RIDTPPA
Rhode Island Data Transparency and Privacy Protection Act
Key Facts
Overview
Rhode Island's RIDTPPA has no cure period and applies more broadly than most state laws by covering commercial websites and ISPs with Rhode Island customers even without meeting standard numerical thresholds. Under-18 data is classified as sensitive, and additional penalties apply for intentional unauthorized disclosure.
What This Means for Your Website
- No cure period: the AG can take immediate enforcement action
- Opt-in consent required for sensitive data (including under-18 data)
- Applies to commercial websites and ISPs with RI customers regardless of numerical thresholds
- Additional penalties of $100-$500 per intentional unauthorized disclosure
- Consumer requests must be fulfilled within 45 days (extendable by 45)
Key Requirements
The Rhode Island AG enforces the RIDTPPA with penalties up to $10,000 per violation, plus additional per-disclosure penalties for intentional unauthorized disclosure. The broad applicability, covering commercial websites and ISPs regardless of thresholds, makes this law relevant to more businesses than typical state privacy laws.
How ConsentStack Handles This
ConsentStack detects Rhode Island visitors and applies opt-in consent for sensitive data categories including under-18 data, ensuring compliance with the RIDTPPA's broad applicability.
Penalties
$10,000 per violation; additional $100-$500 per intentional unauthorized disclosure.
Key Requirements
- Opt-in consent for sensitive data
- Consumer rights: access, correct, delete, portability, opt-out
- 45-day response window extendable by 45 days
- Privacy notice requirements
- No cure period: immediate enforcement
- Data protection assessments for high-risk processing
Notable Provisions
- No cure period
- Additional $100-$500 per unauthorized disclosure
- Under-18 data is sensitive
- Applies to commercial websites/ISPs regardless of thresholds
Data Subject Rights
Confirm whether a controller is processing your personal data and access that data, unless doing so would require the controller to reveal a trade secret.
Correct inaccuracies in your personal data, taking into account the nature of the data and the purposes of the processing.
Have a controller delete personal data you provided or that it obtained about you, taking into account the nature of the data and the purposes of the processing.
Obtain a copy of your personal data in a portable and, where technically feasible, readily usable format you can transmit to another controller, where the processing is carried out by automated means and no trade secret would be revealed.
Opt out of the processing of your personal data for targeted advertising, meaning ads selected from your activity over time across nonaffiliated websites or apps.
Opt out of the sale of your personal data, meaning its exchange for money or other valuable consideration by the controller to a third party.
Opt out of profiling in furtherance of solely automated decisions that produce legal or similarly significant effects, such as decisions about lending, housing, insurance, education, employment, health care or essential goods.
Designate an authorized agent to opt out on your behalf of targeted advertising, sale or profiling; this agent right covers opt-outs only, and the controller must comply once it can verify your identity and the agent's authority.
Appeal a controller's refusal to act on your request through an appeal process that must be clearly and conspicuously available, and receive a written explanation of the decision.
If your appeal is denied, you may submit a complaint to the Rhode Island Attorney General, which has sole authority to enforce this law.
Revoke consent you gave where consent is required, for example for the processing of sensitive data, through a mechanism the controller must provide, after which the controller must suspend that processing as soon as practicable.
A controller may not discriminate against you for exercising your rights, such as by denying goods or services or charging different prices because you opted out, but it may run voluntary loyalty, rewards, premium, discount or club card programs and need not provide a service that needs data you opted out of.
US State Specifics
Other North America Regulations
Frequently Asked Questions
Stay compliant with RIDTPPA
ConsentStack helps you implement Opt-out consent for Rhode Island, United States automatically.