Rhode Island's privacy law (RIDTPPA) has been in force since 1 January 2026, with no cure period and no GPC mandate. Scope, exemptions and penalties explained. The Rhode Island Data Transparency and Privacy Protection Act is codified at R.I. Gen. Laws chapter 6-48.1. Its main duties cover for-profit businesses that handle the personal data of 35,000 Rhode Island residents, or 10,000 plus more than 20% of revenue from selling data. It also adds a duty to name the third parties you sell data to. This guide is based on the statute text, and it is general information, not legal advice.
Rhode Island privacy law at a glance
Every row below comes from the chapter as published by the Rhode Island General Assembly, with the section cited so you can check it.
| Item | What the statute says |
|---|---|
| Name | Rhode Island Data Transparency and Privacy Protection Act (§ 6-48.1-1) |
| Codified at | R.I. Gen. Laws title 6, chapter 48.1, sections 6-48.1-1 to 6-48.1-10 |
| Enacted as | H 7787 Substitute A (P.L. 2024, ch. 453) and S 2500 Substitute A (P.L. 2024, ch. 430), enacted 29 and 28 June 2024 |
| In force | 1 January 2026, for every section |
| Main thresholds | 35,000 customers (not counting payment-only data), or 10,000 customers plus more than 20% of gross revenue from selling personal data (§§ 6-48.1-4 to 6-48.1-7, each repeats the test) |
| Response time | 45 days, plus one 45-day extension (§ 6-48.1-6) |
| Appeals | Written answer within 60 days; if denied, the customer may complain to the Attorney General (§ 6-48.1-6) |
| Sensitive data | Consent required; revocation must take effect within 15 days (§ 6-48.1-4) |
| Cure period | None in the chapter |
| Universal opt-out signals (GPC) | Not mentioned in the chapter |
| Enforcement | Attorney General has sole enforcement authority under the chapter; the chapter creates no private right of action of its own (§ 6-48.1-8) |
| Money exposure | Deceptive trade practice, so up to $10,000 per violation under § 6-13.1-8; plus $100 to $500 per intentional unlawful disclosure (§ 6-48.1-8) |
What the law is called and where it sits
The statute's short title is the "Rhode Island Data Transparency and Privacy Protection Act", usually shortened to RIDTPPA. It is chapter 48.1 of title 6, among the commercial law general regulatory provisions, and it has ten sections.
The act passed as two companion bills with identical text, H 7787 Substitute A and S 2500 Substitute A. The General Assembly lists them as public laws 2024 chapters 453 and 430, enacted on 29 and 28 June 2024. The Future of Privacy Forum reports that the governor let the bills become law without a signature. That comes from a secondary source, not the governor's records.
Amendments: the legislature's chapter index, as archived on 30 October 2026, lists the same ten sections. The section pages we could read, with captures from April to October 2026, cite only the two 2024 public laws in their histories. We could not use the General Assembly's bill search or LegiScan, and the search results we reviewed showed no amending bill. That is good evidence but not proof, so check the live statute before you rely on it.
Who has to comply
The duties in sections 6-48.1-4 to 6-48.1-7 apply to for-profit entities that do business in Rhode Island, or that produce products or services targeted to Rhode Island residents, and that in the preceding calendar year did either of the following:
- Controlled or processed the personal data of at least 35,000 customers, not counting data processed solely to complete a payment transaction.
- Controlled or processed the personal data of at least 10,000 customers and earned more than 20% of gross revenue from the sale of personal data.
A "customer" is an individual who lives in Rhode Island and acts in an individual or household context. People acting in a commercial or employment context, such as staff or business contacts acting for their company, are not customers. There is no revenue-size test and no employee-count test. Only the count of Rhode Island residents matters.
