# Delaware DPPA Compliance Assessment Report

## Organization Information

| Field | Value |
|-------|-------|
| **Organization** | Liberty Commerce Inc. |
| **Assessment Date** | 2026-03-16 |
| **DE Consumer Count** | 52,000 |
| **Payment-Only Excluded** | 3,000 |
| **Net Consumer Count** | 49,000 |
| **Revenue from Data Sale** | 12% |
| **Threshold A Met (35,000)** | Yes |
| **DPPA Applicable** | Yes |

## Consumer Rights Implementation Status

| Right | Statute | Status | Channel | Notes |
|-------|---------|--------|---------|-------|
| Access | §12D-106(a)(1) | Implemented | Web portal, email | 3-point verification |
| Correct | §12D-106(a)(2) | Implemented | Web portal, email | 2-point verification |
| Delete | §12D-106(a)(3) | Implemented | Web portal, email | Retention exceptions documented |
| Portability | §12D-106(a)(4) | Implemented | JSON export | 3-point verification |
| Opt-out: targeted ads | §12D-106(a)(5) | Implemented | Privacy page, GPC | No verification required |
| Opt-out: sale | §12D-106(a)(5) | Implemented | Privacy page, GPC | No verification required |
| Opt-out: profiling | §12D-106(a)(5) | Implemented | Privacy page | No verification required |
| Appeal | §12D-106(f) | Implemented | Email | 60-day response; AG referral on denial |

## Request Processing Metrics

| Metric | Value |
|--------|-------|
| Total requests received (trailing 12 months) | -- |
| Average response time | -- days |
| Requests completed within 45 days | --% |
| Extensions granted | -- |
| Requests denied | -- |
| Appeals filed | -- |
| Appeals upheld | -- |

## Sensitive Data Consent Status

| Category | Collected | Consent Mechanism | Active Consents | Withdrawals |
|----------|-----------|-------------------|-----------------|-------------|
| Precise geolocation | Yes | In-app toggle | -- | -- |
| Citizenship/immigration | No | N/A | N/A | N/A |
| Health diagnosis | No | N/A | N/A | N/A |
| Racial/ethnic origin | No | N/A | N/A | N/A |
| Religious beliefs | No | N/A | N/A | N/A |
| Sexual orientation | No | N/A | N/A | N/A |
| Genetic data | No | N/A | N/A | N/A |
| Biometric data | No | N/A | N/A | N/A |
| Known child data | Yes | Parental consent (COPPA) | -- | -- |

## Universal Opt-Out Readiness (Effective January 1, 2026)

| Requirement | Status |
|-------------|--------|
| GPC header detection (Sec-GPC: 1) | Implemented |
| Authenticated consumer: account-level opt-out | Implemented |
| Unauthenticated consumer: device/browser opt-out | Implemented |
| Third-party tag suppression on GPC signal | Implemented |
| Conflict resolution (GPC vs. prior consent) | GPC prevails |
| Absence of signal not treated as consent | Confirmed |
| Quarterly validation testing | Scheduled |

## Minor Data Processing

| Age Bracket | Targeted Advertising | Data Sale | Consent Required |
|-------------|---------------------|-----------|------------------|
| Under 13 | Prohibited | Prohibited | Verifiable parental consent |
| 13-17 | Opt-in only | Opt-in only | Consumer opt-in |
| 18+ | Standard DPPA | Standard DPPA | Standard DPPA |

## Data Protection Assessments

| DPIA ID | Processing Activity | Trigger | Approved | Next Review |
|---------|-------------------|---------|----------|-------------|
| DPIA-DE-001 | Targeted advertising | Targeted advertising | Yes | 2027-03-16 |
| DPIA-DE-002 | Geolocation personalization | Sensitive data | Yes | 2027-03-16 |

## Enforcement Preparedness

| Item | Status |
|------|--------|
| No cure period awareness | Documented |
| AG inquiry response plan | In place |
| Consumer complaint escalation path | Defined |
| DPIA records accessible to AG | Confirmed |
| Civil penalty exposure calculated | $10,000/violation |

## Sign-Off

| Role | Name | Date | Signature |
|------|------|------|-----------|
| Privacy Officer | | | |
| Legal Counsel | | | |
| IT Security Lead | | | |