Rhode Island's Data Transparency and Privacy Protection Act (RIDTPPA) took effect on January 1, 2026, giving Rhode Island residents significant new rights over their personal data. If you live in Rhode Island, you now have the legal power to opt out of data sales, targeted advertising, and automated profiling. Here is everything you need to know about exercising those rights and removing your information from data broker sites.
What Is the RIDTPPA?
The Rhode Island Data Transparency and Privacy Protection Act (RIDTPPA) is a comprehensive consumer privacy law signed into law in 2024 and effective as of January 1, 2026. It follows the framework established by similar laws in Connecticut, Virginia, and Colorado, giving consumers a defined set of rights over the personal data that businesses collect and sell.
The law applies to entities that conduct business in Rhode Island or target Rhode Island residents and meet one of the following thresholds:
- Process the personal data of 35,000 or more Rhode Island consumers during a calendar year
- Process the personal data of 10,000 or more consumers and derive more than 20% of gross revenue from the sale of personal data
Most major data brokers, people-search sites, and large online platforms meet these thresholds, meaning they are required to comply with your opt-out requests.
Your Rights Under the RIDTPPA
As a Rhode Island resident, the RIDTPPA grants you the following rights:
- Right to know: You can confirm whether a business is processing your personal data and access a copy of that data
- Right to correct: You can request correction of inaccurate personal data
- Right to delete: You can request deletion of your personal data
- Right to data portability: You can obtain a copy of your data in a portable, readily usable format
- Right to opt out of sale: You can opt out of the sale of your personal data
- Right to opt out of targeted advertising: You can opt out of the use of your data for targeted advertising
- Right to opt out of profiling: You can opt out of automated profiling that produces legal or similarly significant effects
Key Definitions
Under the RIDTPPA, "sale" of personal data means exchanging personal data for monetary consideration. "Targeted advertising" means displaying ads selected based on personal data obtained from a consumer's activities across different businesses or websites. Standard contextual advertising (ads based on the content of the page you are viewing) is not considered targeted advertising.
Response Timelines and Process
When you submit a request under the RIDTPPA, businesses must respond within 45 days. They may extend this period by an additional 45 days if reasonably necessary, but must notify you of the extension and the reason for it within the initial 45-day window.
Businesses cannot charge a fee for processing your request unless it is manifestly unfounded or excessive. If they deny your request, they must provide a clear explanation and instructions for how to appeal.
The Appeals Process
If a business denies your opt-out or deletion request, you have the right to appeal. The business must provide a clear mechanism for submitting an appeal and must respond to your appeal within 60 days. If the appeal is also denied, the business must provide you with instructions on how to file a complaint with the Rhode Island Attorney General.
Notable Limitation: No Universal Opt-Out Signal Requirement
Unlike California's CCPA amendments and Colorado's privacy law, the RIDTPPA does not require businesses to honor universal opt-out signals such as the Global Privacy Control (GPC). This means you cannot simply enable a browser-based opt-out signal and have it apply automatically across all websites.
Instead, you must opt out individually from each data broker and business that holds your data. This is a significant limitation that makes manual opt-outs substantially more time-consuming for Rhode Island residents compared to California residents who can use the GPC signal.
California's DROP Platform Is Only for California Residents
California launched its Data Broker Registry Opt-Out Platform (DROP) in 2026, which allows California residents to submit a single deletion request that applies to all registered data brokers. Unfortunately, this platform is only available to California residents. Rhode Island residents must opt out from each data broker individually or use an automated service like PrivacyOn.
How to Exercise Your Rights Step by Step
Follow this process to opt out of data brokers operating in Rhode Island:
Step 1: Identify Which Brokers Have Your Data
Search for yourself on major data broker and people-search sites to see which ones have profiles on you. Start with these commonly used platforms:
- Spokeo -- spokeo.com
- BeenVerified -- beenverified.com
- Whitepages -- whitepages.com
- PeopleFinders -- peoplefinders.com
- Radaris -- radaris.com
- TruePeopleSearch -- truepeoplesearch.com
- Intelius -- intelius.com
- USSearch -- ussearch.com
- Acxiom -- acxiom.com
- LexisNexis -- lexisnexis.com
Step 2: Submit Opt-Out Requests
Visit each broker's privacy page or opt-out portal. Most have online forms, though some require email requests or even postal mail. When submitting your request:
- Clearly state that you are a Rhode Island resident exercising your rights under the RIDTPPA
- Specify that you want to opt out of the sale of your personal data and request deletion
- Provide enough identifying information for them to locate your records (name, email, city) but do not over-share -- never provide your Social Security number unless absolutely required
- Keep a record of every request you submit, including the date and method of submission
Step 3: Follow Up After 45 Days
If you have not received a response within 45 days, send a follow-up referencing your original request. Remind the business of the RIDTPPA's 45-day response requirement and note that you may file a complaint with the Attorney General if they fail to comply.
Step 4: Appeal Denials
If a broker denies your request, use their appeals process. Document all communications. If the appeal is denied, you can file a complaint with the Rhode Island Attorney General's office at riag.ri.gov.
Step 5: Monitor for Re-Listing
Data brokers frequently re-acquire and re-list your information from public records, data partnerships, and other sources. Even after a successful opt-out, your data may reappear within weeks or months. Check back periodically and be prepared to submit opt-out requests again.
Enforcement
The RIDTPPA is enforced by the Rhode Island Attorney General. There is no private right of action, meaning individual consumers cannot sue businesses directly for violations. Instead, complaints must go through the AG's office. The Attorney General can impose civil penalties for violations after providing the business with a 30-day cure period to address the issue.
The Easier Alternative: Automated Removal
Manually opting out of each data broker is effective but extremely time-consuming. With no universal opt-out signal requirement in Rhode Island, you are looking at dozens of individual requests, each with its own process, followed by ongoing monitoring for re-listings.
PrivacyOn handles this entire process automatically. PrivacyOn submits opt-out requests to over 100 data broker sites on your behalf, monitors for re-listings, and re-submits removal requests whenever your data reappears. For Rhode Island residents who lack the hours needed to manage this manually, PrivacyOn provides continuous, automated protection that keeps your personal data off these sites year-round -- starting at just $8.33 per month.
Whether you handle opt-outs manually or use an automated service, the important thing is to exercise the rights that the RIDTPPA now provides. Your personal data has value, and Rhode Island law now gives you the power to control how it is used.