The notice duties in section 6-48.1-3 work differently. Neither the notice requirement in subsection (a) nor the disclosure requirement in subsection (b) repeats the volume tests. Subsection (a) applies to any commercial website or internet service provider that does business in Rhode Island or has Rhode Island customers, and that collects, stores and sells customers' personally identifiable information. Subsection (b) applies to any controller that sells personal data or processes it for targeted advertising. Section 6-48.1-10(f) adds that the chapter is intended to apply only to entities that choose to collect, store and sell or otherwise transfer personally identifiable information, and the exemptions in section 6-48.1-3(d) apply to section 3 as well. Whether a regulator would read the volume thresholds into section 3 is untested. If you sell data and have Rhode Island customers, plan for the notice duties even if you are well below 35,000 residents.
Who is exempt
Exemptions matter because they remove whole organizations.
Entity-level exemptions (§ 6-48.1-3(d) and § 6-48.1-10):
- Government bodies and political subdivisions of the state, and contractors of state or local agencies when working for them.
- Nonprofit organizations, defined as those exempt under Internal Revenue Code sections 501(c)(3), (4), (6) or (12). Section 6-48.1-10 also excludes any entity recognized as tax-exempt.
- Institutions of higher education.
- National securities associations registered under the Securities Exchange Act.
- Financial institutions, their affiliates, and data subject to Title V of the Gramm-Leach-Bliley Act.
- HIPAA covered entities and business associates.
- Consumer reporting agencies (§ 6-48.1-10(f)).
Data-level exemptions (§ 6-48.1-3(e)) include protected health information under HIPAA, substance use disorder records under 42 U.S.C. § 290dd-2, certain human subjects research data, health care quality and patient safety work product, public health activity data, data regulated by the Fair Credit Reporting Act, the Driver's Privacy Protection Act and FERPA, Farm Credit Act data, certain airline data, and personal data of job applicants, employees and contractors used within that role.
Two practical points follow. First, if you process data under one of the carve-outs in section 6-48.1-7, such as subsection (o) or (p), you carry the burden of showing it applies (§ 6-48.1-7(t)). The chapter does not say who bears the burden for the entity-level and data-level exemptions in sections 3 and 10, so document your basis anyway. Second, an organization can be exempt for some data and covered for the rest. A bank is exempt as a financial institution, but a non-financial company that holds GLBA data is exempt only for that data.
What the law requires
Consumer rights and deadlines
Section 6-48.1-5(e) gives customers four numbered rights: to confirm and access their data, to correct inaccuracies and delete data, to get a portable copy, and to opt out of targeted advertising, the sale of personal data, and profiling used for solely automated decisions with legal or similarly significant effects. Those decisions cover financial or lending services, housing, insurance, education, criminal justice, employment, health care, and access to essential goods or services. A controller may not deny goods or services or charge different prices because a customer opts out, though it need not provide a service that requires data the customer has opted out of collecting (§ 6-48.1-5(c)).
Section 6-48.1-6 sets the process. For the operational side, see how companies automate DSAR workflows.
- Respond without undue delay and within 45 days. You may extend once by 45 days when reasonably necessary, if you tell the customer about the extension and the reason inside the first 45 days.
- If you decline a request, say so within 45 days, give your reason, and explain how to appeal.
- Provide information free of charge once per customer in any 12-month period. You may charge a reasonable fee or refuse requests that are manifestly unfounded, excessive or repetitive, and you carry the burden of showing that.
- You may refuse to act on a request you cannot authenticate, after telling the customer. You do not have to authenticate an opt-out request, though you may deny one you reasonably and documentably believe is fraudulent, with a notice explaining why.
- Run a clear and conspicuous appeal process. Answer an appeal in writing within 60 days, with reasons. If you deny it, the customer may complain to the Attorney General.
- Honor opt-out requests from authorized agents when you can verify the agent's authority. Parents and guardians may act for a known child or a person under guardianship.
Rhode Island has no separate "right to know the list of third parties" request. The nearest thing is the notice duty described below.
The privacy notice duty
Section 6-48.1-3 requires a commercial website or internet service provider doing business in Rhode Island to designate a controller. If it collects, stores and sells customers' personally identifiable information, the controller must say so in the customer agreement, an addendum, or another conspicuous place where such notices are usually posted. The notice must:
- Identify all categories of personal data collected through the website or service.
- Identify all third parties to whom the controller has sold or may sell customers' personally identifiable information.
- Give an active email address or other online way to contact the controller.
