Rhode Island Enacts Nation's Nineteenth Comprehensive Privacy Law

On June 13, the Rhode Island legislature passed the Rhode Island Data Transparency and Privacy Protection Act (RIDTPPA) (H. 7787/S. 2500), with the bill passing into law on June 29. This bill is the nineteenth state comprehensive privacy law to be enacted and will take effect on January 1, 2026. Though the Act generally adheres to the standard model exemplified by most non-California state comprehensive privacy laws, it departs from that model in several ways that companies should take note of, including the broad applicability of its privacy notice requirements (which apply to all commercial websites and internet service providers, even ones not subject to the Act's other requirements), its potentially expansive disclosure requirements regarding sales of personal data to third parties, and its lack of a cure period provision for potential violations.