Rhode Island
Rhode Island Data Transparency and Privacy Protection Act
Rhode Island’s consumer privacy law. It gives Rhode Island residents rights over their personal data and sets rules for businesses that meet its size limits.
- Status
- In effect since January 1, 2026
- Citation
- R.I. Gen. Laws § 6-48.1-1 et seq.
- Official text
- Read the law(opens in a new tab)
Who it covers
Businesses that handle data of 35,000+ Rhode Island customers a year, or 10,000+ with over 20% of revenue from selling data. Any commercial website that sells personal information must name the third parties it sells to.
What it asks of your website
- A privacy notice explaining what you collect, why, who you share it with and how people use their rights.
- Let people access, delete and correct their data, and opt out of targeted ads and the sale of their data.
- Get opt-in consent before using sensitive data (health, precise location, children’s data and more).
- Offer an appeal when you turn down a privacy request.
Two duties: one for every site that sells data
The Rhode Island Data Transparency and Privacy Protection Act took effect on January 1, 2026. Most of it applies to for-profit businesses that handle the personal data of 35,000 or more Rhode Island customers (not counting payment-only data), or 10,000 or more while getting over 20% of gross revenue from selling personal data.
One duty has no threshold: any commercial website or internet service provider with Rhode Island customers that collects, stores and sells personally identifiable information must say what categories it collects and name every third party it has sold, or may sell, that information to. Put this in the customer agreement or another conspicuous place on the site.
Nonprofits are exempt, as are government bodies, colleges, Gramm-Leach-Bliley financial institutions and HIPAA covered entities.
Visitors’ rights and your deadlines
- Rights to confirm and access, correct, delete, get a portable copy, and opt out of targeted advertising, sale and profiling, directly or through an authorized agent.
- You don’t have to verify identity for an opt-out.
- Respond within 45 days, extendable by 45 more. Free once every 12 months.
- Appeals: answer within 60 days; a denial must say the customer can complain to the Attorney General.
Opt-out signals and sensitive data
Rhode Island doesn’t require honoring universal opt-out signals such as Global Privacy Control.
Sensitive data, including a known child’s data and precise geolocation, needs consent, and you have 15 days to act on a withdrawal. Children’s data also follows COPPA. Data protection assessments are required for targeted advertising, sale and sensitive data.
Your notice
The notice must identify every category of personal data you collect, the third parties you sell it to, and an active email address or other online way to reach you. If you sell data or use it for targeted advertising, disclose that clearly and conspicuously.
Enforcement
The Attorney General has sole enforcement authority; there’s no private right of action, and the statute has no cure period. A violation is a deceptive trade practice, which carries civil penalties of up to $10,000 per violation. Intentionally disclosing personal data in violation of the law adds a fine of $100 to $500 per disclosure.
Where GoConsent helps
Privacy Policy builder
A Privacy Policy with a Notice at Collection, written from your settings and your latest scan, drafted to cover the points privacy laws describe. Review it with your lawyer.
Opt-outs and requests
Your Privacy Choices with a Marketing switch, “Opt out using your email”, and a Requests tab with deadlines and reminders.
Copy and delete requests (Pro)
Visitors ask for a copy of their information or for it to be deleted from Your Privacy Choices, with a 45-day deadline, a checklist and reminders.
Children’s Privacy Policy (Pro)
A children’s privacy notice page for sites that may collect information from children under 13.
A plain-English summary, last reviewed October 26, 2026. It isn’t legal advice, and some duties depend on how your business handles data, such as security programs and answering access requests. Read the official text and talk to a lawyer about your situation.
FAQ
Questions, answered
Does Rhode Island’s law apply to small websites?
One part does: any commercial website that sells Rhode Island customers’ personal information must name the third parties it sells to.
Is there a cure period in Rhode Island?
No. The statute doesn’t give one.
Do I have to honor Global Privacy Control in Rhode Island?
The law doesn’t require it.
Check your site against this law
GoConsent scans your site, tells you which laws likely apply and what to fix. Free, with no visit limits.
