Consumer Data Privacy
Rhode Island Consumer Data Privacy Law: Thresholds, Consumer Rights & Deadlines
What Rhode Island’s consumer data privacy law requires, maintained by Stauss PLLC. Last reviewed July 2026.
What You Need to Know
Enacted in 2024, the law is notable for privacy policy provisions that apply more broadly than those in other state laws. However, it fails to define "personally identifiable information," the term those provisions turn on, leaving their scope ambiguous. Where they apply, controllers must name every third party to whom they sell or "may sell" PII. Beyond that, the law omits much of what is now standard in state privacy legislation.
Official law text
Who the law applies to
| Threshold | Requirement |
|---|---|
| Annual gross revenue | N/A |
| Consumers whose data is processed | 35,000 customers 3.19% of state's 1.096 million population |
| Revenue from sale of personal data | Derives more than 20% of gross revenue from sale of personal data and controls or processes personal data of not less than 10,000 customers. |
| Other conditions |
|
Consumer rights under Rhode Island's law15
| Right | Provided? |
|---|---|
| Know | Yes |
| Access | Yes |
| Obtain list of third parties to which personal data was disclosed | No |
| Data portability | Yes |
| Delete | Yes |
| Correct inaccuracies | Yes |
| Not be discriminated against for exercising rights | Yes |
Opt-out of salenoteContains pseudonymous data carve out. | Partial |
Opt-out of targeted advertising/sharingnoteContains pseudonymous data carve out. | Partial |
Opt-out of certain types of profilingnoteContains pseudonymous data carve out. | Partial |
| Opt-out of ADMT | No |
| Recognize opt-out signals | No |
| Revoke consent | Yes |
| Not process data in discriminatory manner | No |
| Appeal | Yes |
Categories treated as sensitive data10
- Racial or ethnic origin
- Religious beliefs
- Mental or physical health diagnosis
- Mental or physical health condition
- Sexual orientation
- Sex life
- Citizenship or immigration status
- Genetic or biometric data for purposes of uniquely identifying an individual
- Personal data of known child
- Precise geolocation
note
Connecticut, Maryland, Oregon, and Virginia ban the sale of precise geolocation data.
How sensitive data must be treated2
- Obtain Consent to Process
- Conduct Data Protection or Risk Assessment
Requirements for minors' data1
- Process personal data of children under 13 in accordance with COPPA or parental/legal guardian consent
Activities that trigger a risk or impact assessment5
- Targeted advertising (“sharing”)
- Sale of personal data
- Processing of sensitive data
- Processing personal data for purposes of profiling where it presents reasonably foreseeable risk of unfair or deceptive treatment of, or unlawful disparate impact on, consumers; financial, physical, or reputational injury to consumers; physical or other intrusion upon the solitude or seclusion, or the private affairs or concerns, of consumers, where such intrusion would be offensive to a reasonable person; other subject injury to consumers
- Any processing activities involving personal data that present a heightened risk of harm to consumers
Other notable provisions5
- Definition of “Sale” Includes “Other Valuable Consideration”
- Data Processing Agreements
- Privacy Policy
- Implement Reasonable Data Security Measures
- Attorney General Enforcement
Key dates1
| Date | What happens |
|---|---|
| January 1, 2026 | Rhode Island's consumer data privacy law takes effect |
Questions about Rhode Island’s privacy law?
Stauss PLLC advises companies on state privacy, AI, and data broker compliance.
Contact Stauss PLLCThis page is provided for general informational purposes only, is not legal advice, and does not create an attorney-client relationship. State laws change frequently; coverage reflects this tool’s most recent update. Contact Stauss PLLC to confirm how these requirements apply to your organization.