Rhode Island, The Ocean State, Sails The Privacy Waves

Rhode Island's new privacy law has now passed into law, adding to the constantly evolving US privacy law patchwork. Rhode Island becomes the 20th state to enact a "comprehensive" privacy law (this one passing by default, without governor signature). It will go into effect on January 1, 2026, the same day as Indiana and Kentucky. For a recap of all of the US state privacy laws, including their obligations and effective dates, visit our interactive tool.

Rhode Island's law does not have the same deviations from the standards that we saw with those recently enacted Maryland and Minnesota. The key provisions will thus look familiar:

• Applicability. The law will apply to businesses that either (1) process personal data of at least 35,000 Rhode Island consumers or (2) control or process personal data of at least 10,000 consumers and derive more than twenty percent of gross revenue from the sale of personal data. The notice obligation, however, applies regardless of