Rhode Island RIDTPPA
In force Rhode Island · In force Jan 1, 2026 · no upcoming deadlines
Deadlines
Summaries for reference, not legal advice. Check the official text.
What it does
Comprehensive consumer privacy law giving access, correction, deletion, portability and opt-out rights, requiring opt-in consent for sensitive data and data protection assessments. A notable extra: any commercial website or ISP that sells personally identifiable information must disclose the categories collected and every third party it has sold or may sell data to, whatever its size.
- Who it applies to
- For-profit entities conducting business in RI or targeting RI residents that in the preceding calendar year controlled or processed personal data of at least 35,000 customers (excluding payment-only data), or at least 10,000 customers while deriving more than 20% of gross revenue from selling personal data (6-48.1-4). The 6-48.1-3 disclosure duties apply to any commercial website or ISP doing business in RI. Exempts government, nonprofits, higher education, GLBA and HIPAA entities.
- Penalties
- Violations are deceptive trade practices under R.I. Gen. Laws ch. 6-13.1 (civil penalty up to $10,000 per violation, 6-13.1-8). Intentional disclosures to shell entities or otherwise in violation of the act also carry a fine of $100 to $500 per disclosure (6-48.1-8). No cure period. No private right of action.
- Enforced by
- Rhode Island Attorney General (sole enforcement authority)
- Official name
- Rhode Island Data Transparency and Privacy Protection Act
- Citation
- R.I. Gen. Laws 6-48.1-1 et seq. (P.L. 2024, ch. 430 and ch. 453; H 7787 / S 2500)
- Topics
- privacy
Research notes
The act became law without the Governor's signature in late June 2024; June 28, 2024 is the commonly reported date and was not confirmed on an official page. The statute has no cure period and no rulemaking authority. No amendments found through Sept 2026.
Related
Alabama Personal Data Protection Act (APDPA)
CCPA / CPRA
Colorado AI Act
Connecticut Data Privacy Act (CTDPA)
Delaware Personal Data Privacy Act (DPDPA)Questions about Rhode Island RIDTPPA
- What are the Rhode Island RIDTPPA compliance deadlines?
- Jan 1, 2026: RIDTPPA takes effect.
- When does Rhode Island RIDTPPA take effect?
- Rhode Island RIDTPPA took effect on Jan 1, 2026.
- Who does Rhode Island RIDTPPA apply to?
- For-profit entities conducting business in RI or targeting RI residents that in the preceding calendar year controlled or processed personal data of at least 35,000 customers (excluding payment-only data), or at least 10,000 customers while deriving more than 20% of gross revenue from selling personal data (6-48.1-4). The 6-48.1-3 disclosure duties apply to any commercial website or ISP doing business in RI. Exempts government, nonprofits, higher education, GLBA and HIPAA entities.
- What are the penalties under Rhode Island RIDTPPA?
- Violations are deceptive trade practices under R.I. Gen. Laws ch. 6-13.1 (civil penalty up to $10,000 per violation, 6-13.1-8). Intentional disclosures to shell entities or otherwise in violation of the act also carry a fine of $100 to $500 per disclosure (6-48.1-8). No cure period. No private right of action.