Rhode Island

Effective January 1, 2027 by the act's own terms, it is unlawful to operate or provide an "AI companion" (a system using AI, generative AI, or emotional-recognition algorithms to simulate social human interaction) unless it contains a protocol addressing possible suicidal ideation or self-harm, physical harm to others, and financial harm to others expressed by a user, including referral to crisis services.

An operator must also notify users at the start of an interaction and at least every three hours thereafter, in specified bold text or spoken form, that the AI companion is a computer program that cannot feel human emotion. A person physically or financially harmed as a result of a violation may sue in superior court for damages and equitable relief, and the Attorney General may investigate and sue under the state's deceptive trade practices chapter.

Section 11-9-1.3 defines "child pornography" to include a visual depiction that is a digital image, computer image, or computer-generated image of a minor engaging in sexually explicit conduct, or one that has been created, adapted, or modified to display an identifiable minor engaging in such conduct, alongside the ordinary case of an actual minor's image.

This technology-neutral language, in force since 2001 and last amended in 2004, already reaches an AI-generated or AI-altered depiction without needing a dedicated 2024 or 2025 amendment; no such amendment was located. Production, transport, or reproduction of covered material is punishable by a fine of not more than $5,000 and imprisonment of not more than fifteen years, or both; mere possession is punishable by not more than $5,000 and five years, or both.

Section 11-64-3(a)(1), as amended by two 2025 public laws effective July 2, 2025, reaches a sexually explicit visual image of an identifiable adult "including any image created by a digital device or altered by digitization," language that covers a synthetic or AI-altered intimate image of a real, identifiable person alongside an unaltered photograph or recording.

Liability requires that the image was made or obtained under circumstances a reasonable person would know were meant to stay private (or was made without consent), was disseminated without the depicted person's consent, and was disseminated with knowledge or reckless disregard of likely harm, or with intent to harass, intimidate, threaten, or coerce.

A first violation is a misdemeanor (up to one year and $1,000); a second or subsequent violation is a felony (up to three years and $3,000); threatening to disclose such an image for a benefit, or demanding payment to remove one from public view, is a separate felony (up to five years and $5,000). Newsworthy, law-enforcement, legal-proceeding, and interactive-computer-service exemptions apply.

This act bars any individual, corporation, or entity from offering therapy or psychotherapy services in Rhode Island, including through internet-based AI, unless the services are conducted by a state-licensed professional or provider.

A licensed provider may use AI only for administrative or supplementary support (scheduling, billing, records, drafting logistics communications, tracking client progress subject to professional review), and never to make independent therapeutic decisions, conduct therapeutic communication directly with a client without an established provider relationship, or determine treatment plans.

Where a client's session is recorded or transcribed and an AI system simulating emotional attachment or bonding assists with supplementary support or therapeutic communication, the patient or their representative must be informed in writing and consent. The act's own text states it takes effect upon passage.

Contemporaneous Rhode Island state-policy reporting (Rhode Island Current, Route Fifty) describes the act as signed by Governor Dan McKee in June 2026, but the exact signing date and session-law chapter number are not confirmed in a primary session-law record.

Effective July 2, 2025, section 17-30-1 bars a candidate, campaign committee, party committee, or independent-expenditure person or entity from distributing, within ninety days of an election, "synthetic media" that realistically but falsely depicts a candidate's appearance, action, or speech in a way that creates a fundamentally different impression than the real, unaltered version, where the distributor knows or should know it is deceptive.

The prohibition does not apply if the media carries a disclosure that it was manipulated or generated by artificial intelligence, sized and timed as the statute specifies for visual and audio media. A depicted candidate may seek injunctive relief and sue for general or special damages plus attorney's fees, proven by clear and convincing evidence. Broadcasters, news publications that label the media as inaccurate, satire and parody, and interactive computer services are exempted.

