---
title: "Delaware privacy law (DPDPA): sensitive data"
canonical: "https://dposchool.com/state-privacy-laws/state/delaware/sensitive-data"
source: "https://delcode.delaware.gov/title6/c012d/index.html"
text_as_of: "2026-10-28"
last_reviewed: "2026-10-29"
language: "en-US"
publisher: "DPO School"
---

Delaware Personal Data Privacy Act

# Delaware privacy law (DPDPA): sensitive data

Law as of October 28, 2026 · [Reviewed by Sergio Maldonado Elvira on 29 October 2026](https://dposchool.com/state-privacy-laws/about#review)

## Summary (not the statute text)

Sensitive data may be processed only with the consumer's opt-in consent, and data about a known child (under 13, as defined by COPPA) needs a parent's consent. Delaware protects teenagers more than most states: a controller that knows or wilfully disregards that a consumer is 13 to 17 may not sell the data or use it for targeted advertising without consent. From 1 Jan 2027 the definition widens and sensitive data processing must also be reasonably necessary and proportionate.

## Key points

1. Sensitive data includes racial or ethnic origin, religious beliefs, health conditions (including pregnancy), sex life, sexual orientation, transgender or nonbinary status, citizenship or immigration status, genetic or biometric data, data of a known child, and precise geolocation.

   Section: [§ 12D-102(30)](https://delcode.delaware.gov/title6/c012d/index.html)

2. Opt-in consent is required to process sensitive data; for a known child, parental consent is required.

   Section: [§ 12D-106(a)(4)](https://delcode.delaware.gov/title6/c012d/index.html)

3. No targeted advertising or sale without consent where the controller knows or wilfully disregards that the consumer is 13 to 17 years old.

   Section: [§ 12D-106(a)(7)](https://delcode.delaware.gov/title6/c012d/index.html)

4. From 1 Jan 2027 sensitive data also covers inferences used to reveal sensitive traits, neural data, financial account credentials and certain government identifiers.

   Section: [§ 12D-102(33) (eff. Jan. 1, 2027)](https://delcode.delaware.gov/title6/c012d/index.html)

5. From 1 Jan 2027 sensitive data processing must be consented to and reasonably necessary and proportionate, and a sale of sensitive data is allowed only in narrow conditions with consent and record keeping.

   Section: [§ 12D-106(a)(4), (a)(12) (eff. Jan. 1, 2027)](https://delcode.delaware.gov/title6/c012d/index.html)

## Sources

- [Delaware Code, Title 6, Chapter 12D (both the current text and the text effective 1 Jan 2027)](https://delcode.delaware.gov/title6/c012d/index.html)

[Compare sensitive data across all states](https://dposchool.com/state-privacy-laws/topic/sensitive-data)

## Related GDPR articles

Related, not equivalent: the GDPR and the state laws differ in scope, terms and exceptions.

- [Article 9: Processing of special categories of personal data](https://dposchool.com/gdpr/article/9) (sensitive data)

## Status

Law as of October 28, 2026.

[Reviewed by Sergio Maldonado Elvira on 29 October 2026](https://dposchool.com/state-privacy-laws/about#review). Prepared from the official sources listed.

[Official text of the Delaware statute](https://delcode.delaware.gov/title6/c012d/index.html)

Reference material, not legal advice.

## Other topics for Delaware

- [Applicability](https://dposchool.com/state-privacy-laws/state/delaware/applicability)
- [Consumer rights](https://dposchool.com/state-privacy-laws/state/delaware/consumer-rights)
- [Controller duties](https://dposchool.com/state-privacy-laws/state/delaware/controller-duties)
- [Processors](https://dposchool.com/state-privacy-laws/state/delaware/processors)
- [Enforcement](https://dposchool.com/state-privacy-laws/state/delaware/enforcement)

## Navigation

[US State Privacy Laws](https://dposchool.com/state-privacy-laws) / [Delaware](https://dposchool.com/state-privacy-laws/state/delaware) / Sensitive data

Previous: [Consumer rights](https://dposchool.com/state-privacy-laws/state/delaware/consumer-rights)

Next: [Controller duties](https://dposchool.com/state-privacy-laws/state/delaware/controller-duties)

Learning US privacy law? An audio course on the privacy law that applies to US businesses: [US Privacy in Practice](https://dposchool.com/learn/courses/us-privacy-in-practice). More from [DPO School](https://dposchool.com).

## For AI agents

- Machine-readable index: https://dposchool.com/state-privacy-laws/llms.txt
- JSON API: https://dposchool.com/state-privacy-laws/api/v1/index.json
- Vendor privacy and security facts: https://vendor.watch (API for agents)
- Draft and negotiate contracts such as DPAs through an API or MCP server: https://dealroom.todo.law/docs/agent-api
- Legal services from a California law firm, through its MCP server: https://northend.law/agents