Regulations › US states › Rhode Island
RIDTPPA
Rhode Island Data Transparency and Privacy Protection Act
WhenIn effect since 1 January 2026
Who enforces itState Attorney General
Who it applies toBusinesses that process personal data of the state's residents above the law's thresholds. Thresholds, exemptions and sensitive-data rules differ by state.
ThresholdsApplies to for-profit entities controlling or processing data of 35,000+ Rhode Island customer…
Universal opt-outNot required
Cure periodNo cure period
Request deadlineControllers must respond within 45 days, extendable once by 45 days
Maximum penalty$100 to $500 per intentional unlawful disclosure
Private actionNo private right of action
Every requirement we score, with the rule in plain words and the section it comes from. Darker means more demanding. See every law side by side →
Who it covers
Thresholds
2
Applies to for-profit entities controlling or processing data of 35,000+ Rhode Island customers (excluding payment-only data), or 10,000+ customers with over 20% of gross revenue from data sales.R.I. Gen. Laws § 6-48.1-4(a) · source ↗
Enacted by P.L. 2024, ch. 430 (H 7787) and ch. 453 (S 2500). No 2025 or 2026 amendments found.
Exemptions
0
Entity-level exemptions for GLBA financial institutions, HIPAA covered entities and business associates, nonprofits and higher education.R.I. Gen. Laws § 6-48.1-3(d)-(e) · source ↗
Sensitive data and minors
Sensitive data
1
Processing sensitive data requires opt-in consent; revocation must be honored within 15 days.R.I. Gen. Laws §§ 6-48.1-2(26), 6-48.1-4(c), (e) · source ↗
Children and teens
1
A child is under 13 (COPPA); a known child's data is sensitive and needs COPPA parental consent. No teen-specific protections.R.I. Gen. Laws §§ 6-48.1-2(5), 6-48.1-4(c) · source ↗
Data minimization
2
Processing must be reasonably necessary and proportionate to disclosed purposes, and data adequate, relevant and limited to what is necessary.R.I. Gen. Laws § 6-48.1-7(s) · source ↗
Consumers' rights
Rights
2
Confirm and access, correct, delete, portability, and opt out of targeted ads, sale and solely automated significant profiling.R.I. Gen. Laws § 6-48.1-5(e) · source ↗
Request deadline
2
Controllers must respond within 45 days, extendable once by 45 days.R.I. Gen. Laws § 6-48.1-6(b)(1) · source ↗
Appeals
2
Controllers must offer an appeal and decide it in writing within 60 days; on denial the customer may complain to the Attorney General.R.I. Gen. Laws § 6-48.1-6(b)(6) · source ↗
Universal opt-out
0
Not required; only authorized agents may opt out for customers.R.I. Gen. Laws § 6-48.1-6(b)(7) · source ↗
Business duties
Assessments
2
Assessments are required for targeted ads, sale, risky profiling and sensitive data processing; the AG may require disclosure.R.I. Gen. Laws § 6-48.1-7(e)-(i) · source ↗
Applies to processing activities created or generated after January 1, 2026.
Processor contracts
3
Binding contract with detailed terms and assessments; subcontractors only after the controller can object and under flow-down written contracts.R.I. Gen. Laws § 6-48.1-7(b)-(c) · source ↗
Privacy notice
3
Any commercial website that sells PII, whatever its size, must identify all third parties it has sold or may sell PII to. Sale and targeted ads need clear disclosure.R.I. Gen. Laws § 6-48.1-3(a)-(b) · source ↗
The named-third-party disclosure applies to commercial websites and ISPs regardless of the § 6-48.1-4 thresholds.
Loyalty programs
1
Non-discrimination rule with a carve-out for voluntary bona fide loyalty, rewards, premium, discount or club card programs.R.I. Gen. Laws § 6-48.1-5(c)-(d) · source ↗
De-identified data
3
Deidentified data needs safeguards, a public commitment and contract duties; pseudonymous data is exempt from rights if kept separate; disclosers must oversee recipients.R.I. Gen. Laws § 6-48.1-7(j)-(n) · source ↗
Enforcement
Who enforces
1
Attorney General has sole enforcement authority; violations are also deceptive trade practices under chapter 6-13.1.R.I. Gen. Laws § 6-48.1-8 · source ↗
Maximum penalty
2
$100 to $500 per intentional unlawful disclosure; other violations are deceptive trade practices carrying civil penalties up to $10,000 each.R.I. Gen. Laws § 6-48.1-8(a); § 6-13.1-8 · source ↗
The $10,000 figure comes from the Deceptive Trade Practices Act (§ 6-13.1-8), which was not read directly; verify.
Rulemaking
0
No rulemaking authority in the Act.R.I. Gen. Laws ch. 6-48.1 · source ↗
No rulemaking provision found in the chapter.
Scores are our reading on the published rubric, checked 18 October 2026. Not legal advice.
Regulations library
Every US state privacy law, on one map
24 states have a comprehensive privacy law in the library, alongside the EU, UK, US federal and global laws: 102 in all, each explained in plain words with its sources. Select a state to see what applies there.
- In force
- Coming into force
- Sector laws