Delaware Website Tracking, Privacy & Wiretap Litigation
Current Landscape
The supplied data labels Delaware’s risk level as Moderate and reports two lawsuits, zero demand letters, and zero tracked matters. Those counts are not fully reconciled with the two supplied Bayhealth summaries, which may describe different stages of the same litigation rather than separate lawsuits.
Three anonymous patients alleged that Bayhealth’s website trackers collected private health information and disclosed it to Facebook, Google, and Microsoft for targeted advertising. On April 4, 2025, the Delaware Superior Court granted in part and denied in part Bayhealth’s motion to dismiss the first amended complaint. The excerpt does not identify the affected claims, the court’s reasoning, or any standing determination; it does not establish the merits of the allegations.
A settlement website separately reports a proposed Bayhealth class settlement, with eligibility described for people who accessed its MyChart Patient Portal through Bayhealth web pages between January 1, 2019, and December 31, 2025. Bayhealth denies wrongdoing. According to the supplied excerpt, the court has neither decided the merits nor approved the settlement. The website lists October 5, 2026, as the claim deadline and October 29, 2026, as the final approval hearing date. No later outcome is supplied.
The data lists the Delaware Wiretapping Act and the Delaware Online Privacy and Protection Act, but the summaries do not establish which statutory claims were asserted or how either statute was interpreted.
Current Litigation Activity
Important New Filings
- Doe et al. v. Bayhealth Medical Center Inc., d/b/a Bayhealth
Current Filing & Litigation Trends
The supplied data reports two lawsuits and no demand letters, but the summaries concern the same defendant and potentially the same litigation. They support describing a Bayhealth-focused set of reports, not a broader filing trend, an increase in litigation, or two confirmed independent proceedings. The separate zero tracked-matter count remains unresolved.
Precedent Landscape: What Courts Have Decided
No decided precedent with a clear substantive direction is currently tracked.
Current Laws & Relevant Statutes
- Delaware Wiretapping Act — Del. Code tit. 11 § 2402 · all-party consent
- Delaware Online Privacy and Protection Act — Del. Code tit. 6 § 1201C et seq.
Regulatory Enforcement
Agency Guidance
[object Object]
Global Privacy Control / Opt-Out Signals
Currently required
Effective since: January 1, 2026.
| Statute | Delaware Personal Data Privacy Act |
|---|---|
| Citation | 6 Del. C. § 12D-104(a)(6) |
| Applicability | Controllers must honor universal opt-out mechanisms for targeted advertising and sales. |
| Universal opt-out requirement | Yes |
| Recognized mechanisms | Global Privacy Control (GPC) |
Statutory baseline: Delaware Personal Data Privacy Act (6 Del. C. § 12D-104(a)(6)).
Learn more about Global Privacy Control → · How GPC posture is weighted in the risk guideline →
Changes Coming in the Next 24 Months
Coming Into Effect (Enacted)
| Law / Regulation | Effective Date | Time Until | What Changes | Who May Be Affected |
|---|---|---|---|---|
| Delaware privacy law UOOM requirement (per guide) | January 1, 2026 | already effective | Businesses in Delaware must detect and honor a UOOM as described from the stated date. | Businesses subject to Delaware's privacy law |
Legislation to Watch (Pending)
Important Cases & Tracked Matters
Doe v. Bayhealth Medical Center, Inc.
What the court decided: The court granted in part and denied in part Bayhealth's motion to dismiss the first amended complaint. The excerpt does not identify which claims were dismissed or retained or provide the court's reasoning.
What the court did not decide: The excerpt does not establish a final determination of liability, class certification, or the truth of plaintiffs' tracking and disclosure allegations.
Doe et al. v. Bayhealth Medical Center Inc., d/b/a Bayhealth
What the court decided: The parties reached a proposed class action settlement, subject to court approval; the page reports no merits holding.
What the court did not decide: The court has not decided the merits and still must decide whether to approve the proposed settlement.
