---
jurisdiction: "Rhode Island"
slug: rhode-island
countryCode: US
snapshotAsOf: "2026-06-12"
lastReviewed: "2026-06-06"
canonicalUrl: https://openagreements.org/legal/privacy/rhode-island
license: CC BY 4.0
stale: false
---

> [!IMPORTANT]
> **Informational only — not legal advice.** This is a snapshot of an OpenAgreements practice note,
> provided for general information. It is not legal advice, does not create an attorney-client
> relationship, and is not a substitute for a licensed attorney in the relevant jurisdiction.
> Laws change; verify against the canonical version before relying on it.
>
> **Canonical:** https://openagreements.org/legal/privacy/rhode-island · **Snapshot as of:** 2026-06-12 · License: CC BY 4.0 · © UseJunior

# Rhode Island Consumer Privacy Law (RIDTPPA)[^about]

The Rhode Island Data Transparency and Privacy Protection Act, effective January 1, 2026, sets information-sharing-practices disclosure duties for commercial websites and broader controller obligations — sensitive-data consent and processor contracts — on for-profit entities above defined customer thresholds, enforced exclusively by the Attorney General with no private right of action.


## At a glance

| Question | Rhode Island |
| --- | --- |
| **Summary** | If your commercial website sells Rhode Island customers' personal information, RIDTPPA requires an information-sharing-practices notice; meeting the 35,000-customer (or 10,000-plus-20%-data-sale) threshold adds opt-in consent for sensitive data and binding processor contracts — all enforced by the Attorney General, with no consumer lawsuits. |
| **Main law** | R.I. Gen. Laws ch. 6-48.1 (Rhode Island Data Transparency and Privacy Protection Act), effective January 1, 2026 |
| **Privacy policy required?** | Yes — a commercial website or ISP that collects, stores, and sells customers' personal information must conspicuously disclose data categories, the third parties it sells to, and a contact mechanism |
| **Who does it cover?** | Two tracks: any commercial website or internet service provider that collects, stores, and sells customers' personal information must post information-sharing disclosures; the broader controller duties reach for-profit entities that control or process the data of 35,000+ Rhode Island customers, or 10,000+ while deriving over 20% of gross revenue from data sales. Financial institutions, GLBA/HIPAA data, nonprofits, and government bodies are exempt. |
| **Can consumers sue?** | No — the statute expressly forbids any private right of action; the Attorney General is the sole enforcer |
| **Who enforces it?** | Rhode Island Attorney General (sole enforcement authority) |

## Does the Rhode Island privacy law apply to your business? {#does-ridtppa-apply}

**Short answer.** It depends which duty you are asking about, because RIDTPPA runs on two tracks. The disclosure duty reaches any commercial website or internet service provider doing business in Rhode Island that collects, stores, and sells customers' personally identifiable information [^stat-3-apply]. The broader controller duties apply only to for-profit entities that, in the preceding year, controlled or processed the data of at least 35,000 Rhode Island customers, or at least 10,000 customers while earning more than 20% of gross revenue from selling personal data [^stat-4-apply].

A customer here is an individual residing in Rhode Island acting in an individual or household context, so employees and business contacts do not count toward the thresholds. The split structure is the practical surprise: a small site that sells customer data can owe the disclosure obligations even if it never approaches the 35,000-customer floor that triggers the consent and contracting duties. Financial institutions and GLBA-regulated data, HIPAA-covered entities, nonprofits, and state and local government bodies sit outside the chapter entirely.

## What must your Rhode Island privacy notice contain? {#privacy-policy-contents}

**Short answer.** If your commercial website or service collects, stores, and sells customers' personally identifiable information, you must — in the customer agreement, an incorporated addendum, or another conspicuous location — identify the categories of personal data you collect, identify the third parties you have sold or may sell that data to, and give an email address or other online way for the customer to reach you [^stat-3-notice]. If you sell personal data or process it for targeted advertising, you must also disclose that clearly and conspicuously [^stat-3-targeted].

Rhode Island frames this as an information-sharing-practices notice rather than the all-purpose privacy policy other states require, and it is keyed to the act of selling data. The three required disclosures are the content checklist for a compliant Rhode Island notice. Note that the statute uses the term personally identifiable information in this section while using personal data elsewhere, so a notice that maps the data you actually collect and sell is the safer posture.

