{ "type": "practice-guide", "canonical": "https://openagreements.org/practice-guides/privacy/us/rhode-island", "links": [ { "rel": "self", "href": "https://openagreements.org/practice-guides/privacy/us/rhode-island.json", "type": "application/json" }, { "rel": "alternate", "href": "https://openagreements.org/practice-guides/privacy/us/rhode-island", "type": "text/html" }, { "rel": "alternate", "href": "https://openagreements.org/practice-guides/privacy/us/rhode-island/markdown", "type": "text/markdown" }, { "rel": "alternate", "href": "https://openagreements.org/practice-guides/privacy/us/rhode-island/json", "type": "application/json" } ], "data": { "topic": "privacy", "state": "rhode-island", "frontmatter": { "title": "Rhode Island Consumer Privacy Law (RIDTPPA)", "description": "The Rhode Island Data Transparency and Privacy Protection Act, effective January 1, 2026, sets information-sharing-practices disclosure duties for commercial websites and broader controller obligations — sensitive-data consent and processor contracts — on for-profit entities above defined customer thresholds, enforced exclusively by the Attorney General with no private right of action.", "state": "Rhode Island", "lastReviewed": "2026-06-06", "license": "CC BY 4.0", "authors": [ "steven-obiajulu" ], "summary": { "keyLaw": "R.I. Gen. Laws ch. 6-48.1 (Rhode Island Data Transparency and Privacy Protection Act), effective January 1, 2026", "appliesTo": "Two tracks: any commercial website or internet service provider that collects, stores, and sells customers' personal information must post information-sharing disclosures; the broader controller duties reach for-profit entities that control or process the data of 35,000+ Rhode Island customers, or 10,000+ while deriving over 20% of gross revenue from data sales. Financial institutions, GLBA/HIPAA data, nonprofits, and government bodies are exempt.", "privacyPolicyRequired": "Yes — a commercial website or ISP that collects, stores, and sells customers' personal information must conspicuously disclose data categories, the third parties it sells to, and a contact mechanism", "privateRightOfAction": "No — the statute expressly forbids any private right of action; the Attorney General is the sole enforcer", "regulator": "Rhode Island Attorney General (sole enforcement authority)", "bottomLine": "If your commercial website sells Rhode Island customers' personal information, RIDTPPA requires an information-sharing-practices notice; meeting the 35,000-customer (or 10,000-plus-20%-data-sale) threshold adds opt-in consent for sensitive data and binding processor contracts — all enforced by the Attorney General, with no consumer lawsuits.", "lawCoverage": "limitedScope", "policyMandate": "statutoryContents", "consumersCanSue": "no", "sensitiveDataConsent": "optIn", "universalOptOutSignal": "notRequired" }, "about": [ "Rhode Island Data Transparency and Privacy Protection Act RIDTPPA", "Rhode Island privacy policy requirements", "Rhode Island information sharing practices notice", "RIDTPPA applicability thresholds", "RIDTPPA sensitive data consent", "RIDTPPA processor contract requirements", "Rhode Island Attorney General privacy enforcement", "RIDTPPA no private right of action" ], "translations": [ { "language": "中文", "status": "planned" }, { "language": "Español", "status": "planned" }, { "language": "Português", "status": "planned" }, { "language": "Deutsch", "status": "planned" } ] }, "questions": [ { "slug": "does-ridtppa-apply", "label": "Does the Rhode Island privacy law apply to your business?", "heading": "Does the Rhode Island privacy law apply to your business?", "answerText": "It depends which duty you are asking about, because RIDTPPA runs on two tracks. The disclosure duty reaches any commercial website or internet service provider doing business in Rhode Island that collects, stores, and sells customers' personally identifiable information. The broader controller duties apply only to for-profit entities that, in the preceding year, controlled or processed the data of at least 35,000 Rhode Island customers, or at least 10,000 customers while earning more than 20% of gross revenue from selling personal data.", "sources": [ { "id": "stat-3-apply", "authorityType": "primary-law", "tier": "primary-source-backed", "title": "R.I. Gen. Laws § 6-48.1-3", "citation": "R.I. Gen. Laws § 6-48.1-3(a).", "url": "https://webserver.rilegislature.gov/Statutes/TITLE6/6-48.1/6-48.1-3.htm", "proposition": "The information-sharing-practices disclosure duty applies to any commercial website or internet service provider that collects, stores, and sells customers' personally identifiable information.", "verbatimQuote": "Any commercial website or internet service provider conducting business in Rhode Island or with customers in Rhode Island or otherwise subject to Rhode Island jurisdiction, shall designate a controller.", "anchor": "https://openagreements.org/practice-guides/privacy/us/rhode-island#src-stat-3-apply" }, { "id": "stat-4-apply", "authorityType": "primary-law", "tier": "primary-source-backed", "title": "R.I. Gen. Laws § 6-48.1-4", "citation": "R.I. Gen. Laws § 6-48.1-4(a).", "url": "https://webserver.rilegislature.gov/Statutes/TITLE6/6-48.1/6-48.1-4.htm", "proposition": "The broader controller duties apply to for-profit entities that control or process the data of at least 35,000 Rhode Island customers, or 10,000-plus while deriving over 20% of gross revenue from selling personal data.", "verbatimQuote": "This section shall apply to for-profit entities that conduct business in the state or for-profit entities that produce products or services that are targeted to residents of the state and that during the preceding calendar year did any of the following: (1) Controlled or processed the personal data of not less than thirty-five thousand (35,000) customers, excluding personal data controlled or processed solely for the purpose of completing a payment transaction. (2) Controlled or processed the personal data of not less than ten thousand (10,000) customers and derived more than twenty percent (20%) of their gross revenue from the sale of personal data.", "anchor": "https://openagreements.org/practice-guides/privacy/us/rhode-island#src-stat-4-apply" } ] }, { "slug": "privacy-policy-contents", "label": "What must your Rhode Island privacy notice contain?", "heading": "What must your Rhode Island privacy notice contain?", "answerText": "If your commercial website or service collects, stores, and sells customers' personally identifiable information, you must — in the customer agreement, an incorporated addendum, or another conspicuous location — identify the categories of personal data you collect, identify the third parties you have sold or may sell that data to, and give an email address or other online way for the customer to reach you. If you sell personal data or process it for targeted advertising, you must also disclose that clearly and conspicuously.", "sources": [ { "id": "stat-3-notice", "authorityType": "primary-law", "tier": "primary-source-backed", "title": "R.I. Gen. Laws § 6-48.1-3", "citation": "R.I. Gen. Laws § 6-48.1-3(a).", "url": "https://webserver.rilegislature.gov/Statutes/TITLE6/6-48.1/6-48.1-3.htm", "proposition": "A controller that collects, stores, and sells customers' personally identifiable information must disclose the categories of personal data collected, the third parties it sells to, and a contact mechanism.", "verbatimQuote": "(1) Identify all categories of personal data that the controller collects through the website or online service about customers; (2) Identify all third parties to whom the controller has sold or may sell customers’ personally identifiable information; and (3) Identify an active electronic mail address or other online mechanism that the customer may use to contact the controller.", "anchor": "https://openagreements.org/practice-guides/privacy/us/rhode-island#src-stat-3-notice" }, { "id": "stat-3-targeted", "authorityType": "primary-law", "tier": "primary-source-backed", "title": "R.I. Gen. Laws § 6-48.1-3", "citation": "R.I. Gen. Laws § 6-48.1-3(b).", "url": "https://webserver.rilegislature.gov/Statutes/TITLE6/6-48.1/6-48.1-3.htm", "proposition": "A controller that sells personal data or processes it for targeted advertising must clearly and conspicuously disclose that processing.", "verbatimQuote": "If a controller sells personal data to third parties or processes personal data for targeted advertising, the controller shall clearly and conspicuously disclose such