Delaware lowers its privacy law threshold to 10,000 consumers from 2027

What changed

Thresholds drop from 35,000 to 10,000 consumers, among the lowest of any state. Controllers answer for partners' violations unless they oversaw them. GPC has been required since January 1, 2026.

Who it affects

Businesses with data of 10,000+ Delaware consumers (5,000+ with over 20% of revenue from data sales), plus third parties that acquire data from a controller. Nonprofits aren't exempt.

What to do

1. Re-check coverage at 10,000 Delaware consumers.
2. Keep evidence that you oversee processors.
3. Add Delaware to workflows before January 1, 2027.

What ComplyMo already handles

• Global Privacy Control
• Tracker blocking
• Policy drafts
• Daily re-check

Page audits and daily re-checks: Growth and up. Everything else: every plan, from $19 a month.

Sources

• Delaware Code tit. 6, ch. 12D (85 Del. Laws c. 463) (opens in a new tab)

Summary of public sources, not legal advice.