Rhode Island Data Transparency and Privacy Protection Act (RIDTPPA): your rights and how to use them
Quick answer
Since January 1, 2026, Rhode Island's privacy law lets you ask a covered company to show you, correct or delete the personal data it holds about you, and to stop selling it or using it for targeted ads. Send your request through the method in the company's privacy notice: it has 45 days to answer, and one request a year is free. Rhode Island doesn't require companies to honor browser opt-out signals and has no data broker registry, so you contact each company yourself, then appeal and complain to the Attorney General if it refuses.
All privacy laws“Correct inaccuracies in the customer’s personal data and delete personal data provided by, or obtained about, the customer”
- Applies in
- Rhode Island
- In force since
- Companies must answer within
- Within 45 days of receiving your request. The company can extend by 45 more days when that's reasonably necessary, if it tells you why within the first 45 days. If it refuses, it must say why within 45 days and explain how to appeal. Appeals get a written decision within 60 days. One request per 12 months is free (R.I. Gen. Laws § 6-48.1-6(b)).
- Last updated
Head of Product & Co-Founder
Reviewed by Ludwig Sandgren
Head of Legal
Serus is a privacy company with paid tools to find and remove your personal data. This page is free and based on official sources.
Sources checked: webserver.rilegislature.gov
Last verified against the official page:
Rhode Island residents acting for themselves or their household, not in a work or business role. The rights apply to for-profit companies that do business in Rhode Island or target its residents and that, in the previous calendar year, handled personal data of at least 35,000 customers (not counting data used only to complete a payment), or at least 10,000 customers while earning more than 20% of gross revenue from selling personal data (R.I. Gen. Laws § 6-48.1-5(a)). State bodies, nonprofits, colleges, banks and other financial institutions covered by the Gramm-Leach-Bliley Act, and HIPAA-covered entities are exempt. Data covered by HIPAA, the Fair Credit Reporting Act, the Driver's Privacy Protection Act and FERPA is exempt too.
Your rights
-
Confirm and access
Ask whether a company processes your personal data and get access to it, unless that would reveal a trade secret (R.I. Gen. Laws § 6-48.1-5(e)(1)).
-
Correct and delete
Have inaccurate personal data fixed, and have a company delete personal data you gave it or that it obtained about you (R.I. Gen. Laws § 6-48.1-5(e)(2)).
-
Get a portable copy
Where the processing is automated, get your data in a portable, readily usable format (R.I. Gen. Laws § 6-48.1-5(e)(3)).
-
Opt out
Stop the company using your data for targeted advertising, selling it, or profiling you for solely automated decisions with legal or similarly significant effects (R.I. Gen. Laws § 6-48.1-5(e)(4)).
-
No penalty for using your rights
A company can't discriminate against you for using these rights. Genuine loyalty programs are still allowed (R.I. Gen. Laws § 6-48.1-5(b)-(d)).
-
Withdraw consent
Where a company relies on your consent, it must give you a way to withdraw it and act on the withdrawal within 15 days (R.I. Gen. Laws § 6-48.1-4(e)).
-
Appeal
Appeal a refusal through the company's appeal process. It must answer in writing within 60 days, and if it still says no you can complain to the Attorney General (R.I. Gen. Laws § 6-48.1-6(b)(6)).
General information, not legal advice.
How to use it
- 1
Find the request method in the privacy notice
Covered companies must describe a secure and reliable way to send a privacy request in their privacy notice. Use that channel, and say you're making the request under the Rhode Island Data Transparency and Privacy Protection Act.
- 2
Name the rights you want to use
Be specific: access, correction, deletion, a copy, or an opt-out of sales and targeted ads. A line like "Under R.I. Gen. Laws § 6-48.1-5, please delete the personal data you hold about me" is enough to start.
- 3
Opt out at each company, or use an authorized agent
Rhode Island's law doesn't make companies honor a browser signal such as Global Privacy Control, so switching it on may not count as an opt-out here. Opt out through each company's own process, or name an authorized agent to opt out for you. The company has to act on the agent's request if it can verify who you are and that the agent may act for you.
- 4
Wait up to 45 days
The company has 45 days to answer, or up to 90 if it tells you within the first 45 days that it needs more time and why.
- 5
Appeal if the company refuses
The company must have a clear appeal process. Use it and keep a copy of what you send. It must decide in writing within 60 days.
