Recording Law for Voiceprints & Biometric Data in Delaware

Under the Delaware Personal Data Privacy Act (DPDPA), which takes effect on January 1, 2025, biometric data is classified as "sensitive data." The law defines "biometric data" to mean "data generated by automatic measurements of an individual's unique biological characteristics, such as a fingerprint, a voiceprint, eye retinas, irises, or other unique biological patterns or characteristics that are used to identify a specific individual." The definition expressly excludes "a digital or physical photograph," "an audio or video recording," and "any data generated from such a recording" unless that data is generated to identify a specific individual. That means if your product converts a recorded voice into a voiceprint for identification, Delaware law requires the person’s explicit consent before processing their voiceprint. The law does not create a private right of action, so only the Delaware Department of Justice can enforce it. Penalties may be imposed by a court of not more than $10,000 for each willful violation, and may include cease-and-desist orders, return of unlawfully obtained money, asset freezes, restitution, rescission, or recoupment. Raw audio recordings themselves are not biometric data unless they’re processed to create a voiceprint used for identification. Delaware has no dedicated biometric statute like Illinois’ BIPA; a standalone biometric bill (HB 350) was introduced in the 149th General Assembly (2017–18) but died in committee, and a 2026 bill (HB 380) passed both chambers but has not yet been signed into law as of July 22, 2026.

Under the DPDPA, you must obtain the person’s clear, affirmative consent before processing their voiceprint for identification. The law defines "consent" as "a clear affirmative act signifying a consumer's freely given, specific, informed and unambiguous agreement." Consent may not be obtained through acceptance of broad terms of service, dark patterns, or other methods that do not meet this standard. The consent duty is triggered when the raw audio is processed into a voiceprint template used to identify the person. The DPDPA applies only if it controls or processes the personal data of at least 35,000 Delaware consumers per year, or at least 10,000 Delaware consumers with more than 20% of gross revenue derived from the sale of personal data; a pending amendment (HB 380) would lower the threshold to 15,000 consumers but has not yet been signed into law. The law requires you to limit how long you keep the voiceprint and to provide users with clear information about how you use and store it.

Delaware’s law defines "biometric data" to mean "data generated by automatic measurements of an individual's unique biological characteristics, such as a fingerprint, a voiceprint, eye retinas, irises, or other unique biological patterns or characteristics that are used to identify a specific individual." The definition expressly excludes "a digital or physical photograph," "an audio or video recording," and "any data generated from such a recording" unless that data is generated to identify a specific individual. So if your glasses capture audio but don’t convert it into a voiceprint template for identification, the DPDPA’s biometric consent rule isn’t triggered. Only when the audio is processed into a voiceprint used for identification does the consent duty apply.

Delaware’s older wiretap and privacy laws still apply to audio recording, and they create a hybrid consent regime: Chapter 24 (Wiretapping, Electronic Surveillance and Interception of Communications) permits interception where the person is a party to the communication or where one of the parties to the communication has given prior consent, unless done to commit a crime or tort, while Chapter 5’s §1335(a)(4) provides that it is unlawful to intercept without the consent of all parties thereto a message by telephone, telegraph, letter or other means of communicating privately, including private conversation. The DPDPA is the first Delaware law to treat voiceprints as sensitive biometric data, requiring explicit consent before processing, limiting retention, and setting enforcement by the Attorney General. So you must follow both sets of rules: obtain consent to record the conversation under the applicable wiretap statute, and obtain separate consent to process the recording into a voiceprint for identification under the DPDPA.

Say you’re wearing glasses that record audio during a meeting with a client in Delaware. The raw audio is captured, but your product only processes it into a voiceprint for identification after the meeting ends. Under Delaware’s DPDPA, you must obtain the client’s clear, affirmative consent before processing their voiceprint for identification; the law defines "consent" as "a clear affirmative act signifying a consumer's freely given, specific, informed and unambiguous agreement." If you don’t, a court may impose a civil penalty of not more than $10,000 for each willful violation, and the Attorney General may pursue other remedies such as cease-and-desist orders, return of unlawfully obtained money, asset freezes, restitution, rescission, or recoupment. Separately, Delaware’s wiretap law requires you to determine whether the conversation is an "oral communication" under Chapter 24 — which includes a Katz-style reasonable-expectation-of-privacy test — or a "private conversation" under §1335(a)(4), a term Delaware courts have not defined in any reported case, and to obtain the necessary consent before recording. So you need both consents: one to record the conversation under the applicable wiretap statute, and one to process the recording into a voiceprint for identification under the DPDPA.

