What Is the RIDTPPA? Rhode Island Data Privacy Act

The Rhode Island Data Transparency and Privacy Protection Act (RIDTPPA), codified at R.I. Gen. Laws ch. 6-48.1, is Rhode Island's first comprehensive consumer data privacy law. It was enacted in 2024 through companion bills H 7787 and S 2500, became law in June 2024, and takes effect on January 1, 2026. The law gives Rhode Island residents rights to access, correct, delete, and port their personal data and to opt out of targeted advertising, data sales, and certain profiling.

As of 2026, the RIDTPPA is enforced exclusively by the Rhode Island Attorney General. A violation is a deceptive trade practice under R.I. Gen. Laws ch. 6-13.1, which exposes a violator to a civil penalty of up to $10,000 per violation under 6-13.1-8, in addition to the $100 to $500 fine that 6-48.1-8(a)(2) sets for each intentional disclosure made in violation of the chapter. There is no private right of action and no statutory right to cure, so a covered business does not get a guaranteed grace period to fix a violation before the Attorney General can act.

Jurisdiction scope: This covers Rhode Island's Data Transparency and Privacy Protection Act (R.I. Gen. Laws ch. 6-48.1). It is general legal information, not legal advice.

What the RIDTPPA is: statute, enactment, and effective date

The Rhode Island Data Transparency and Privacy Protection Act is Rhode Island's first omnibus consumer privacy statute. It is codified in the General Laws at chapter 6-48.1, and section 6-48.1-1 provides that the chapter "shall be known and may be cited as" the Rhode Island Data Transparency and Privacy Protection Act. The name itself signals the law's focus on transparency about data sharing.

The chapter was created during the 2024 legislative session through two companion bills, H 7787 in the House and S 2500 in the Senate. The legislation cleared the General Assembly in June 2024 and became law that month. The 2024 enacting acts, P.L. 2024, ch. 430 and P.L. 2024, ch. 453, set a single effective date of January 1, 2026 for the entire chapter, giving covered businesses roughly eighteen months to prepare before their obligations begin. No individual section fixes that date; it is carried as a bracketed annotation in the heading of every section in chapter 6-48.1.

As of 2026, that effective date has arrived and the law is operative. Rhode Island joins a large group of states with omnibus privacy statutes loosely modeled on the framework first adopted in Virginia and Connecticut. The RIDTPPA shares much of that structure, including controller and processor roles, a consumer rights catalog, and opt-in consent for sensitive data. For the full controller and processor obligations, see the Rhode Island data privacy laws parent page.

Why the RIDTPPA is viewed as a lighter-touch law

Privacy practitioners widely describe the RIDTPPA as one of the more lightly drafted state privacy laws, and that nuance is worth stating plainly. The statute borrows the familiar rights catalog and the opt-in sensitive-data rule, but it omits several guardrails that newer laws include and uses looser drafting in places.

Two omissions stand out. First, the RIDTPPA does not require controllers to honor a universal opt-out preference signal such as the Global Privacy Control, a mechanism that Colorado, Connecticut, and a growing number of states now mandate. Section 6-48.1-6 describes how customers exercise their rights and permits authorized agents, but it contains no universal opt-out signal obligation. Second, the law provides no statutory right to cure, yet it also does not include the detailed data-minimization and contracting scaffolding that some sister statutes spell out at length.

The result is a law that grants real consumer rights but is generally seen as less prescriptive than the Connecticut or Colorado models. Businesses that already comply with a stricter state law will usually clear the Rhode Island bar with little additional work. The one place where Rhode Island asks for something distinctive is its website third-party disclosure duty, discussed next.

The signature feature: website third-party disclosure

The RIDTPPA's most distinctive requirement lives in section 6-48.1-3, titled "Information sharing practices." It applies to a commercial website or internet service provider that operates in Rhode Island or serves Rhode Island customers and that collects, stores, and sells customers' personally identifiable information. Once that conjunctive trigger is met, the controller must, in its customer-facing disclosure, do three things.

It must identify all of the categories of personal data that the controller collects through the website or application. It must identify all third parties to whom the controller has sold or may sell customers' personally identifiable information. And it must provide an active means by which a customer can contact the controller about its data practices.

