RI S2406

Establishes an "Age-Appropriate Design Code" requiring businesses with over $25 million in annual revenue, or that process data of 50,000+ individuals, to use reasonable care to avoid heightened risks of harm to children (defined as under 18) when offering online services, products, or features

Mandates covered entities complete and maintain data protection impact assessments for online services reasonably likely to be accessed by children, with assessments due to the attorney general within 5-7 days upon request

Prohibits covered entities from profiling known children by default, processing unnecessary personal data, collecting precise geolocation without strict necessity and conspicuous notice, or using "dark patterns" to manipulate children into forgoing privacy protections

Requires default privacy settings to offer high-level privacy protection for known children, and privacy policies must be written in clear language suited to the age of children accessing the service

Authorizes the attorney general to impose civil penalties of up to $2,500 per affected child for negligent violations and $7,500 per affected child for intentional violations, with a 90-day cure period for entities in substantial compliance; effective January 1, 2027