Rhode Island Data Transparency and Privacy Protection Act

Effective January 2026. Consumer access, correction, deletion, and opt-out rights. Applies to controllers with 35,000 or more consumers or 10,000 consumers where data sales exceed 20% of revenue.

JurisdictionRhode Island
CategoryPrivacy & Data Protection
StatusActive
Effective date
Latest development

Analysis

Rhode Island’s Data Transparency and Privacy Protection Act (RIDTPPA) is a comprehensive state privacy law effective January 1, 2026, granting Rhode Island consumers rights to access, correct, delete, and opt out of certain data uses, and applying to for‑profit controllers meeting specified data‑volume and revenue thresholds.Rhode Island General Laws – Chapter 6‑48.1Koley Jessen summaryWilmerHale analysis

Key Requirements

Scope and Applicability

Consumer Rights

Controller Obligations

Exemptions

Enforcement and Penalties

Compliance Challenges

  • No cure period – higher enforcement risk
  • Absence of a cure window and \$10,000 per‑violation penalties increase risk; similar challenges have been documented under other state privacy laws, where organizations faced substantial enforcement costs.TrustArc overviewKoley Jessen summaryOsano overview

Real‑World Examples and Analogues

Because Rhode Island’s law is not yet effective, public enforcement cases are not available; however, similar comprehensive state privacy regimes provide concrete analogues:

Implementation Best Practices

  • Conduct a Rhode Island‑specific data inventory and mapping
  • Map all Rhode Island consumer data, identify sensitive data, and document flows to third parties to support rights fulfillment and DPIAs.[TrustArc overview](https://trustarc.com/resource/rhode-island

Recent developments

  • — TrustArc analyzes the Rhode Island Data Transparency and Privacy Protection Act (RIDTPPA), highlighting its January 1, 2026 effective date, scope thresholds (35,000/10,000 customers), consumer rights (access, correction, deletion, opt-out), and high penalties of up to $10,000 per violation, positioning it as one of the stricter state privacy laws.[3] (source)
  • — Koley Jessen summarizes Rhode Island’s law alongside Indiana and Kentucky, noting its Washington Privacy Act–style framework, opt-in requirement for sensitive data, and exclusive enforcement by the Rhode Island Attorney General with penalties up to $10,000 per violation, prompting multistate compliance planning by covered entities.[4] (source)
  • — Osano provides a practical compliance guide to RIDTPPA ahead of its 2026 start date, detailing applicability thresholds, required consumer rights processes, affirmative opt-in for sensitive data, and the lack of a cure period, warning that organizations face immediate fines up to $10,000 per deceptive trade practice violation plus $100–$500 per intentional disclosure.[2] (source)
  • — White & Case issues a client alert on Rhode Island’s enactment of the Data Transparency and Privacy Protection Act (Rhode Island Data Privacy Act), emphasizing its January 1, 2026 effective date, DPIA obligations for high‑risk processing, broad sensitive data definition, and exclusive AG enforcement with no private right of action, signaling material compliance burdens for larger controllers.[1] (source)
  • — A JD Supra article notes that Rhode Island has become the nineteenth state with a comprehensive privacy law, describing key departures from the standard model such as broad privacy notice obligations for all commercial websites/ISPs, expansive third‑party sale disclosures, and the absence of a cure period, which industry commentators view as increasing enforcement risk.[7] (source)
  • — Perkins Coie’s Byte Back blog explains the legislature’s passage of RIDTPPA and its move to the governor, outlining applicability thresholds, unique requirements to identify all categories of personal data collected and third parties to whom data is or may be sold, and opt‑out rights for targeted advertising and sales, raising transparency expectations for online businesses.[6] (source)
  • — TrustArc’s early analysis stresses that RIDTPPA’s penalties (up to $10,000 per violation) exceed those in many other states and that the law covers not only threshold‑meeting for‑profit controllers but also commercial websites/ISPs that collect, store, and sell PII, prompting organizations to expand data inventories and update notices and DSAR workflows.[3] (source)
  • — Osano reports on the enactment of RIDTPPA on June 29, 2024, comparing it to other U.S. state privacy laws and noting consumer rights (access, correction, deletion, opt‑out of targeted ads/sales), mandatory opt‑in for sensitive data, and significant per‑violation penalties, with privacy vendors and counsel advising companies to align Rhode Island preparations with broader state‑law programs.[2] (source)
  • — White & Case highlights that violations of the Act constitute violations of Rhode Island’s commercial law (Title 6), subject to civil penalties up to $10,000 per violation and additional $100–$500 fines for intentional disclosures, signaling to industry that enforcement could be financially significant even without a private right of action.[1] (source)
  • — Following the June 13, 2024 legislative passage, Byte Back notes RIDTPPA’s Washington Privacy Act lineage and its unusually broad disclosure obligations for any controller selling personal data or engaging in targeted advertising, which commentators say may require many businesses to expand website disclosures even if they fall below usual applicability thresholds.[6] (source)

Related regulations

Put it into practice

Browse all regulations · Compliance deadlines · Latest updates