RI S2766

Data brokers that collect, share, or sell personal data of consumers without a direct relationship must register annually with the Rhode Island Department of Business Regulation by January 31 and pay a registration fee

The Department must establish an accessible deletion mechanism by January 1, 2027, allowing consumers to submit a single request to delete their personal data from all registered data brokers

Data brokers must process deletion requests within 45 days beginning August 1, 2027, and continue deleting newly collected data every 45 days unless the consumer opts out

Registration requires disclosure of data collection practices including whether the broker collects sensitive information such as biometric data, precise geolocation, reproductive health data, citizenship status, and whether data was shared with foreign actors, governments, law enforcement, or GenAI developers

Data brokers face administrative fines of $200 per day for failure to register and $200 per day per deletion request for failure to comply with deletion requirements, with mandatory independent compliance audits every three years beginning January 1, 2028