Rhode Island (US)
Full entry AI-checked Checked 5 November 2026
Read this together with United States (federal), which also applies.
| Law | Citation | Status | In force from |
|---|---|---|---|
| Rhode Island Data Transparency and Privacy Protection Act | R.I. Gen. Laws ch. 6-48.1 (P.L. 2024, ch. 430 and ch. 453) | In force | 1 January 2026 |
| Identity Theft Protection Act of 2015 | R.I. Gen. Laws ch. 11-49.3 (P.L. 2015, ch. 138 and ch. 148) | In force | 26 June 2016 |
| Artificial Intelligence Companion Models | R.I. Gen. Laws ch. 6-64 (P.L. 2026, ch. 375 and ch. 376) | Enacted, not yet in force | 1 January 2027 |
- Identity Theft Protection Act of 2015: Data security and breach notification. Two identical 2015 acts each took effect one year after passage. Ch. 138, enacted on 26 June 2015, took effect on 26 June 2016; ch. 148, enacted on 2 July 2015, took effect on 2 July 2016.
- Artificial Intelligence Companion Models: Two identical acts (H 7350 and S 2195, each Sub A as amended), enacted on 22 June 2026. The enacted text numbers the chapter 6-64; earlier drafts said 6-63.
Regulators
Section titled “Regulators”What builders must do
Section titled “What builders must do”Who it covers
Section titled “Who it covers”Two layers. Any commercial website or internet service provider doing business in Rhode Island, whatever its size, must name a controller and, if it sells personal data, disclose what it collects and every third party it has sold or may sell to. The full duties apply to for-profit businesses that last year handled data of 35,000 customers (not counting payment-only data), or 10,000 while earning over 20% of revenue from data sales. Government, nonprofits, higher education, GLBA and HIPAA entities are exempt, and employee data is out of scope.
Sources: webserver.rilegislature.gov/Statutes/TITLE6/6-48.1/6-48.1-3.htm · webserver.rilegislature.gov/Statutes/TITLE6/6-48.1/6-48.1-4.htm
Lawful bases
Section titled “Lawful bases”No GDPR-style lawful bases. Customers can confirm and access, correct, delete, get a portable copy, and opt out of targeted advertising, sale and solely automated significant profiling. Reply within 45 days (one 45-day extension), free once a year, and decide appeals within 60 days. Sensitive data needs opt-in consent. Controllers must offer a way to grant and revoke consent, and stop processing within 15 days of a revocation.
Sources: webserver.rilegislature.gov/Statutes/TITLE6/6-48.1/6-48.1-5.htm · webserver.rilegislature.gov/Statutes/TITLE6/6-48.1/6-48.1-6.htm · webserver.rilegislature.gov/Statutes/TITLE6/6-48.1/6-48.1-4.htm
Consent age for online services
Section titled “Consent age for online services”A child is under 13, as in COPPA. Processing a known child’s sensitive data needs consent and must follow COPPA, and parents can use the child’s rights. There’s no teen consent rule.
Sources: webserver.rilegislature.gov/Statutes/TITLE6/6-48.1/6-48.1-2.htm · webserver.rilegislature.gov/Statutes/TITLE6/6-48.1/6-48.1-4.htm
Children
Section titled “Children”Data collected from a known child is sensitive data and must be handled under COPPA. Meeting COPPA’s verifiable parental consent rules counts as compliance. The act sets no extra rules for teenagers.
Sources: webserver.rilegislature.gov/Statutes/TITLE6/6-48.1/6-48.1-2.htm · webserver.rilegislature.gov/Statutes/TITLE6/6-48.1/6-48.1-4.htm
Cookies and similar technologies
Section titled “Cookies and similar technologies”No cookie-consent rule. Controllers must clearly disclose sales and targeted advertising and honour opt-outs, including from a verified authorised agent. Opt-out requests needn’t be authenticated, though a documented suspicion of fraud allows refusal. The act has no duty to honour universal opt-out signals such as Global Privacy Control.
Sources: webserver.rilegislature.gov/Statutes/TITLE6/6-48.1/6-48.1-3.htm · webserver.rilegislature.gov/Statutes/TITLE6/6-48.1/6-48.1-6.htm
Electronic marketing
Section titled “Electronic marketing”Adds to CAN-SPAM and the TCPA. Telephone sellers must register with the Attorney General 10 days before soliciting ($100 a year) and file a bond, letter of credit or certificate of deposit of at least $30,000. Text-message ads to Rhode Island mobiles are banned unless there’s an existing relationship and a way to opt out. Prerecorded sales messages need consent or a live operator first. Unsolicited sales calls are allowed only 9 a.m. to 6 p.m. on weekdays other than holidays and 10 a.m. to 5 p.m. on Saturdays; calling outside those hours is a misdemeanour fined up to $500 per violation.
