RI S2992

Requires entities collecting reproductive health or gender-affirming care data to obtain affirmative opt-in consent from consumers before collection or sharing, with regulated entities complying by January 1, 2027 and small businesses by April 1, 2027

Prohibits the sale of consumer health data without a separate valid written authorization that must include specific disclosures and expires after one year

Grants consumers the right to access their health data, withdraw consent, and request deletion within 45 days, including deletion from backup systems within 6 months

Bans geofencing within 2,000 feet of reproductive healthcare or gender-affirming care facilities to track consumers or collect health data

Allows individuals to bring civil lawsuits for injunctive relief, compensatory and punitive damages, plus attorney fees; violations also constitute deceptive trade practices enforceable by the attorney general