also file a $50,000 corporate surety bond, or an equivalent letter of credit, with the Director.

The registration and bond duty does not apply to a corporation whose shares trade on a public exchange or its at least 60-percent-owned subsidiary, or a 501(c)(3) or (6) nonprofit, if organized in Delaware or qualified to do business there, to a telemarketing business working under contract for such a corporation, or to listed sellers including repair-contract sellers, Public Service Commission-regulated sellers, established Delaware retailers, negative-option plans, small food sellers, real estate licensees, and cable, newspaper or magazine sellers.

A seller or telemarketing business must keep its advertising and scripts, prize-recipient records, customer and sales records, telemarketing employee records and payment authorizations for 24 months. At the beginning of a solicitation call and before any sales pitch, a telemarketer must disclose that the call's purpose is to sell specific merchandise, the telemarketer's name and the name of the seller on whose behalf the call is made, and accurate information about the merchandise offered.

Before the initial sales call ends and before payment is requested, the telemarketer must disclose the total price, any restrictions or conditions, material aspects of the merchandise and of the refund, cancellation, exchange or repurchase policy, and the material terms of any investment or prize promotion.

A telemarketing sale becomes final only 7 business days after the customer receives a written notice, in at least 12-point bold type, of the right to cancel, unless the seller offers a full refund or satisfaction guarantee with at least 7 days to review the goods or services.

It is a prohibited practice to submit a customer's check or draft for payment without the customer's express verifiable authorization, to represent registration as a government endorsement, to assist a seller or telemarketer one knew or should have known was violating the chapter, to take advance payment to recover losses from a prior telemarketing transaction, or to send a courier for payment unless the customer can inspect the merchandise first.

A telemarketer may not wilfully call or contact a customer for a purpose connected with selling or advertising merchandise for 10 years after the customer has directed the telemarketer, orally or in writing, to cease and desist, a call being wilful if the caller knows or should know of the instruction.

The chapter does not apply to a solicitation completed only after a face-to-face presentation to the customer, a business-to-business sale, telephone use by a charitable, religious, political, educational, labor or social organization for noncommercial fundraising, a licensed insurance or registered securities professional acting within the license's scope, a supervised financial institution, a qualifying catalog seller, or a sale governed by Public Service Commission or Federal Communications Commission tariffs.

It also exempts a communication by telephone or other media that the customer initiated and that was not the result of any solicitation by the telemarketer, seller or telemarketing business. The sale of merchandise by an unregistered, non-exempt seller or telemarketing business is voidable. A customer who suffers a loss or harm from a violation may recover actual and punitive damages, attorney's fees, court costs and any other remedies including equitable relief.

Violating Title 11's extortion or blackmail offenses in connection with telemarketing is separately a class F felony. The provisions this entry describes came into force on different days.

A child is a child as defined in the federal Children's Online Privacy Protection Act. Until December 31, 2026, a controller may not process sensitive data concerning a known child without first obtaining consent from the child's parent or lawful guardian. Sensitive data includes the personal data of a known child.

Until December 31, 2026, a controller may not process a consumer's personal data for targeted advertising, or sell it, without the consumer's consent where the controller has actual knowledge or wilfully disregards that the consumer is at least 13 years of age but younger than 18. From January 1, 2027, a controller may not process any personal data of a consumer it has actual knowledge, or wilfully disregards, is a child without first obtaining consent from the child's parent or lawful guardian.

From January 1, 2027, the same consent rule for a consumer at least 13 but younger than 18 covers every purpose listed in section 12D-104(a)(6). Those purposes are targeted advertising, the sale of personal data, and profiling in furtherance of automated decisions that produce legal or similarly significant effects.

Until December 31, 2026, the Act applies to a person that controlled or processed the personal data of not less than 35,000 consumers in the preceding calendar year, or not less than 10,000 consumers while deriving more than 20% of gross revenue from the sale of personal data. From January 1, 2027, those thresholds are 10,000 consumers, and 5,000 consumers where more than 20% of gross revenue comes from the sale of personal data.

House Bill 380 of the 153rd General Assembly was signed on September 2, 2026. The amending act, chapter 463 of volume 85 of the Laws of Delaware, takes effect on January 1, 2027.