processing.", "anchor": "https://openagreements.org/practice-guides/privacy/us/rhode-island#src-stat-3-targeted" } ] }, { "slug": "vendor-contracts", "label": "What must your contracts with processors say?", "heading": "What must your contracts with processors say?", "answerText": "A contract between a controller and a processor must govern how the processor handles data on the controller's behalf, so a data processing agreement is a statutory requirement, not a best practice. That contract has to set out the processing instructions, the nature and purpose of processing, the type of data, the duration, and each party's rights and obligations, and it must bind the processor to specific duties.", "sources": [ { "id": "stat-7-contract", "authorityType": "primary-law", "tier": "primary-source-backed", "title": "R.I. Gen. Laws § 6-48.1-7", "citation": "R.I. Gen. Laws § 6-48.1-7(c).", "url": "https://webserver.rilegislature.gov/Statutes/TITLE6/6-48.1/6-48.1-7.htm", "proposition": "A contract between a controller and a processor must govern the processor's data processing performed on behalf of the controller.", "verbatimQuote": "A contract between a controller and a processor shall govern the processor’s data processing procedures with respect to processing performed on behalf of the controller.", "anchor": "https://openagreements.org/practice-guides/privacy/us/rhode-island#src-stat-7-contract" }, { "id": "stat-7-terms", "authorityType": "primary-law", "tier": "primary-source-backed", "title": "R.I. Gen. Laws § 6-48.1-7", "citation": "R.I. Gen. Laws § 6-48.1-7(c).", "url": "https://webserver.rilegislature.gov/Statutes/TITLE6/6-48.1/6-48.1-7.htm", "proposition": "The controller-processor contract must set out processing instructions, nature and purpose, type of data, duration, and the parties' rights and obligations, and must require the processor to keep data confidential, delete or return data at the controller's direction, make compliance information available, bind subcontractors by written contract, and allow and cooperate with reasonable assessments.", "verbatimQuote": "The contract shall be binding and clearly set forth instructions for processing data; the nature and purpose of processing; the type of data subject to processing; the duration of processing; and the rights and obligations of both parties. The contract shall also require that the processor: (1) Ensure that each person processing personal data is subject to a duty of confidentiality with respect to the data; (2) At the controller’s direction, delete or return all personal data to the controller as requested at the end of the provision of services, unless retention of the personal data is required by law; (3) Upon the reasonable request of the controller, make available to the controller all information in its possession necessary to demonstrate the processor’s compliance with the obligations of this chapter; (4) After providing the controller an opportunity to object, engage any subcontractor pursuant to a written contract that requires the subcontractor to meet the obligations of the processor with respect to the personal data; and (5) Allow, and cooperate with, reasonable assessments by the controller or the controller’s designated assessor", "anchor": "https://openagreements.org/practice-guides/privacy/us/rhode-island#src-stat-7-terms" } ] }, { "slug": "sensitive-data", "label": "Do you need consent to process sensitive data?", "heading": "Do you need consent to process sensitive data?", "answerText": "Yes. A covered controller may not process a customer's sensitive data without obtaining the customer's consent, and it may not process the sensitive data of a known child unless it gets consent and handles the data under the federal Children's Online Privacy Protection Act. Sensitive data includes data revealing racial or ethnic origin, religious beliefs, a health condition or diagnosis, sex life, sexual orientation, or citizenship or immigration status; genetic or biometric data used to identify someone; data from a known child; and precise geolocation.", "sources": [ { "id": "stat-7-consent", "authorityType": "primary-law", "tier": "primary-source-backed", "title": "R.I. Gen. Laws § 6-48.1-4", "citation": "R.I. Gen. Laws § 6-48.1-4(c).", "url": "https://webserver.rilegislature.gov/Statutes/TITLE6/6-48.1/6-48.1-4.htm", "proposition": "A