The second item is the quirk. Most state privacy laws ask only for the categories of third parties with whom a controller shares data. Rhode Island's text reaches further, requiring a controller to "identify all third parties" to whom it "has sold or may sell" personal data. Read literally, that is a broader naming duty than the category-level disclosures elsewhere, and it is the feature that gives the act its "transparency" name. Section 6-48.1-3 also requires a controller that sells personal data or processes it for targeted advertising to clearly and conspicuously disclose that processing.

Who the RIDTPPA covers: applicability thresholds

The applicability test sits in section 6-48.1-4. The law reaches a for-profit entity that conducts business in Rhode Island, or that produces products or services targeted to Rhode Island residents, and that during a calendar year controlled or processed the personal data of either of two groups.

The first trigger is 35,000 or more customers, "excluding personal data controlled or processed solely for the purpose of completing a payment transaction." The payment carve-out means a retailer does not count routine card transactions toward the threshold when the only data involved is what is needed to complete that single purchase.

The second trigger is 10,000 or more customers, but only when the business "derived more than twenty percent (20%) of their gross revenue from the sale of personal data." This lower headcount captures data-driven businesses whose revenue depends on selling personal information. The 20 percent figure is notable, because several other state laws set the comparable revenue test at 25 percent, so Rhode Island's data-sale trigger is slightly easier to meet.

A defined term matters here. The statute uses "customer" rather than "consumer," and section 6-48.1-2 defines a customer as an individual residing in Rhode Island acting in an individual or household context. Data about people acting in a commercial or employment context is generally outside that definition.

RIDTPPA's threshold-based obligations also reach only for-profit entities. Section 6-48.1-4(a) limits its threshold test to for-profit entities, so a nonprofit that otherwise meets the customer-count test is not covered by it. Section 6-48.1-3(d) separately excludes the entire chapter for state and local government bodies, nonprofit organizations, institutions of higher education, national securities associations registered under 15 U.S.C. 78o-3, GLBA-regulated financial institutions, and HIPAA covered entities and business associates. Sections 6-48.1-3(e) and 6-48.1-10 add further carve-outs, including research data, FCRA-regulated consumer reporting agency data, driver's license data under the Driver's Privacy Protection Act, FERPA-covered education records, certain employment-context data, Airline Deregulation Act data, and information held by tax-exempt organizations.

Sensitive data and the opt-in consent rule

Sensitive data sits at the center of the RIDTPPA because processing it requires opt-in consent. Under section 6-48.1-4, a controller "shall not process sensitive data concerning a customer without obtaining customer consent," and may not process the sensitive data of a known child except with consent and in accordance with the federal Children's Online Privacy Protection Act. Consent must be a clear affirmative act, not a pre-checked box or inferred from inaction.

The definition of sensitive data in section 6-48.1-2 is broad. It includes personal data revealing racial or ethnic origin, religious beliefs, a mental or physical health condition or diagnosis, sex life, sexual orientation, or citizenship or immigration status. It also includes genetic or biometric data processed to uniquely identify an individual, personal data collected from a known child, and precise geolocation data.

Because sensitive data triggers an opt-in gate, the breadth of the definition has operational weight. A business that processes health information, immigration status, biometric identifiers, or precise location must obtain affirmative consent before that processing begins. Section 6-48.1-4 also requires a controller to give customers a way to grant and revoke consent, and to honor a revocation within 15 days of receipt.

RIDTPPA vs. CCPA: the key differences

Rhode Island's RIDTPPA and California's CCPA are often compared by companies that operate nationally. The state data privacy law comparison page covers the broader multistate picture, but several differences between the RIDTPPA and California's CCPA stand out.

The most consequential difference is the coverage net. Rhode Island's 35,000-customer threshold and the absence of a dollar-revenue floor pull in companies that California's $25 million revenue trigger would leave out, even though California's law is often described as the strictest in the country on other dimensions.

The two laws also differ on the universal opt-out signal and on sensitive data. California requires recognition of opt-out preference signals such as the Global Privacy Control and uses a "right to limit" the use of sensitive personal information. Rhode Island does not mandate a universal opt-out signal and instead requires opt-in consent before sensitive data may be processed. Where Rhode Island goes further than California is its named third-party disclosure duty under 6-48.1-3.