Technologies Appearing in Claims
- Meta Pixel
- Facebook Conversions Application Programming Interface (CAPI)
- Google Tag Manager (GTM)
- Microsoft Universal Events
- Microsoft Clarity
- Cookie identifiers
- Website page-view, click, search, and form-submission tracking
- third-party tracking pixels
- Third-party tracking pixels
- Website tracking tools
- Built-in search bar
- Website video viewing
- Algorithmic feeds
- Age assurance
- Push notifications
- Beauty filters
- Visible like counts
- Third-party website tracking tools
- Cookies
- Cookie consent banner
- Manage Preferences interface
- Third-party cookies
- Website browsing tracking
Historical Risk Guideline
| Date | Risk Guideline | Level | Confidence | Tracked Lawsuits |
|---|---|---|---|---|
| October 8, 2026 | 30 | Moderate | 93% | 0 |
| October 11, 2026 | 30 | Moderate | 93% | 0 |
| October 11, 2026 | 34 | Moderate | 93% | 1 |
| October 11, 2026 | 34 | Moderate | 93% | 1 |
| October 12, 2026 | 34 | Moderate | 96% | 1 |
| October 12, 2026 | 34 | Moderate | 96% | 1 |
| October 12, 2026 | 35 | Moderate | 96% | 2 |
| October 12, 2026 | 35 | Moderate | 96% | 2 |
| October 12, 2026 | 35 | Moderate | 96% | 2 |
| October 12, 2026 | 35 | Moderate | 96% | 2 |
| October 12, 2026 | 35 | Moderate | 96% | 2 |
| October 13, 2026 | 35 | Moderate | 96% | 2 |
What Businesses Should Review
Businesses can use these allegations as a reason to review website tracking configurations, particularly on health-related pages and portal-access flows. Review which data and identifiers are collected, which third parties receive them, and whether tracking settings align with disclosures and consent or preference interfaces. Where deployed, examine pixels, tag managers, analytics APIs, cookies, search and form interactions, and embedded media. These are review considerations, not requirements established by the supplied ruling or assurances about legal outcomes.
Data Quality
27 source(s), 13 primary; evidence is fresh.
Methodology & Limitations
Statistics on this page are generated by the Crandall Consulting litigation intelligence engine. Publicly available sources (court and government materials, recognized legal press, professional analysis, and industry reports) are discovered through automated web research, classified into a tiered source hierarchy, and reduced to structured facts with full source provenance. Risk guidelines and evidence-confidence scores are computed by a deterministic formula from those stored facts — never by an AI model directly (AI explains findings; it never assigns a score). Counts labeled "tracked" reflect matters identified in our source set and are not official court statistics.
The overall risk guideline is composed of six deterministically weighted components: statutory structure (25%), current litigation activity (25%), prior precedent (18%), GPC / universal opt-out posture (15%), regulatory enforcement (9%), and the forward-looking 24-month horizon (8%). When a state's GPC status is limited data, that component is excluded and the remaining weights are renormalized — limited data never reads as lower exposure. Current litigation activity is measured over recent windows (velocity), not lifetime volume, so a jurisdiction with high historical activity but declining current filings reflects that decline. Litigation activity (volume) and precedential risk (authority of decisions) are measured separately. Full details are on the methodology page.
Sources
- Frequently Asked Questions — Delaware Personal Data Privacy Act
- Delaware Personal Data Privacy Act — Title 6, Chapter 12D
- Stowe et al. v. Hearst Magazine Media, Inc., d/b/a Bicycling — Opinion and Order Denying Motion to Compel Arbitration
- Utah Secures $12.2 Billion Settlement With Meta Over Child Safety Practices
- FROM CALIFORNIA TO NEW JERSEY: Northern District of California Sends CIPA Website Tracking Class Action to New Jersey
- Barrales v. Reckitt Benckiser LLC: Order Granting in Part and Denying in Part Defendant’s Motion to Dismiss the Complaint, with Leave to Amend
- Still Tracking, Still Suing: Website Privacy Litigation After SB 690
- Lutge v. Timex.com, Inc. — Order Dismissing Case
- Brown et al. v. WebMD LLC — Order Granting Motion to Transfer
- Doe v. Bayhealth Medical Center, Inc. — Amended Opinion and Order Granting in Part and Denying in Part Motion to Dismiss
- Stowe et al. v. Hearst Magazine Media, Inc. — Document 23, Opinion Denying Motion to Compel Arbitration
- Doe et al. v. Bayhealth Medical Center Inc., d/b/a Bayhealth — Class Action Settlement
- Ortiz et al. v. Foris Dax, Inc. — Order Dismissing Case, with Leave to Amend
- Still Tracking, Still Suing: Website Privacy Litigation After SB 690
- Barrales et al v. Reckitt Benckiser LLC, Document 40 (N.D. Cal. Jul. 31, 2026)
- Barrales et al v. Reckitt Benckiser LLC, 5:2025cv10643 - Document 40 (N.D. Cal. 2026)
- Case 1:26-cv-00739-RMI — Class Action Complaint (filed 01/23/2026)
- Universal Opt-Out Mechanisms: State Requirements and Penalties
- Global Privacy Control for Financial Services: A State-by-State Scope Test
- Universal Opt-Out Mechanisms: Which States Require Them
- Universal Opt-Out Mechanism (UOOM) Compliance: What Every Business Needs to Know in 2026
- U.S. Cybersecurity and Data Privacy Review and Outlook – 2025
- Wyden Letter to Attorneys General on Global Privacy Control
- The US State Privacy Law Tracker for 2026: Twenty Laws, One Compliance Baseline
- Juhyun So v. Hyatt Hotels Corporation
All State Pages
Is Your Website Creating Hidden Tracking Risk?
Scan your site for third-party tracking and potential wiretap exposure. Free, no account required.
Scan My Website