controller may not process a customer's sensitive data without consent, and may not process a known child's sensitive data unless consent is obtained and the data is handled in accordance with COPPA.", "verbatimQuote": "The controller shall not process sensitive data concerning a customer without obtaining customer consent and shall not process sensitive data of a known child unless consent is obtained and the information is processed in accordance with COPPA.", "anchor": "https://openagreements.org/practice-guides/privacy/us/rhode-island#src-stat-7-consent" }, { "id": "stat-2-sensitive", "authorityType": "primary-law", "tier": "primary-source-backed", "title": "R.I. Gen. Laws § 6-48.1-2", "citation": "R.I. Gen. Laws § 6-48.1-2(26).", "url": "https://webserver.rilegislature.gov/Statutes/TITLE6/6-48.1/6-48.1-2.htm", "proposition": "Sensitive data includes data revealing race or ethnicity, religious beliefs, health condition, sex life, sexual orientation, or citizenship or immigration status; genetic or biometric data used to identify an individual; data from a known child; and precise geolocation.", "verbatimQuote": "“Sensitive data” means personal data that includes data revealing racial or ethnic origin, religious beliefs, mental or physical health condition or diagnosis, sex life, sexual orientation or citizenship or immigration status, the processing of genetic or biometric data for the purpose of uniquely identifying an individual, personal data collected from a known child, or precise geolocation data.", "anchor": "https://openagreements.org/practice-guides/privacy/us/rhode-island#src-stat-2-sensitive" } ] }, { "slug": "consumer-lawsuit", "label": "Can a customer sue your business under the Rhode Island privacy law?", "heading": "Can a customer sue your business under the Rhode Island privacy law?", "answerText": "No. The statute expressly says nothing in it authorizes a private right of action. Enforcement rests solely with the Attorney General, who may proceed under the chapter itself or under the general regulatory provisions of commercial law.", "sources": [ { "id": "stat-8-nopra", "authorityType": "primary-law", "tier": "primary-source-backed", "title": "R.I. Gen. Laws § 6-48.1-8", "citation": "R.I. Gen. Laws § 6-48.1-8(c).", "url": "https://webserver.rilegislature.gov/Statutes/TITLE6/6-48.1/6-48.1-8.htm", "proposition": "The statute does not authorize any private right of action to enforce the chapter.", "verbatimQuote": "Nothing in this section shall be construed to authorize any private right of action to enforce any provision of this chapter, any regulation hereunder, or any other provisions of law.", "anchor": "https://openagreements.org/practice-guides/privacy/us/rhode-island#src-stat-8-nopra" }, { "id": "stat-8-ag", "authorityType": "primary-law", "tier": "primary-source-backed", "title": "R.I. Gen. Laws § 6-48.1-8", "citation": "R.I. Gen. Laws § 6-48.1-8(b).", "url": "https://webserver.rilegislature.gov/Statutes/TITLE6/6-48.1/6-48.1-8.htm", "proposition": "The Attorney General has sole enforcement authority and may enforce under the chapter or under the general regulatory provisions of commercial law.", "verbatimQuote": "The attorney general shall have sole enforcement authority of the provisions of this chapter and may enforce a violation of this chapter pursuant to:", "anchor": "https://openagreements.org/practice-guides/privacy/us/rhode-island#src-stat-8-ag" }, { "id": "stat-8-fine", "authorityType": "primary-law", "tier": "primary-source-backed", "title": "R.I. Gen. Laws § 6-48.1-8", "citation": "R.I. Gen. Laws § 6-48.1-8(a).", "url": "https://webserver.rilegislature.gov/Statutes/TITLE6/6-48.1/6-48.1-8.htm", "proposition": "A violation is a violation of the general regulatory provisions of commercial law and a deceptive trade practice, and intentional disclosure to a shell company or in violation of the chapter carries a $100-$500 fine per disclosure.", "verbatimQuote": "A violation of this chapter constitutes a violation of the general regulatory provisions of commercial law in this title and shall constitute a deceptive trade practice in violation of chapter 13.1 of this title", "anchor": "https://openagreements.org/practice-guides/privacy/us/rhode-island#src-stat-8-fine" } ] } ] } }