79%
of Rhode Island's 19 requirements are already met by California (CA). Here is what RIDTPPA adds, biggest gaps first.
ThresholdsWho it coversBig gap
CA0 For-profit businesses with gross revenue over $26,625,000 (2025 adjusted), or buying/selling/sharing data of 100,000+ consumers or households, or 50%+ revenue from selling/sharing.
RIDTPPA adds2 Applies to for-profit entities controlling or processing data of 35,000+ Rhode Island customers (excluding payment-only data), or 10,000+ customers with over 20% of gross revenue from data sales.
R.I. Gen. Laws § 6-48.1-4(a) · source ↗
AppealsConsumers' rightsBig gap
CA0 No statutory appeal process for denied requests.
RIDTPPA adds2 Controllers must offer an appeal and decide it in writing within 60 days; on denial the customer may complain to the Attorney General.
R.I. Gen. Laws § 6-48.1-6(b)(6) · source ↗
Sensitive dataSensitive data and minorsGap
CA0 Broad sensitive personal information list, including neural data, IDs and financial log-ins; consumers get a right to limit use rather than opt-in consent.
RIDTPPA adds1 Processing sensitive data requires opt-in consent; revocation must be honored within 15 days.
R.I. Gen. Laws §§ 6-48.1-2(26), 6-48.1-4(c), (e) · source ↗
De-identified dataBusiness dutiesGap
CA2 Deidentified data requires reasonable measures, a public commitment not to reidentify, and contract flow-down to recipients.
RIDTPPA adds3 Deidentified data needs safeguards, a public commitment and contract duties; pseudonymous data is exempt from rights if kept separate; disclosers must oversee recipients.
R.I. Gen. Laws § 6-48.1-7(j)-(n) · source ↗
Already covered by CA: Exemptions, Children and teens, Data minimization, Rights, Request deadline, Universal opt-out, Assessments, Processor contracts, Privacy notice, Loyalty programs, Who enforces, Cure period, Maximum penalty, Private action, Rulemaking.
A gap means RIDTPPA is more demanding than CA on that requirement, on our 0 to 3 scale (how we score). Read the cited section before acting. Not legal advice.