Separately, a controller that sells personal data or processes it for targeted advertising must clearly and conspicuously disclose that. The statute does not define "personally identifiable information" (it defines "personal data"), and it does not say how specific the list of third parties must be. As a practical step, name each category of recipient and each known buyer, and keep the list current.
Consent for sensitive data
Section 6-48.1-4(c) bars processing sensitive data without the customer's consent. This is opt-in. Consent means a clear affirmative act giving specific, informed and unambiguous agreement. The definition rules out acceptance of a general terms-of-use document, hovering over, muting, pausing or closing content, and agreement obtained through dark patterns. Our dark pattern avoidance checklist covers what to remove from consent flows.
You must offer a way to grant and revoke consent. After a revocation you must suspend the processing as soon as practicable, and no later than 15 days after receipt (§ 6-48.1-4(e)).
"Sensitive data" means personal data revealing racial or ethnic origin, religious beliefs, a mental or physical health condition or diagnosis, sex life, sexual orientation, or citizenship or immigration status. It also covers genetic or biometric data processed to uniquely identify a person, personal data collected from a known child, and precise geolocation data. Precise geolocation means data that locates a person within a radius of 1,750 feet. Biometric data excludes photographs and recordings unless the data is generated to identify a specific individual. For how these categories differ from ordinary personal data, see PII vs personal data vs sensitive data.
Minors
The statute's only age line is COPPA's. "Child" has the meaning in 15 U.S.C. § 6501, which is an individual under 13. Personal data collected from a known child is sensitive data, so it needs consent, and it may be processed only if consent is obtained and the information is processed in accordance with COPPA. Controllers that meet COPPA's verifiable parental consent rules are treated as compliant with the chapter's parental consent duty (§ 6-48.1-4(c)). Parents and guardians can exercise rights for a known child.
The chapter has no provision for teenagers, no age-based advertising ban, and no minor-specific impact assessment. Treating all minors' data as opt-in would be a cautious policy choice, not a statutory requirement. Several other states, including Connecticut, have separate rules for minors.
Data protection assessments
Section 6-48.1-7(e) requires a controller to conduct and document a data protection assessment for each processing activity that presents a heightened risk of harm. That includes targeted advertising, the sale of personal data, profiling that creates a reasonably foreseeable risk of harm (unfair or deceptive treatment, unlawful disparate impact, financial, physical or reputational injury, or offensive intrusion), and the processing of sensitive data.
- The Attorney General may require you to hand over a relevant assessment during an investigation. Assessments are confidential and exempt from public records disclosure, and sharing them does not waive privilege.
- One assessment may cover a comparable set of processing operations.
- An assessment done for another law counts if it is reasonably similar in scope and effect.
- The requirement applies to processing activities created or generated after 1 January 2026, and it is not retroactive. The statute does not say how to treat an ongoing activity that changes after that date.
- The statute does not say what an assessment must contain, so there is no prescribed template. Our guide to automating privacy impact assessments shows one way to structure them.
Processors, security and de-identified data
A contract must bind every processor. It must set out the instructions, the nature and purpose of processing, the data types, the duration, and each side's rights and obligations. It must also require confidentiality for staff, deletion or return of data at the end of services, proof of compliance on request, subcontractors under written contracts after you have had a chance to object, and cooperation with assessments (§ 6-48.1-7(c)). A processor that starts deciding the purposes and means of processing becomes a controller. Our SaaS DPA guide covers contract terms and subprocessors, though it is written around GDPR.
Controllers must keep reasonable administrative, technical and physical security practices (§ 6-48.1-4(b)) and must not process data in violation of state or federal anti-discrimination law. They may not retaliate against customers who use their rights, though bona fide loyalty programs are allowed (§ 6-48.1-5).
If you hold de-identified data, you must take reasonable measures to prevent re-association, publicly commit not to re-identify it, and bind recipients by contract (§ 6-48.1-7(j)). Pseudonymous data is outside the customer rights when the extra information is kept separately under effective controls.
