Rhode Island Data Transparency and Privacy Protection Act

Applicability model: Provision-specific / for-profit threshold model.

Core threshold: 35,000 customers; or 10,000 customers and >20% gross revenue from sale for core controller provisions

Applicability remains subject to statutory entity, data-level and activity-specific exemptions. Employment/B2B treatment and federal-law carve-outs should be read together with the official statute linked below.

Sensitive-data standard: Special statutory treatment; consult chapter definitions and controller duties

The statute's legislative findings emphasize children's information; specific age obligations should be read from the operative chapter.

Reasonable administrative, technical and physical security; controller-processor contracts; transparency and request handling.

Authority: Rhode Island Attorney General

Private right of action: No general private action

Penalty / remedy baseline: $100–$500 for specified intentional disclosures; deceptive-trade-practice remedies may also apply

Rhode Island is structurally unusual because its privacy chapter uses 'customers' and contains provision-specific scope, including a broader transparency layer for commercial websites/ISPs alongside threshold-based controller duties.

The comprehensive chapter took effect January 1, 2026. Any separate AI consumer-protection activity should be tracked as a different regulatory layer.

Editorial rule: future-effective, proposed and pending measures are kept separate from current law.