Related guides

• Rhode Island data privacy laws parent hub
• RIDTPPA consumer rights
• RIDTPPA compliance checklist
• State data privacy law comparison
• What is the CCPA?

More Rhode Island Laws

• Rhode Island Deepfake Laws
• Rhode Island Employee Monitoring Laws
• Rhode Island GPS Tracking Laws
• Rhode Island Recording Laws

Frequently Asked Questions

What is the RIDTPPA?

The RIDTPPA, or Rhode Island Data Transparency and Privacy Protection Act, is Rhode Island's comprehensive consumer data privacy law codified at R.I. Gen. Laws ch. 6-48.1. It was enacted in 2024 through bills H 7787 and S 2500, became law in June 2024, and takes effect January 1, 2026. It gives Rhode Island residents rights over their personal data and requires covered businesses to disclose how they collect, use, and share it.

When does the Rhode Island Data Transparency and Privacy Protection Act take effect?

The RIDTPPA takes effect on January 1, 2026, the effective date set by the 2024 enacting legislation for the entire chapter. The law was passed in June 2024, so covered businesses had roughly eighteen months to prepare. As of 2026, the law is operative and the Attorney General has enforcement authority.

Who has to comply with the RIDTPPA?

Under section 6-48.1-4, the RIDTPPA applies to a for-profit business that conducts business in Rhode Island or targets Rhode Island residents and that, during a calendar year, controls or processes the personal data of 35,000 or more customers, or of 10,000 or more customers while deriving more than 20 percent of gross revenue from the sale of personal data. The first threshold excludes data processed solely to complete a payment transaction. Nonprofits, higher-education institutions, government bodies, GLBA financial institutions, and HIPAA covered entities and business associates are exempt from the chapter under 6-48.1-3(d).

What is the RIDTPPA third-party disclosure requirement?

Section 6-48.1-3 requires a commercial website or internet service provider that collects, stores, and sells customers' personally identifiable information to disclose the categories of personal data it collects and to identify all third parties to whom the controller has sold or may sell that information, along with an active means of contact. The duty to name third parties, rather than just disclose categories of third parties, is the law's signature feature and the reason it is called a transparency act.

Does the RIDTPPA require a universal opt-out signal?

No. As of 2026, the RIDTPPA does not require controllers to recognize a universal opt-out preference signal such as the Global Privacy Control. Section 6-48.1-6 describes how customers exercise opt-out rights and allows authorized agents, but it contains no universal opt-out mechanism mandate. This is one reason the law is viewed as lighter-touch than the Colorado or Connecticut models.

What counts as sensitive data under the RIDTPPA?

Under section 6-48.1-2, sensitive data includes data revealing racial or ethnic origin, religious beliefs, a mental or physical health condition or diagnosis, sex life, sexual orientation, or citizenship or immigration status. It also includes genetic or biometric data used to identify a person, personal data collected from a known child, and precise geolocation data. Processing sensitive data requires opt-in consent under section 6-48.1-4.

How is the RIDTPPA different from the CCPA?

Key differences: Rhode Island's coverage threshold is 35,000 customers with no dollar floor, while California's CCPA uses a $25 million revenue trigger among its tests; Rhode Island requires opt-in consent for sensitive data while California uses an opt-out right to limit; Rhode Island does not require a universal opt-out signal while California does; Rhode Island uniquely requires controllers to identify all third parties to whom they sell or may sell data; and California has a limited private right of action for certain breaches while Rhode Island has none.

Who enforces the RIDTPPA?

The Rhode Island Attorney General has sole enforcement authority under section 6-48.1-8. A violation is a deceptive trade practice under R.I. Gen. Laws ch. 6-13.1, which authorizes the Attorney General to seek a civil penalty of up to $10,000 per violation under 6-13.1-8. Intentional disclosure of personal data in violation of the chapter carries an additional fine of not less than $100 and no more than $500 for each such disclosure under 6-48.1-8(a)(2). There is no private right of action and no statutory right to cure.