Definitions that decide scope
- Sale of personal data: an exchange of personal data for "monetary or other valuable consideration" by a controller to a third party. Disclosures to processors, to affiliates, at the customer's direction, to provide a product the customer asked for, and in a merger or acquisition are not sales. Because "other valuable consideration" is in the definition, a data swap with no cash can still be a sale.
- Targeted advertising: ads selected from a customer's activity over time across non-affiliated sites or apps. Ads based on your own sites, the current search query or visit, or a customer's request, and measurement of ad performance, are excluded.
- Profiling: automated processing that evaluates or predicts a person's economic situation, health, preferences, interests, reliability, behavior, location or movements.
- De-identified data and publicly available information are outside the definition of personal data.
The chapter has no separate "consumer health data" section. Health information is covered through the sensitive data definition and the HIPAA exemptions above.
Data minimization
The chapter has no stand-alone minimization or purpose-limitation duty. Section 6-48.1-7(s) does say personal data may be processed to the extent reasonably necessary and proportionate to the purposes disclosed, and "adequate, relevant, and limited to what is necessary". The wording does not make clear whether this is a free-standing duty. Collecting only what your disclosed purposes need is the safer course.
No cure period, and what it means
The chapter contains no notice-and-cure requirement and no sunset date for one. The Attorney General can bring an action under section 6-48.1-8 or under the general commercial law provisions, "or both", without first giving you a window to fix the problem.
The general deceptive trade practices chapter does require "appropriate notice" before the Attorney General seeks an injunction (§ 6-13.1-5). That reads as notice of the proceeding, not a right to cure, and the privacy chapter creates no cure right of its own.
Compare that with Virginia, where the Attorney General must give 30 days' written notice and cannot sue if you cure and give a written statement.
Penalties: how the $10,000 and the $100 to $500 fit
Two money provisions apply, and they live in different places.
- Section 6-48.1-8(a) makes any violation of the chapter a violation of the general regulatory provisions of commercial law and a deceptive trade practice under chapter 13.1 of title 6.
- The $10,000 figure is not in chapter 6-48.1. It comes from the deceptive trade practices chapter, § 6-13.1-8, which says a person who violates that chapter "shall forfeit and pay to the state a civil penalty of not more than ten thousand dollars ($10,000) per violation." The Attorney General petitions to recover it. The same chapter lets the Attorney General seek injunctions and restitution (§ 6-13.1-5).
- The $100 to $500 figure is in § 6-48.1-8(a). An individual or entity that intentionally discloses personal data to a shell company, or to any entity formed in whole or in part to circumvent the chapter, or that intentionally discloses personal data in violation of any provision of the chapter, "shall pay a fine of not less than" $100 and "no more than" $500 for each such disclosure. It is a fine that sits inside the privacy chapter. The text does not call it criminal.
- How they interact is not spelled out. The Attorney General "may enforce a violation of this chapter" under the section, under the general commercial law provisions, "or both." The statute does not say whether the two amounts stack for the same conduct, or how disclosures are counted, and we found no case or Attorney General guidance on either point. Plan for the $10,000 per violation ceiling as the main exposure and treat the per-disclosure fine as an additional risk for intentional disclosures.
- Private lawsuits. The chapter creates no private right of action of its own, and section 6-48.1-8(c) says nothing in that section authorizes one. The Attorney General has sole enforcement authority under the chapter (§ 6-48.1-8(b)). Because section 6-48.1-8(a) deems a violation a deceptive trade practice, a consumer might try to sue under the private action in the deceptive trade practices chapter (§ 6-13.1-5.2). Whether that route is open has not been tested. Compare Virginia, whose statute expressly bars private suits under the chapter or any other law. Plan on Attorney General enforcement as the main risk. Customers whose appeals are denied can complain to the Attorney General.
- Waivers are void. Any waiver of the chapter's provisions is unenforceable (§ 6-48.1-9).
GPC and universal opt-out signals
The chapter text contains no reference to a global opt-out signal, a browser signal, Global Privacy Control or an opt-out preference signal. The only mechanism for someone acting for a customer is an authorized agent's opt-out request.
That is a real difference from Connecticut, whose statute requires controllers to honor an opt-out preference signal not later than 1 January 2025. It also means a Rhode Island customer's GPC signal is not something the statute tells you to treat as a valid opt-out.