- 6
Complain to the Rhode Island Attorney General
If the appeal is denied, you can submit a complaint to the Attorney General, who alone enforces the law. Go to the Attorney General's website and use its consumer complaint route. Attach the company's refusal and your appeal.
No answer in time? Complain to Rhode Island Office of the Attorney General .
No opt-out signal, no broker registry
Two things Rhode Island's law leaves out are worth knowing before you start. It doesn't require companies to honor an opt-out preference signal such as Global Privacy Control, as some other state privacy laws do. And it doesn't set up a data broker registry or a single deletion tool. So every request goes to one company at a time, through that company's own process.
The rights themselves are the usual set. Deletion is the one most people want.
Who has to follow it
The rights apply to for-profit companies that do business in Rhode Island or target its residents and that handled personal data of at least 35,000 customers in the previous calendar year. Data used only to complete a payment doesn't count. A smaller company is covered if it handled data of at least 10,000 customers and earned more than 20% of its gross revenue from selling personal data.
A separate section with duties about sharing information applies more broadly, to any commercial website or internet service provider doing business in Rhode Island (R.I. Gen. Laws § 6-48.1-3).
The law protects "customers": people living in Rhode Island acting for themselves or their household. Not you at work.
Why a company can say no
Some organizations are exempt: state bodies and political subdivisions, nonprofits, colleges and universities, registered national securities associations, financial institutions covered by the Gramm-Leach-Bliley Act (GLBA), and HIPAA-covered entities. Some data is exempt too. The big one for people-search pages is credit data: activity regulated by the Fair Credit Reporting Act sits outside the law, as do HIPAA health information, motor vehicle records under the Driver's Privacy Protection Act, FERPA school records and employment data.
If a company points to one of these, that's likely why it's declining. You can still appeal, and complain to the Attorney General if the refusal looks wrong. Our guide on what to do when a company won't delete your account covers the next steps.
Where Serus fits
With no registry and no opt-out signal, Rhode Island's law works one company at a time, and you first have to know which companies hold your data. Serus finds the data brokers and people-search sites that list you where you live and sends the deletion and opt-out requests for you. Then it keeps checking. The steps above are free if you'd rather do them yourself.
Data brokers that list people in United States
Each guide shows how to opt out of that site, step by step.
- Remove yourself from CourtRecords.us
- Remove yourself from TruePeopleSearch
- Remove yourself from Spokeo
- Remove yourself from LexisNexis
- Remove yourself from TruthFinder
- Remove yourself from FastPeopleSearch
- Remove yourself from BeenVerified
- Remove yourself from Intelius
Let Serus send the requests for you
Serus finds the data brokers that list you where you live and removes you from them.
Related
Frequently asked
When did the Rhode Island privacy law take effect?
January 1, 2026. It was enacted in 2024 (P.L. 2024, ch. 430 and ch. 453).
Do companies have to honor Global Privacy Control in Rhode Island?
No. Chapter 6-48.1 has no requirement to honor a universal opt-out or opt-out preference signal. You opt out with each company, or through an authorized agent.
Is there a Rhode Island data broker registry?
No. The law doesn't create one, and there's no state tool to send one deletion request to many brokers. You contact each company yourself.
Can I sue under the Rhode Island privacy law?
No. The Attorney General has sole enforcement authority and the law doesn't give you a private right of action.
What penalties apply?
A violation counts as a deceptive trade practice under Rhode Island's chapter 13.1. Intentionally disclosing personal data in violation of the law carries a fine of $100 to $500 per disclosure.
Sources
- webserver.rilegislature.gov/Statutes/TITLE6/6-48.1/INDEX.htm
- webserver.rilegislature.gov/Statutes/TITLE6/6-48.1/6-48.1-2.htm
- webserver.rilegislature.gov/Statutes/TITLE6/6-48.1/6-48.1-3.htm
- webserver.rilegislature.gov/Statutes/TITLE6/6-48.1/6-48.1-4.htm
- webserver.rilegislature.gov/Statutes/TITLE6/6-48.1/6-48.1-5.htm
- webserver.rilegislature.gov/Statutes/TITLE6/6-48.1/6-48.1-6.htm
- webserver.rilegislature.gov/Statutes/TITLE6/6-48.1/6-48.1-8.htm
- webserver.rilegislature.gov/Statutes/TITLE6/6-48.1/6-48.1-10.htm
Something wrong or out of date? Tell us and we'll re-check it.