Rhode Island does not have a comprehensive consumer privacy law as of June 2026, but federal CAN-SPAM, COPPA, ADA Title III, and FTC Act apply to every website serving Rhode Island residents. Rhode Island also has narrower state-specific rules noted below.
Last reviewed 2026-06-19 · Risk rating rationale: Rhode Island relies primarily on federal law plus narrow state-specific rules. Compliance focuses on the federal baseline + the specific quirk noted in Key Laws.
Scantra runs a free, no-account, 9-check audit of your homepage covering privacy policy, contact info, CCPA-style opt-out, security headers, accessibility, and SEO basics. Most Rhode Island sites we scan fail at least three.
Run a free scan →No credit card · Email required so we can send you the full results.
The statutes most likely to apply to a commercial website serving Rhode Island residents. Click a citation to read the official text where available.
Applies to: Rhode Island's Data Transparency and Privacy Protection Act takes effect Jan 1, 2026. Full Tier-1 coverage will be added then.
What your website must do
Citation: See state code citation in summary
What your site has to disclose, ask consent for, and allow consumers to do with their personal information.
Rhode Island has no comprehensive privacy law. Sectoral federal laws (HIPAA for health, FERPA for education, GLBA for financial, COPPA for children under 13) apply where relevant.
Practical requirements for your website
When you need consent, opt-outs, or universal-signal honor for cookies and analytics scripts.
Rhode Island does not require a cookie consent banner. EU/UK visitors trigger GDPR/UK GDPR cookie consent requirements independently.
Practical requirements for your website
WCAG conformance expectations and how the state's accessibility cases tend to be litigated.
Federal ADA Title III applies to commercial websites serving Rhode Island residents.
Practical requirements for your website
What 'reasonable security' looks like under state law and how fast you have to notify after a breach.
Rhode Island has no website-specific cybersecurity statute beyond standard data-breach notification. Federal sectoral laws (HIPAA for health, GLBA for financial, FTC Act § 5 'unfair practices' for general consumer harm) and recognized frameworks (NIST CSF, ISO 27001, CIS Controls) set the practical baseline.
Practical requirements for your website
How federal CAN-SPAM and TCPA interact with state-level marketing rules in this jurisdiction.
Federal CAN-SPAM governs commercial email regardless of state.
Practical requirements for your website
Which AI uses the state has chosen to regulate, who's covered, and what the website has to disclose.
Rhode Island has no AI-specific consumer protection law. Federal FTC Act § 5 prohibits unfair or deceptive AI deployment, but enforcement is case-by-case.
Practical requirements for your website
The same free 9-rule scan, no signup needed. Two of the findings include drafted fixes you can copy/paste; full results (and ongoing monitoring) come with a free account.
Run a free scan →No credit card · Email required so we can send you the full results.
We're building a state-by-state compliance overview for the entire United States. Here's what's published today:
Important: Scantra is a software tool and a non-profit publisher, not a law firm. The summaries on this page are written for general business orientation and reflect the editors' reading of the statutes as of 2026-06-19. They are not legal advice and should not be the only source you rely on for compliance decisions. For your specific situation, consult a licensed attorney in Rhode Island.