For how to test signal handling on a site, see our GPC compliance audit. Two cautions keep this from becoming a loophole. If you already honor GPC for California or Connecticut visitors, applying the same logic to Rhode Island visitors is a policy choice that reduces the risk of failing an opt-out, not a Rhode Island legal duty. And whatever signal you decide to honor, an opt-out request that reaches you by another route, such as a form or an agent, must still be honored.
How Rhode Island differs from other states
| Topic | Rhode Island | Virginia | Connecticut |
|---|---|---|---|
| Cure period | None | 30 days' written notice, with a written cure statement stopping action | Mandatory 60-day cure where a cure is possible, 1 July 2023 to 31 December 2024; since 1 January 2025 the Attorney General decides whether to offer one |
| Opt-out preference signals (GPC) | Not mentioned | No requirement in §§ 59.1-577, 59.1-578 or 59.1-584 | Required not later than 1 January 2025 |
| Civil penalty | Up to $10,000 per violation under the deceptive trade practices chapter, plus $100 to $500 per intentional unlawful disclosure | Up to $7,500 per violation | Unfair trade practice; up to $5,000 per willful violation (§ 42-110o(b)) |
| Private right of action | None created by the chapter; use of the deceptive trade practices action is untested | None, expressly barred (§ 59.1-584(E)) | None (§ 42-525(d)) |
Connecticut amended its law in 2025 and 2026, so check current Connecticut thresholds before relying on older guides. For the full 2026 field, see our US state privacy law tracker and the marketing team view of state privacy laws. Kentucky and Indiana laws also took effect on 1 January 2026, and our Kentucky guide covers that law.
Enforcement so far
As of 8 September 2026, the latest capture of the Attorney General's press release list that we could read, and in web searches through early November, we found no Rhode Island enforcement action, guidance document or press release under the privacy act. The Attorney General's privacy-adjacent work that surfaced was multistate or under the general deceptive trade practices law, not under chapter 6-48.1. A more recent item could be missing. Absence of public enforcement is not a safe harbor, because there is no cure window to rely on when the first case does arrive.
Rhode Island privacy law compliance checklist
Items marked "recommended" are good practice, not statutory duties.
▢ Count Rhode Island residents in your data for the last calendar year, leaving out data used solely to complete payments, and compare with both thresholds
▢ Check whether you are exempt at entity level, and document any data-level exemption you rely on
▢ If you sell personal data, publish the section 6-48.1-3 notice with data categories, third-party recipients (including those you may sell to) and a contact email
▢ Disclose targeted advertising and sales clearly and conspicuously, whatever your volume
▢ Build request handling for 45 days plus a 45-day extension, a decline notice, and a 60-day written appeal answer
▢ Add an authorized agent route for opt-out requests and a parent or guardian route for known children
▢ Switch sensitive data processing, including precise geolocation and data from known children, to documented opt-in consent with a working withdrawal path inside 15 days
▢ Remove dark patterns from consent flows, and do not rely on acceptance of general terms
▢ Document a data protection assessment for targeted advertising, sales, risky profiling and sensitive data, for activities created or generated after 1 January 2026
▢ Update processor contracts to include the section 6-48.1-7(c) terms
▢ Recommended: decide and record your GPC policy for Rhode Island visitors
▢ Recommended: review any intentional disclosure to third parties for the $100 to $500 per-disclosure risk
▢ Recommended: set a date to re-check the statute for amendments
How Secure Privacy fits
Rhode Island gives you no cure period, so the proof has to exist before anyone asks for it. Secure Privacy keeps that proof in one platform, and most checklist items map to a module.
- Know what you process. The Process Register and the Data Map record every processing activity with its purposes, legal bases, data categories and retention periods, and export audit-ready reports. That record is the starting point for finding your sales, targeted advertising and sensitive data.
- Track your DSAR deadlines. DSAR handling manages each request from intake to resolution, tracks deadlines by regulation with automatic alerts, and keeps complete logs for audits and regulators. Customers submit requests through DSAR forms with email validation to cut spam. The materials we reviewed do not name Rhode Island, so confirm with your account team that the 45-day, extension and 60-day appeal windows are set up for Rhode Island.