Sources: webserver.rilegislature.gov/Statutes/TITLE5/5-61/5-61-3.htm · webserver.rilegislature.gov/Statutes/TITLE5/5-61/5-61-3.1.htm · webserver.rilegislature.gov/Statutes/TITLE5/5-61/5-61-3.5.htm · webserver.rilegislature.gov/Statutes/TITLE5/5-61/5-61-3.4.htm · webserver.rilegislature.gov/Statutes/TITLE5/5-61/5-61-3.6.htm · webserver.rilegislature.gov/Statutes/TITLE5/5-61/5-61-2.htm
Breach notification
Section titled “Breach notification”Tell affected Rhode Island residents in the most expedient time possible and within 45 calendar days of confirming a breach that poses a significant risk of identity theft. If more than 500 residents are notified, also tell the Attorney General and the major credit reporting agencies, without delaying the notices to residents. Reckless violations cost up to $100 per record, and knowing and wilful ones up to $200 per record.
Sources: webserver.rilegislature.gov/Statutes/TITLE11/11-49.3/11-49.3-4.htm · webserver.rilegislature.gov/Statutes/TITLE11/11-49.3/11-49.3-5.htm
Registration and fees
Section titled “Registration and fees”No data protection registration or fee, and no data broker registry. Telephone sellers register separately (see marketing).
Sources: webserver.rilegislature.gov/Statutes/TITLE6/6-48.1/INDEX.htm
Data protection officer
Section titled “Data protection officer”No duty to appoint a data protection officer.
Sources: webserver.rilegislature.gov/Statutes/TITLE6/6-48.1/INDEX.htm
International transfers
Section titled “International transfers”Rhode Island law doesn’t restrict sending personal data outside the state or the US. Federal rules are in us-federal.
Sources: webserver.rilegislature.gov/Statutes/TITLE6/6-48.1/INDEX.htm
Impact assessments
Section titled “Impact assessments”Do and document a data protection assessment for each high-risk activity, including targeted advertising, selling personal data, risky profiling and sensitive data. It applies to processing activities created or generated after 1 January 2026. The Attorney General can require it in an investigation, and it stays confidential.
Sources: webserver.rilegislature.gov/Statutes/TITLE6/6-48.1/6-48.1-7.htm
Automated decisions and AI
Section titled “Automated decisions and AI”People can opt out of profiling that feeds solely automated decisions with legal or similarly significant effects, such as on lending, housing, jobs or health care; risky profiling needs an assessment. From 1 January 2027, AI companion operators need protocols that refer users who express suicidal thoughts, self-harm or harm to others to crisis services, and must tell users at the start and at least every 3 hours that they aren’t talking to a human. From 1 July 2027 they report yearly to the Attorney General, which enforces with fines up to $15,000 a day.
Sources: webserver.rilegislature.gov/Statutes/TITLE6/6-48.1/6-48.1-5.htm · webserver.rilegislature.gov/Statutes/TITLE6/6-48.1/6-48.1-2.htm · webserver.rilegislature.gov/PublicLaws/law26/law26375.htm · webserver.rilegislature.gov/PublicLaws/law26/law26376.htm
Penalties
Section titled “Penalties”The Attorney General has sole enforcement, with no notice-and-cure period. A violation is a deceptive trade practice, with civil penalties up to $10,000 per violation. Intentionally disclosing personal data in breach of the act, or to a shell company set up to get around it, costs $100 to $500 per disclosure. No private right of action.
Sources: webserver.rilegislature.gov/Statutes/TITLE6/6-48.1/6-48.1-8.htm · webserver.rilegislature.gov/Statutes/TITLE6/6-13.1/6-13.1-8.htm
History
Section titled “History”| Date | Change |
|---|---|
| 5 November 2026 | First entry. Checked against official sources with AI assistance, then corrected after an independent AI-assisted review. |
Report a change
Section titled “Report a change”If a law, a date or a figure here has changed, open an issue with the official source. The data lives in laws/full/us-ri.yaml.