Delaware’s DPDPA is enforced only by the Attorney General, not by private lawsuits; the law provides that "Nothing in this chapter shall be construed as providing the basis for, or be subject to, a private right of action for violations of said sections or any other law," and is enforced solely by the Department of Justice. Penalties may be imposed by a court of not more than $10,000 for each willful violation, and may include cease-and-desist orders, return of unlawfully obtained money, asset freezes, restitution, rescission, or recoupment. The law also gives the Attorney General a mandatory 60-day cure-notice period from January 1, 2025 through December 31, 2025 if the Department of Justice determines a cure is possible; from January 1, 2026 onward, cure opportunities become discretionary, weighed against factors such as the number of violations, size and complexity of the controller, likelihood of public injury, and past compliance history. Because there’s no private right of action, individuals can’t sue you directly for biometric violations under the DPDPA.

From January 1, 2025 through December 31, 2025, the Department of Justice must provide a mandatory 60-day cure period if it determines a cure is possible; after January 1, 2026, cure opportunities are discretionary and the Attorney General may consider factors such as the number of violations, the size and complexity of the controller, the likelihood of public injury, and the controller’s past compliance history. In practice, this means that if your processing of voiceprints begins before January 1, 2026, you have a stronger expectation of receiving a cure period if a potential violation is identified, whereas after January 1, 2026, the absence of a cure period cannot be assumed. Controllers should document their compliance programs and any steps taken to address potential issues to support a request for discretionary relief if needed.

Delaware sits within the U.S. Court of Appeals for the Third Circuit, whose precedent in Fields v. City of Philadelphia, 862 F.3d 353 (3d Cir. 2017), holds that the First Amendment protects the right of members of the public to photograph, film, and audio-record police officers carrying out their official duties in public, regardless of the recorder’s purpose. Because on-duty police interactions occur in public and officers acting in an official public capacity generally lack a reasonable expectation of privacy in that public interaction, such recording is unlikely to be treated as interception of a "private conversation" under §1335(a)(4) or as protected "oral communication" under 11 Del. C. §2401(13). No Delaware state case squarely addresses this scenario, so this conclusion rests on the statutory text plus Third Circuit First Amendment precedent rather than a Delaware police-recording case directly on point.

Silent video-only recording is treated differently depending on which chapter applies. Delaware’s wiretap chapter (Chapter 24) is essentially inapplicable to silent video-only capture because its definitions of "oral communication," "wire communication," and "electronic communication" are built around spoken or transmitted communications, not visual capture. However, §1335(a)(2) separately bars installing, in a "private place," any device "for observing, photographing, recording, amplifying or broadcasting sounds or events" without consent of the person(s) entitled to privacy there — this applies to a purely visual/video device, and no audio is required. The §1337 definition of "private place" excludes places with public or substantial-group access, so silent video recording of events unfolding in public places is not restricted by §1335(a)(2). By contrast, video-only capture inside a private space (someone’s home, a private office, a fitting room, etc.) without the consent of the person entitled to privacy there can independently violate §1335(a)(2) as a Class A misdemeanor even with no audio at all.

Delaware’s wiretap statute includes a narrow home-related carve-out at §1335(a)(6), which exempts a parent or guardian from liability for recording their own minor child (under 18) inside the family dwelling, unless done for sexual gratification. This exemption is part of the statute’s "intimate/undress" recording provision and is not a general home-recording rule. It does not authorize recording other people’s children or co-occupants without consent, and it does not override the separate biometric consent duties under the DPDPA if voiceprints are created.