Delaware Children’s Privacy Laws (2026)

HB 154 (2023, 84 Del. Laws c. 197); amended by HB 380, as amended by HA 2 (2026, 85 Del. Laws c. 463)

In force · Privacy law (minors) · effective 2025-01-01 · binds operators

Ages: Known minors 13-17; children under 13 (sensitive data only until 2026-12-31, all personal data from 2027-01-01, each with parental consent; COPPA-compliant consent satisfies the consent element)

Requires: Until 2026-12-31 a controller may not process a known child's (under 13) sensitive data without parental consent, and may not process a consumer's personal data for targeted advertising, or sell it, without consent where it has actual knowledge of, or wilfully disregards, that the consumer is at least 13 but under 18 (Del. Code tit. 6 § 12D-106(a)(4) and (a)(7)). From 2027-01-01 HB 380 (85 Del. Laws c. 463) rewrites both rules. The child rule becomes a new § 12D-106(a)(5): no processing of any personal data, not only sensitive data, of a consumer the controller has actual knowledge of, or wilfully disregards, is a child, without first obtaining a parent's or lawful guardian's consent and, as under the existing law, complying with § 1204C (Delaware's ban on marketing certain products to children online); COPPA-compliant verifiable parental consent satisfies the parental-consent element (§ 12D-103(d)), not the § 1204C element. The teen rule, renumbered (a)(8), widens from targeted advertising and sale to every purpose on the § 12D-104(a)(6) opt-out list: targeted advertising, sale of personal data, and profiling in furtherance of automated decisions that produce legal or similarly significant effects, none of which is allowed without the 13-to-17-year-old's consent. The same act lowers the applicability threshold to 10,000 consumers; a known child's data stays sensitive data, and so remains a data protection assessment trigger for controllers above the § 12D-108(a) threshold.

Timing: in force since 2025-01-01 under Section 3 of 84 Del. Laws c. 197; the HB 380 amendments (85 Del. Laws c. 463), signed 2026-09-02, take effect 2027-01-01 under Section 2 of the engrossed act, when the wider child and teen rules start and the applicability threshold drops from 35,000 to 10,000 consumers on the general prong and from 10,000 to 5,000 on the prong for controllers deriving over 20% of gross revenue from selling personal data, and the data protection assessment threshold from 100,000 to 50,000; until then the 2023 text governs. The codified chapter at delcode.delaware.gov/title6/c012d carries both texts, each amended section printed twice, headed "Effective until Jan. 1, 2027" and "Effective Jan. 1, 2027", with history notes citing 85 Del. Laws c. 463. The 2026-09-02 signing date comes from the bill page's action history

Litigation: No challenge to the Act or to HB 380 identified in RECAP searches of the Delaware federal courts and the Third Circuit or on NetChoice's and CCIA's litigation pages.

Entry last reviewed 2026-10-01