RI H7632

Creates an "Age-Appropriate Design Code" requiring covered entities offering online services, products, or features to children under 18 to use reasonable care to avoid heightened risks of harm, including unfair treatment, financial/reputational injury, privacy intrusions, and discrimination.

Applies to businesses operating in Rhode Island with annual gross revenues exceeding $25 million, those handling personal data of 50,000+ individuals/households/devices, or those deriving 50%+ of revenue from selling personal data.

Mandates data protection impact assessments for online services likely accessed by children, with assessments to be updated within 90 days of material changes and provided to the attorney general within 5-7 days upon request.

Prohibits covered entities from profiling children by default, processing unnecessary personal data, collecting precise geolocation without strict necessity, using dark patterns to extract data, or allowing parental monitoring without notifying the child.

Authorizes the attorney general to impose civil penalties of up to $2,500 per affected child for negligent violations and $7,500 per affected child for intentional violations, with no private right of action; effective January 1, 2027.