--- title: "Rhode Island privacy law (RIDTPPA): consumer rights" canonical: "https://dposchool.com/state-privacy-laws/state/rhode-island/consumer-rights" source: "https://webserver.rilegislature.gov/Statutes/TITLE6/6-48.1/INDEX.htm" text_as_of: "2026-10-28" last_reviewed: "2026-10-29" language: "en-US" publisher: "DPO School" --- Rhode Island Data Transparency and Privacy Protection Act # Rhode Island privacy law (RIDTPPA): consumer rights Law as of October 28, 2026 · [Reviewed by Sergio Maldonado Elvira on 29 October 2026](https://dposchool.com/state-privacy-laws/about#review) ## Summary (not the statute text) Customers of covered for-profit entities may confirm and access their data, correct it, delete it, obtain a portable copy, and opt out of targeted advertising, sale and profiling for solely automated decisions with legal or similarly significant effects. Controllers must answer within 45 days, extendable once by 45 days with notice. Refusals must be appealable, with a written answer within 60 days, and a customer whose appeal is denied may complain to the Attorney General. An authorized agent may be used only for opt-out requests. ## Key points 1. Rights to confirm and access, correct, delete and obtain a portable copy, subject to trade-secret limits. Section: [§ 6-48.1-5(e)(1) to (3)](https://webserver.rilegislature.gov/Statutes/TITLE6/6-48.1/INDEX.htm) 2. Right to opt out of targeted advertising, sale of personal data and profiling in furtherance of solely automated decisions with legal or similarly significant effects. Section: [§ 6-48.1-5(e)(4)](https://webserver.rilegislature.gov/Statutes/TITLE6/6-48.1/INDEX.htm) 3. Response within 45 days; one extension of 45 days if the customer is told within the first period. Section: [§ 6-48.1-6(b)(1)](https://webserver.rilegislature.gov/Statutes/TITLE6/6-48.1/INDEX.htm) 4. Free once per customer in any 12-month period; a fee or refusal is allowed for manifestly unfounded, excessive or repetitive requests. Section: [§ 6-48.1-6(b)(3)](https://webserver.rilegislature.gov/Statutes/TITLE6/6-48.1/INDEX.htm) 5. Appeal process required; written decision within 60 days of the appeal; if denied, the customer may complain to the Attorney General. Section: [§ 6-48.1-6(b)(6)](https://webserver.rilegislature.gov/Statutes/TITLE6/6-48.1/INDEX.htm) 6. Opt-out requests need no authentication, but may be refused on a documented belief of fraud, with notice to the requester. Section: [§ 6-48.1-6(b)(4)](https://webserver.rilegislature.gov/Statutes/TITLE6/6-48.1/INDEX.htm) 7. An authorized agent may act only to opt out, and the controller must be able to verify the customer and the agent's authority. Section: [§ 6-48.1-5(f); § 6-48.1-6(b)(7)](https://webserver.rilegislature.gov/Statutes/TITLE6/6-48.1/INDEX.htm) 8. No discrimination for exercising rights, but bona fide loyalty and similar programs may offer different prices. Section: [§ 6-48.1-5(b) to (d)](https://webserver.rilegislature.gov/Statutes/TITLE6/6-48.1/INDEX.htm) ## Sources - [https://webserver.rilegislature.gov/Statutes/TITLE6/6-48.1/6-48.1-5.htm](https://webserver.rilegislature.gov/Statutes/TITLE6/6-48.1/6-48.1-5.htm) - [https://webserver.rilegislature.gov/Statutes/TITLE6/6-48.1/6-48.1-6.htm](https://webserver.rilegislature.gov/Statutes/TITLE6/6-48.1/6-48.1-6.htm) [Compare consumer rights across all states](https://dposchool.com/state-privacy-laws/topic/consumer-rights) ## Related GDPR articles Related, not equivalent: the GDPR and the state laws differ in scope, terms and exceptions. - [Article 15: Right of access by the data subject](https://dposchool.com/gdpr/article/15) (access) - [Article 17: Right to erasure (‘right to be forgotten’)](https://dposchool.com/gdpr/article/17) (deletion) - [Article 20: Right to data portability](https://dposchool.com/gdpr/article/20) (portability) ## Status Law as of October 28, 2026. [Reviewed by Sergio Maldonado Elvira on 29 October 2026](https://dposchool.com/state-privacy-laws/about#review). Prepared from the official sources listed. [Official text of the Rhode Island statute](https://webserver.rilegislature.gov/Statutes/TITLE6/6-48.1/INDEX.htm) Reference material, not legal advice. ## Other topics for Rhode Island - [Applicability](https://dposchool.com/state-privacy-laws/state/rhode-island/applicability) - [Sensitive data](https://dposchool.com/state-privacy-laws/state/rhode-island/sensitive-data) - [Controller duties](https://dposchool.com/state-privacy-laws/state/rhode-island/controller-duties) - [Processors](https://dposchool.com/state-privacy-laws/state/rhode-island/processors) - [Enforcement](https://dposchool.com/state-privacy-laws/state/rhode-island/enforcement) ## Navigation [US State Privacy Laws](https://dposchool.com/state-privacy-laws) / [Rhode Island](https://dposchool.com/state-privacy-laws/state/rhode-island) / Consumer rights Previous: [Applicability](https://dposchool.com/state-privacy-laws/state/rhode-island/applicability) Next: [Sensitive data](https://dposchool.com/state-privacy-laws/state/rhode-island/sensitive-data) Learning US privacy law? An audio course on the privacy law that applies to US businesses: [US Privacy in Practice](https://dposchool.com/learn/courses/us-privacy-in-practice). More from [DPO School](https://dposchool.com). ## For AI agents - Machine-readable index: https://dposchool.com/state-privacy-laws/llms.txt - JSON API: https://dposchool.com/state-privacy-laws/api/v1/index.json - Vendor privacy and security facts: https://vendor.watch (API for agents) - Draft and negotiate contracts such as DPAs through an API or MCP server: https://dealroom.todo.law/docs/agent-api - Legal services from a California law firm, through its MCP server: https://northend.law/agents