## What must your contracts with processors say? {#vendor-contracts}

**Short answer.** A contract between a controller and a processor must govern how the processor handles data on the controller's behalf, so a data processing agreement is a statutory requirement, not a best practice [^stat-7-contract]. That contract has to set out the processing instructions, the nature and purpose of processing, the type of data, the duration, and each party's rights and obligations, and it must bind the processor to specific duties [^stat-7-terms].

The required processor duties are a confidentiality obligation for everyone handling the data, deletion or return of data at the controller's direction, making compliance information available on request, binding any subcontractor by written contract to the same obligations after giving the controller a chance to object, and cooperating with reasonable assessments. A compliant template tracks each of these. A processor that starts deciding the purposes and means of processing becomes a controller and can itself face enforcement.

## Do you need consent to process sensitive data? {#sensitive-data}

**Short answer.** Yes. A covered controller may not process a customer's sensitive data without obtaining the customer's consent, and it may not process the sensitive data of a known child unless it gets consent and handles the data under the federal Children's Online Privacy Protection Act [^stat-7-consent]. Sensitive data includes data revealing racial or ethnic origin, religious beliefs, a health condition or diagnosis, sex life, sexual orientation, or citizenship or immigration status; genetic or biometric data used to identify someone; data from a known child; and precise geolocation [^stat-2-sensitive].

This is an opt-in model: consent must be a clear, affirmative act and cannot be obtained through dark patterns or buried in a broad terms-of-use document. Controllers also have to give customers a way to grant and revoke consent, and must act on a revocation within fifteen days. Processing sensitive data is one of the activities that triggers a documented data protection assessment under the same section.

## Can a customer sue your business under the Rhode Island privacy law? {#consumer-lawsuit}

**Short answer.** No. The statute expressly says nothing in it authorizes a private right of action [^stat-8-nopra]. Enforcement rests solely with the Attorney General, who may proceed under the chapter itself or under the general regulatory provisions of commercial law [^stat-8-ag].

A violation of the chapter is treated as a violation of the general regulatory provisions of commercial law and as a deceptive trade practice under Rhode Island law. The statute adds a targeted penalty for bad actors: anyone who intentionally discloses personal data to a shell company set up to circumvent the chapter, or otherwise discloses it in violation of the chapter, pays a fine of $100 to $500 per disclosure [^stat-8-fine]. Because there is no statutory cure period written into the section, the practical posture is to build the disclosure, consent, and contracting controls before a complaint reaches the Attorney General.

[^about]: By Steven Obiajulu, J.D. Published by [openagreements.org](https://openagreements.org) · Maintained by [UseJunior](https://usejunior.com). Last reviewed 2026-06-06. License: CC BY 4.0. Steven Obiajulu, J.D. is admitted in New York, not Rhode Island. This article synthesizes Rhode Island primary law and is not legal advice from a Rhode Island-admitted attorney. This article is for informational purposes only and does not create an attorney-client relationship.

[^stat-3-apply]: **R.I. Gen. Laws § 6-48.1-3** — "Any commercial website or internet service provider conducting business in Rhode Island or with customers in Rhode Island or otherwise subject to Rhode Island jurisdiction, shall designate a controller." *R.I. Gen. Laws § 6-48.1-3(a).* <https://webserver.rilegislature.gov/Statutes/TITLE6/6-48.1/6-48.1-3.htm>

[^stat-4-apply]: **R.I. Gen. Laws § 6-48.1-4** — "This section shall apply to for-profit entities that conduct business in the state or for-profit entities that produce products or services that are targeted to residents of the state and that during the preceding calendar year did any of the following: (1) Controlled or processed the personal data of not less than thirty-five thousand (35,000) customers, excluding personal data controlled or processed solely for the purpose of completing a payment transaction. (2) Controlled or processed the personal data of not less than ten thousand (10,000) customers and derived more than twenty percent (20%) of their gross revenue from the sale of personal data." *R.I. Gen. Laws § 6-48.1-4(a).* <https://webserver.rilegislature.gov/Statutes/TITLE6/6-48.1/6-48.1-4.htm>

