Rhode Island Data Transparency and Privacy Protection Act

Does Rhode Island have a comprehensive privacy law? Yes. The Rhode Island Data Transparency and Privacy Protection Act became law without the Governor’s signature on June 28, 2024, and took effect January 1, 2026.

• Status: In Effect
• Law: Rhode Island Data Transparency and Privacy Protection Act (S 2500 / H 7787, 2024; R.I. Gen. Laws chapter 6-48.1)
• Signed: Became law without the Governor’s signature on June 28, 2024 · Effective: January 1, 2026
• Applies to: Most duties apply to for-profit entities that conduct business in Rhode Island or target its residents and, in the preceding calendar year, controlled or processed the personal data of at least 35,000 customers (excluding data processed solely to complete a payment transaction), or of at least 10,000 customers while deriving more than 20% of gross revenue from selling personal data; the disclosure duties for commercial websites and internet service providers that sell personal data have no threshold
• Cure period: No
• Enforcement: Attorney General (sole authority); violations are deceptive trade practices under R.I. Gen. Laws chapter 6-13.1; fines of $100 to $500 for each intentional disclosure of personal data in violation of the act; no private right of action
• Last verified: November 4, 2026 · Official source: Rhode Island Public Law 2024 (S 2500)
• Related: Rhode Island privacy act guide

As of January 1, 2026, the Rhode Island Data Transparency and Privacy Protection Act (RIDTPPA) is in force. The law establishes enforceable transparency requirements for organizations that sell the personal data of Rhode Island residents through websites or online services.

RIDTPPA focuses on clear disclosure of data sales practices. Covered organizations are required to publicly describe how personal data is sold and shared, with specific attention to third-party recipients.

Active Compliance Requirements

Organizations subject to RIDTPPA are required to:

• Disclose whether personal data is sold
  
• Identify the categories of personal data involved
  
• List all third parties to whom personal data has been sold or may be sold
  
• Maintain privacy notices that accurately reflect current data-sharing practices

Scope and Applicability

RIDTPPA’s disclosure duties apply to commercial websites and internet service providers that sell Rhode Island customers’ personal data, whatever their size. Its other duties, such as consumer rights, consent for sensitive data and data protection assessments, apply to for-profit entities that controlled or processed the personal data of at least 35,000 customers in the preceding calendar year, or of at least 10,000 customers while deriving more than 20% of gross revenue from selling personal data.

Enforcement and Penalties

Enforcement is handled by the Rhode Island Attorney General. Violations are addressed under the state’s Unfair and Deceptive Acts and Practices (UDAP) statute, with:

• Civil penalties of up to $10,000 per violation
  
• Fines of $100 to $500 for each intentional disclosure of personal data in violation of the act
  

Operational Impact

For privacy and compliance teams, RIDTPPA introduces a disclosure-driven compliance obligation. Ongoing alignment between data-sharing practices, third-party relationships, and published privacy notices is central to meeting the law’s requirements.

History of the RIDTPPA

On June 13, 2024, the Rhode Island legislature passed the Rhode Island Data Transparency and Privacy Protection Act (SB 2500 / HB 7787). The act became law without the Governor’s signature on June 28, 2024, and took effect on January 1, 2026. The Rhode Island privacy legislation aims to protect citizens’ personal information in an increasingly digital world. Let’s dive into the key aspects of this new legislation and what it means for residents and businesses alike.

Key Points of RIDTPPA

1. Transparency Requirements: The law imposes transparency requirements specifically on websites and ISPs that sell personal data, without exemptions for small businesses.
2. Privacy Notices: Controllers are required to identify all third parties to whom they have sold or may sell personal information in the future.
3. Omissions: Unlike other state privacy laws, RIDTPPA lacks heightened protections for adolescents, general data minimization requirements, default consumer rights exercises through Universal Opt-Out Mechanisms, and a right to cure alleged violations.

Legislative Process

• The legislature passed the act (S2500 / H7787) on June 13, 2024.
• The act became law without the Governor’s signature on June 28, 2024, and took effect on January 1, 2026.

Penalties

The act links violations to the state Unfair and Deceptive Acts and Practices (UDAP) statute, which provides for civil penalties of up to $10,000. Additionally, a fine of $100 to $500 applies to each intentional disclosure of personal data in violation of the act.

Looking Ahead

RIDTPPA makes Rhode Island one of the states with comprehensive privacy laws, adding to the growing number of states implementing data privacy protections.