RI S2129

Creates new privacy protections for "consumer health data" covering reproductive healthcare, sexual health, and gender-affirming care information, including location data and online research activity that could indicate someone is seeking these services

Requires regulated entities to obtain clear, opt-in consent before collecting or sharing consumer health data, with compliance deadlines of January 1, 2027 for larger entities and April 1, 2027 for small businesses

Grants consumers rights to access their health data, receive lists of third parties with whom data was shared, withdraw consent, and request deletion within 45 days of a request

Prohibits the sale of consumer health data without separate written authorization from the consumer that expires after one year and must include specific disclosures about the buyer and intended use

Bans geofencing within 2,000 feet of healthcare facilities to track or collect data from consumers, and allows private civil lawsuits and attorney general enforcement actions for violations