- Document the assessments. DPIA and impact assessments run from pre-built templates with AI-assisted risk and mitigation suggestions, and each one goes through an approval workflow. Use them for the targeted advertising, sale, profiling and sensitive data assessments. The statute lets one assessment cover comparable processing, so group similar activities.
- Track processors and their contracts. Vendor Management keeps a register of vendors and processors, tracks contracts and data processing agreements, scores risk per vendor and alerts you to renewals and gaps. Use it to track the DPAs that need the section 6-48.1-7(c) terms.
- Score and follow up on risk. Risk Management scores risks by likelihood and impact, links them to systems, processes and owners, and tracks mitigation through to completion.
- Keep the program moving. Task Management and the compliance calendar give every action an owner and a due date, and keep an audit-ready history of what was done, such as the "re-check the statute" item.
- Capture consent and keep records. The cookie banner can block cookies and trackers until the visitor chooses, when prior-consent blocking is enabled. The Universal Consent Management module collects and manages consent across forms, newsletters, chatbots and custom flows through its APIs. Consent logging records every accepted or declined choice in an exportable log.
Some limits are worth stating plainly. Secure Privacy does not decide for you whether you are in scope or exempt, and it does not replace legal advice. The materials we reviewed do not describe sensitive-data-specific opt-in or the withdrawal path inside 15 days, so confirm with Secure Privacy how you would set those up. They also do not name Rhode Island or describe a GPC feature, and Rhode Island does not require one, so decide your Rhode Island GPC policy as a legal and business question first.
FAQ
When did Rhode Island's privacy law take effect?
1 January 2026. Every section of chapter 6-48.1 carries that effective date, and the chapter is enforceable now. Only data protection assessments have a start rule: they apply to processing activities created or generated after 1 January 2026.
Who does the Rhode Island privacy law apply to?
For-profit businesses that operate in Rhode Island or target its residents and that handled the personal data of at least 35,000 Rhode Island customers in the previous year, not counting payment-only data. It also covers those with at least 10,000 customers and more than 20% of gross revenue from selling personal data. The notice duties in section 6-48.1-3 are written without those thresholds, so check them separately if you sell data.
Is there a cure period under RIDTPPA?
No. The chapter has no notice-and-cure requirement and no sunset for one. The Attorney General can enforce under the privacy chapter or the general commercial law provisions without giving you time to fix a violation first.
How much are the penalties?
A violation is a deceptive trade practice, and that chapter allows a civil penalty of up to $10,000 per violation. Separately, an intentional unlawful disclosure of personal data, including to a shell company set up to evade the law, carries a fine of $100 to $500 per disclosure. The statute does not say whether the two amounts stack.
Does the Rhode Island privacy law require Global Privacy Control?
No. The chapter does not mention GPC or any universal opt-out signal. It does require you to honor opt-out requests from authorized agents. If you already honor GPC elsewhere, extending it to Rhode Island is a sensible policy choice, but not a legal requirement under the chapter.
Can individuals sue under the Rhode Island privacy law?
Not under the chapter itself. The chapter gives the Attorney General sole enforcement authority and creates no private right of action. Whether a consumer could sue under the general deceptive trade practices private action, on the footing that a violation is a deceptive trade practice, has not been tested. A customer whose appeal is denied can complain to the Attorney General.
Does the law protect teenagers' data?
Not separately. The chapter protects known children under 13, using the COPPA definition, by treating their data as sensitive and requiring consent. It has no teen-specific rules for ages 13 to 17. Some other states do, so a multi-state program often needs a stricter minors policy than Rhode Island alone requires.
Does the law require a privacy policy?
Not a general one. Section 6-48.1-3 requires a notice from commercial websites and internet service providers that collect, store and sell customers' personally identifiable information, listing data categories, third-party recipients and a contact method. Controllers must also describe how customers can exercise their rights, because section 6-48.1-5 refers to the means "described to the customer in the controller's privacy notice."
