Is Rhode Island's Data Transparency and Privacy Protection Act in Effect in 2026?

Yes. Rhode Island's Data Transparency and Privacy Protection Act (RIDTPPA) took effect on January 1, 2026, and it already applies to marketers running targeted advertising or selling personal data tied to Rhode Island residents today.

How the Law Became Effective Without a Signature

Governor Daniel McKee transmitted the bill back to the legislature without signing it, but under Rhode Island's constitutional process that inaction still let it become law. It joined a wave of state comprehensive privacy statutes enacted in 2024, with its effective date set two full years out to give businesses time to prepare their compliance programs.

Who Has to Comply

RIDTPPA applies to for-profit entities that conduct business in Rhode Island or target Rhode Island residents and that either control or process the personal data of 35,000 or more consumers, or control or process data of 10,000 or more consumers while deriving over 20% of gross revenue from selling personal data. A marketer running paid campaigns at meaningful scale in the state is very likely inside that threshold once email lists, CRM records, and ad-pixel data are counted together.

What It Requires From Marketing Teams

Rhode Island residents gain the right to opt out of having their personal data used for targeted advertising and the right to opt out of its sale to third parties. Marketing teams need an accessible, honored opt-out mechanism for both — not just a general unsubscribe link, but a process that actually stops targeted-ad data use and data sales once a consumer invokes it. The law also requires a reasonably accessible privacy notice disclosing what categories of data are collected and whether they're sold or used for targeted advertising.

Enforcement Is Narrower Than Some Other States

RIDTPPA gives sole enforcement authority to the Rhode Island Attorney General and does not create a private right of action, meaning individual consumers can't sue a business directly over a violation. Reported penalties run $100 to $500 per violation according to compliance guides tracking the statute, though the AG's office has discretion over how aggressively it pursues cases in the law's first year of real-world enforcement.

How It Compares to Other 2024-2026 State Laws

RIDTPPA sits in the same family as the privacy laws in Alabama, Louisiana, Vermont, and Oklahoma — all enacted in 2024-2026 with opt-out rights for targeted advertising as a core marketing-relevant provision. Rhode Island's law reached its effective date earlier than most of that group, several of which don't take effect until 2027 or 2028, which means it's worth prioritizing compliance work here first if you're building a single multi-state framework.

Bottom Line

If your campaigns reach Rhode Island residents and your data volumes clear the 35,000-consumer threshold, audit your opt-out flow for targeted advertising and data sales now — the law is already in force, not a future deadline.

Sources: Hunton Andrews Kurth, "Rhode Island General Assembly Passes State Privacy Bill"; WilmerHale privacy blog on RIDTPPA enactment; Termly and Clym regulatory summaries of RIDTPPA's effective date, thresholds, and enforcement structure.