---
title: "Delaware privacy law (DPDPA): consumer rights"
canonical: "https://dposchool.com/state-privacy-laws/state/delaware/consumer-rights"
source: "https://delcode.delaware.gov/title6/c012d/index.html"
text_as_of: "2026-10-28"
last_reviewed: "2026-10-29"
language: "en-US"
publisher: "DPO School"
---

Delaware Personal Data Privacy Act

# Delaware privacy law (DPDPA): consumer rights

Law as of October 28, 2026 · [Reviewed by Sergio Maldonado Elvira on 29 October 2026](https://dposchool.com/state-privacy-laws/about#review)

## Summary (not the statute text)

Consumers may confirm and access, correct, delete, obtain a portable copy, obtain a list of the categories of third parties that received their data, and opt out of targeted advertising, sale and solely automated profiling with significant effects. Controllers must answer within 45 days, extendable once by 45 days, and decide appeals within 60 days. From 1 Jan 2027 access covers inferences and whether profiling is used for significant decisions, and the third-party list must name specific third parties.

## Key points

1. Rights: confirm and access, correct, delete, portable copy, list of categories of third parties that received the data, and opt-outs of targeted advertising, sale and profiling.

   Section: [§ 12D-104(a)(1)-(6)](https://delcode.delaware.gov/title6/c012d/index.html)

2. Respond within 45 days; one extension of 45 days if reasonably necessary, notified within the first 45 days with reasons.

   Section: [§ 12D-104(c)(1)](https://delcode.delaware.gov/title6/c012d/index.html)

3. Information is free once per consumer in any 12-month period.

   Section: [§ 12D-104(c)(3)](https://delcode.delaware.gov/title6/c012d/index.html)

4. Appeals must be decided in writing within 60 days; if denied, the consumer must be told how to complain to the Department of Justice.

   Section: [§ 12D-104(d)](https://delcode.delaware.gov/title6/c012d/index.html)

5. From 1 Jan 2027: access includes inferences derived from personal data and whether data is used for profiling to make significant decisions.

   Section: [§ 12D-104(a)(1) (eff. Jan. 1, 2027)](https://delcode.delaware.gov/title6/c012d/index.html)

6. From 1 Jan 2027: the consumer may obtain a list of the specific third parties that received the data, subject to limited exceptions.

   Section: [§ 12D-104(a)(5) (eff. Jan. 1, 2027)](https://delcode.delaware.gov/title6/c012d/index.html)

7. Authorized agents may exercise opt-out rights for the consumer.

   Section: [§ 12D-104(b); § 12D-105](https://delcode.delaware.gov/title6/c012d/index.html)

## Sources

- [Delaware Code, Title 6, Chapter 12D (both the current text and the text effective 1 Jan 2027)](https://delcode.delaware.gov/title6/c012d/index.html)

[Compare consumer rights across all states](https://dposchool.com/state-privacy-laws/topic/consumer-rights)

## Related GDPR articles

Related, not equivalent: the GDPR and the state laws differ in scope, terms and exceptions.

- [Article 15: Right of access by the data subject](https://dposchool.com/gdpr/article/15) (access)
- [Article 17: Right to erasure (‘right to be forgotten’)](https://dposchool.com/gdpr/article/17) (deletion)
- [Article 20: Right to data portability](https://dposchool.com/gdpr/article/20) (portability)

## Status

Law as of October 28, 2026.

[Reviewed by Sergio Maldonado Elvira on 29 October 2026](https://dposchool.com/state-privacy-laws/about#review). Prepared from the official sources listed.

[Official text of the Delaware statute](https://delcode.delaware.gov/title6/c012d/index.html)

Reference material, not legal advice.

## Other topics for Delaware

- [Applicability](https://dposchool.com/state-privacy-laws/state/delaware/applicability)
- [Sensitive data](https://dposchool.com/state-privacy-laws/state/delaware/sensitive-data)
- [Controller duties](https://dposchool.com/state-privacy-laws/state/delaware/controller-duties)
- [Processors](https://dposchool.com/state-privacy-laws/state/delaware/processors)
- [Enforcement](https://dposchool.com/state-privacy-laws/state/delaware/enforcement)

## Navigation

[US State Privacy Laws](https://dposchool.com/state-privacy-laws) / [Delaware](https://dposchool.com/state-privacy-laws/state/delaware) / Consumer rights

Previous: [Applicability](https://dposchool.com/state-privacy-laws/state/delaware/applicability)

Next: [Sensitive data](https://dposchool.com/state-privacy-laws/state/delaware/sensitive-data)

Learning US privacy law? An audio course on the privacy law that applies to US businesses: [US Privacy in Practice](https://dposchool.com/learn/courses/us-privacy-in-practice). More from [DPO School](https://dposchool.com).

## For AI agents

- Machine-readable index: https://dposchool.com/state-privacy-laws/llms.txt
- JSON API: https://dposchool.com/state-privacy-laws/api/v1/index.json
- Vendor privacy and security facts: https://vendor.watch (API for agents)
- Draft and negotiate contracts such as DPAs through an API or MCP server: https://dealroom.todo.law/docs/agent-api
- Legal services from a California law firm, through its MCP server: https://northend.law/agents