---
title: "Rhode Island privacy law (RIDTPPA): sensitive data"
canonical: "https://dposchool.com/state-privacy-laws/state/rhode-island/sensitive-data"
source: "https://webserver.rilegislature.gov/Statutes/TITLE6/6-48.1/INDEX.htm"
text_as_of: "2026-10-28"
last_reviewed: "2026-10-29"
language: "en-US"
publisher: "DPO School"
---

Rhode Island Data Transparency and Privacy Protection Act

# Rhode Island privacy law (RIDTPPA): sensitive data

Law as of October 28, 2026 · [Reviewed by Sergio Maldonado Elvira on 29 October 2026](https://dposchool.com/state-privacy-laws/about#review)

## Summary (not the statute text)

Covered controllers may not process sensitive data without the customer's consent. Sensitive data covers racial or ethnic origin, religious beliefs, mental or physical health condition or diagnosis, sex life, sexual orientation, citizenship or immigration status, genetic or biometric data used to identify a person, data collected from a known child, and precise geolocation within 1,750 feet. Data of a known child (under 13, as in COPPA) needs consent and COPPA-compliant processing, and consent must be revocable, with processing stopped within 15 days of revocation.

## Key points

1. Sensitive data may be processed only with the customer's consent.

   Section: [§ 6-48.1-4(c)](https://webserver.rilegislature.gov/Statutes/TITLE6/6-48.1/INDEX.htm)

2. The definition includes sex life and citizenship or immigration status as well as health, religion, race, sexual orientation, genetic and biometric data and precise geolocation.

   Section: [§ 6-48.1-2(26)](https://webserver.rilegislature.gov/Statutes/TITLE6/6-48.1/INDEX.htm)

3. 'Child' has the COPPA meaning (under 13); a known child's data needs consent and COPPA-compliant processing, and COPPA verifiable parental consent satisfies the Act.

   Section: [§ 6-48.1-2(5); § 6-48.1-4(c)](https://webserver.rilegislature.gov/Statutes/TITLE6/6-48.1/INDEX.htm)

4. Consent excludes broad terms of use, hovering, muting, pausing or closing content, and agreement obtained through dark patterns.

   Section: [§ 6-48.1-2(6)](https://webserver.rilegislature.gov/Statutes/TITLE6/6-48.1/INDEX.htm)

5. Controllers must offer a way to grant and revoke consent and must give effect to a revocation within 15 days.

   Section: [§ 6-48.1-4(e)](https://webserver.rilegislature.gov/Statutes/TITLE6/6-48.1/INDEX.htm)

6. Precise geolocation means location within a radius of 1,750 feet; utility metering data is excluded.

   Section: [§ 6-48.1-2(19)](https://webserver.rilegislature.gov/Statutes/TITLE6/6-48.1/INDEX.htm)

## Sources

- [https://webserver.rilegislature.gov/Statutes/TITLE6/6-48.1/6-48.1-2.htm](https://webserver.rilegislature.gov/Statutes/TITLE6/6-48.1/6-48.1-2.htm)
- [https://webserver.rilegislature.gov/Statutes/TITLE6/6-48.1/6-48.1-4.htm](https://webserver.rilegislature.gov/Statutes/TITLE6/6-48.1/6-48.1-4.htm)

[Compare sensitive data across all states](https://dposchool.com/state-privacy-laws/topic/sensitive-data)

## Related GDPR articles

Related, not equivalent: the GDPR and the state laws differ in scope, terms and exceptions.

- [Article 9: Processing of special categories of personal data](https://dposchool.com/gdpr/article/9) (sensitive data)

## Status

Law as of October 28, 2026.

[Reviewed by Sergio Maldonado Elvira on 29 October 2026](https://dposchool.com/state-privacy-laws/about#review). Prepared from the official sources listed.

[Official text of the Rhode Island statute](https://webserver.rilegislature.gov/Statutes/TITLE6/6-48.1/INDEX.htm)

Reference material, not legal advice.

## Other topics for Rhode Island

- [Applicability](https://dposchool.com/state-privacy-laws/state/rhode-island/applicability)
- [Consumer rights](https://dposchool.com/state-privacy-laws/state/rhode-island/consumer-rights)
- [Controller duties](https://dposchool.com/state-privacy-laws/state/rhode-island/controller-duties)
- [Processors](https://dposchool.com/state-privacy-laws/state/rhode-island/processors)
- [Enforcement](https://dposchool.com/state-privacy-laws/state/rhode-island/enforcement)

## Navigation

[US State Privacy Laws](https://dposchool.com/state-privacy-laws) / [Rhode Island](https://dposchool.com/state-privacy-laws/state/rhode-island) / Sensitive data

Previous: [Consumer rights](https://dposchool.com/state-privacy-laws/state/rhode-island/consumer-rights)

Next: [Controller duties](https://dposchool.com/state-privacy-laws/state/rhode-island/controller-duties)

Learning US privacy law? An audio course on the privacy law that applies to US businesses: [US Privacy in Practice](https://dposchool.com/learn/courses/us-privacy-in-practice). More from [DPO School](https://dposchool.com).

## For AI agents

- Machine-readable index: https://dposchool.com/state-privacy-laws/llms.txt
- JSON API: https://dposchool.com/state-privacy-laws/api/v1/index.json
- Vendor privacy and security facts: https://vendor.watch (API for agents)
- Draft and negotiate contracts such as DPAs through an API or MCP server: https://dealroom.todo.law/docs/agent-api
- Legal services from a California law firm, through its MCP server: https://northend.law/agents