[^stat-3-notice]: **R.I. Gen. Laws § 6-48.1-3** — "(1) Identify all categories of personal data that the controller collects through the website or online service about customers; (2) Identify all third parties to whom the controller has sold or may sell customers’ personally identifiable information; and (3) Identify an active electronic mail address or other online mechanism that the customer may use to contact the controller." *R.I. Gen. Laws § 6-48.1-3(a).* <https://webserver.rilegislature.gov/Statutes/TITLE6/6-48.1/6-48.1-3.htm>

[^stat-3-targeted]: **R.I. Gen. Laws § 6-48.1-3** — "If a controller sells personal data to third parties or processes personal data for targeted advertising, the controller shall clearly and conspicuously disclose such processing." *R.I. Gen. Laws § 6-48.1-3(b).* <https://webserver.rilegislature.gov/Statutes/TITLE6/6-48.1/6-48.1-3.htm>

[^stat-7-contract]: **R.I. Gen. Laws § 6-48.1-7** — "A contract between a controller and a processor shall govern the processor’s data processing procedures with respect to processing performed on behalf of the controller." *R.I. Gen. Laws § 6-48.1-7(c).* <https://webserver.rilegislature.gov/Statutes/TITLE6/6-48.1/6-48.1-7.htm>

[^stat-7-terms]: **R.I. Gen. Laws § 6-48.1-7** — "The contract shall be binding and clearly set forth instructions for processing data; the nature and purpose of processing; the type of data subject to processing; the duration of processing; and the rights and obligations of both parties. The contract shall also require that the processor: (1) Ensure that each person processing personal data is subject to a duty of confidentiality with respect to the data;" *R.I. Gen. Laws § 6-48.1-7(c).* <https://webserver.rilegislature.gov/Statutes/TITLE6/6-48.1/6-48.1-7.htm>

[^stat-7-consent]: **R.I. Gen. Laws § 6-48.1-4** — "The controller shall not process sensitive data concerning a customer without obtaining customer consent and shall not process sensitive data of a known child unless consent is obtained and the information is processed in accordance with COPPA." *R.I. Gen. Laws § 6-48.1-4(c).* <https://webserver.rilegislature.gov/Statutes/TITLE6/6-48.1/6-48.1-4.htm>

[^stat-2-sensitive]: **R.I. Gen. Laws § 6-48.1-2** — "‘Sensitive data’ means personal data that includes data revealing racial or ethnic origin, religious beliefs, mental or physical health condition or diagnosis, sex life, sexual orientation or citizenship or immigration status, the processing of genetic or biometric data for the purpose of uniquely identifying an individual, personal data collected from a known child, or precise geolocation data." *R.I. Gen. Laws § 6-48.1-2(26).* <https://webserver.rilegislature.gov/Statutes/TITLE6/6-48.1/6-48.1-2.htm>

[^stat-8-nopra]: **R.I. Gen. Laws § 6-48.1-8** — "Nothing in this section shall be construed to authorize any private right of action to enforce any provision of this chapter, any regulation hereunder, or any other provisions of law." *R.I. Gen. Laws § 6-48.1-8(c).* <https://webserver.rilegislature.gov/Statutes/TITLE6/6-48.1/6-48.1-8.htm>

[^stat-8-ag]: **R.I. Gen. Laws § 6-48.1-8** — "The attorney general shall have sole enforcement authority of the provisions of this chapter and may enforce a violation of this chapter pursuant to:" *R.I. Gen. Laws § 6-48.1-8(b).* <https://webserver.rilegislature.gov/Statutes/TITLE6/6-48.1/6-48.1-8.htm>

[^stat-8-fine]: **R.I. Gen. Laws § 6-48.1-8** — "A violation of this chapter constitutes a violation of the general regulatory provisions of commercial law in this title and shall constitute a deceptive trade practice in violation of chapter 13.1 of this title" *R.I. Gen. Laws § 6-48.1-8(a).* <https://webserver.rilegislature.gov/Statutes/TITLE6/6-48.1/6-48.1-8.htm>
