Implements Delaware DPPA compliance for consumer rights (access, correct, delete, portability, opt-out), controller obligations, processor requirements, sensitive data consent, and universal opt-outs. Effective 2025.
npx claudepluginhub mukul975/privacy-data-protection-skills --plugin privacy-skills-completeThis skill uses the workspace's default tool permissions.
The Delaware Personal Data Privacy Act (DPPA), codified as Title 6, Chapter 12D of the Delaware Code (6 Del. C. §§12D-101 through 12D-111), was signed into law by Governor John Carney on September 11, 2023 (HB 154). The DPPA became effective on January 1, 2025. Delaware is notable for having the lowest applicability threshold of any comprehensive US state privacy law — requiring only that a con...
Conducts multi-round deep research on GitHub repos via API and web searches, generating markdown reports with executive summaries, timelines, metrics, and Mermaid diagrams.
Dynamically discovers and combines enabled skills into cohesive, unexpected delightful experiences like interactive HTML or themed artifacts. Activates on 'surprise me', inspiration, or boredom cues.
Generates images from structured JSON prompts via Python script execution. Supports reference images and aspect ratios for characters, scenes, products, visuals.
The Delaware Personal Data Privacy Act (DPPA), codified as Title 6, Chapter 12D of the Delaware Code (6 Del. C. §§12D-101 through 12D-111), was signed into law by Governor John Carney on September 11, 2023 (HB 154). The DPPA became effective on January 1, 2025. Delaware is notable for having the lowest applicability threshold of any comprehensive US state privacy law — requiring only that a controller process the personal data of 35,000 Delaware consumers (with no revenue-from-sale threshold) — making it the broadest in scope of the state privacy laws enacted through 2023.
Key distinguishing features of the DPPA:
The DPPA applies to persons that conduct business in Delaware or produce products or services targeted to Delaware residents AND during the preceding calendar year either:
Entity-level exemptions:
Data-level exemptions:
Liberty Commerce Inc. Assessment: Liberty Commerce Inc. processes personal data of approximately 52,000 Delaware consumers. With 12% of advertising revenue attributable to data sale activities, Liberty Commerce Inc. exceeds threshold (1) and treats itself as fully subject to the DPPA.
| Parameter | Requirement |
|---|---|
| Response deadline | 45 days from receipt |
| Extension | One additional 45-day extension with notice and reason |
| Denial requirements | Inform consumer of appeal right |
| Appeal response | 60 days; must inform consumer of right to contact AG |
| Cost | Free; no charge for first request per 12 months |
| Verification | Reasonable authentication; cannot require account creation |
Effective January 1, 2026, controllers must recognize universal opt-out preference signals (such as Global Privacy Control). The signal must be treated as a valid opt-out of sale and targeted advertising. Controllers must not interpret the absence of a signal as consent.
Controllers must provide a reasonably accessible, clear privacy notice that includes:
Controllers must limit collection to what is adequate, relevant, and reasonably necessary for the disclosed purpose.
Controllers must establish, implement, and maintain reasonable administrative, technical, and physical data security practices appropriate to the volume and nature of the personal data at issue.
Processing of sensitive data requires the consumer's consent. Sensitive data under the DPPA includes:
Controllers must conduct and document DPIAs for processing activities that present a heightened risk of harm, including:
Processors must:
Processing contracts must include:
| Feature | Delaware DPPA | Connecticut CTDPA | Colorado CPA | Virginia VCDPA |
|---|---|---|---|---|
| Consumer threshold | 35,000 | 100,000 | 100,000 | 100,000 |
| Revenue alternative | 10,000 + 20% | 25,000 + 25% | 25,000 + revenue | 25,000 + 50% |
| Cure period | None (AG discretion) | 60 days (until Dec 2024) | 60 days (until Jan 2025) | 30 days (until Jan 2025) |
| Universal opt-out | Jan 1, 2026 | Jan 1, 2025 | Jul 1, 2024 | Not required |
| Immigration data sensitive | Yes | No | No | No |
| Minor age threshold | Under 18 | Under 16 | Under 13 | Under 13 |
| Penalty per violation | $10,000 | $5,000 | $20,000 | $7,500 |