This act requires any healthcare provider or healthcare facility that employs AI to document an in-person or telehealth visit to notify patients that AI was used for that purpose, and to review the AI-generated documentation for accuracy after the visit. "Healthcare facility" carries the meaning given at section 23-17-2, which reaches a facility whether public or private, so the duty binds a government-run facility as well as a private one. The act's own text states it takes effect upon passage.

Contemporaneous Rhode Island state-policy reporting describes it as signed into law alongside two related AI bills in June 2026, but the exact signing date and session-law chapter number are not confirmed in a primary session-law record.

Any municipal agency, state agency, or person that stores, owns, collects, processes, maintains, acquires, uses, or licenses data including personal information must notify affected Rhode Island residents of a breach that poses a significant risk of identity theft, within 30 days of confirmation for a state or municipal agency and within 45 days for any other person, with Attorney General and consumer-reporting-agency notice required once more than 500 residents are affected.

Reckless violations carry a penalty of up to $100 per record and knowing and willful violations up to $200 per record, brought by the Attorney General; no private right of action was found in the text read. Sections 11-49.3-4 and 11-49.3-5 both originate in P.L. 2015, ch. 138 and ch. 148; sec. 11-49.3-4's notice duty was last amended by P.L. 2023, ch. 375, sec. 1, effective June 27, 2023, while sec. 11-49.3-5's penalty provisions carry no amendment since 2015.

Neither section's own history note prints a same-page effective date for the original 2015 enactment, so no single effective date is recorded for this citation's combined range.

RIDTPPA applies only to for-profit entities conducting business in Rhode Island, or targeting products or services to Rhode Island residents, that in the preceding calendar year controlled or processed personal data of at least 35,000 customers (excluding payment-only data), or 10,000 customers while deriving more than 20 percent of gross revenue from personal-data sales.

Two companion 2024 bills, H 7787 and S 2500, produced two public laws for the same chapter (P.L. 2024, ch. 430 and ch. 453), both effective January 1, 2026.

RIDTPPA gives a Rhode Island customer the right to confirm and access their personal data, correct inaccuracies, delete data, obtain a portable copy, and opt out of targeted advertising, the sale of personal data, and significant-effect profiling. A controller must respond without undue delay and not later than 45 days after receipt, with one 45-day extension available, and must decide an appeal within 60 days, after which the customer may complain to the Attorney General.

A violation of RIDTPPA is a deceptive trade practice, and intentional disclosure of personal data to a shell company or otherwise in violation of the chapter carries a fine of $100 to $500 per disclosure. The Attorney General has sole enforcement authority, and unlike New Hampshire's and Kentucky's near-identical statutes, no mandatory or discretionary cure period appears in the enforcement section as read. The chapter creates no private right of action.

RIDTPPA classifies genetic or biometric data processed to uniquely identify a person, along with racial or ethnic origin, religious belief, health condition, sex life, sexual orientation, citizenship or immigration status, a known child's data, and precise geolocation, as sensitive data.

"Biometric data" is textually identical to New Hampshire's and Kentucky's definitions: it means data from automatic measurement of a biological characteristic, such as a fingerprint, voiceprint, or eye retina or iris, used to identify a specific individual, and excludes a photograph or recording, or data generated from one, only until that data is generated to identify a specific individual.

Section 11-52-1(15)(v) defines a person as "without authority" when he or she has no right or permission of the owner to use a computer, or uses a computer in a manner exceeding his or her right or permission, a broad without-permission-or-exceeding-permission standard rather than the Computer Fraud and Abuse Act (CFAA)'s narrower gates-based test.

Section 11-52-3 makes it a felony to intentionally and without authorization access, alter, damage, or destroy a computer, system, network, program, or data for a fraudulent or other illegal purpose. Section 11-52-4.1 separately criminalizes using a computer or network without authority and with intent to disable data or programs, cause a malfunction, alter or erase data, forge bulk-email headers, or similar disruptive acts, regardless of a fraudulent purpose.

Felony violations of the chapter carry a fine of not more than five thousand dollars and imprisonment of not more than five years, or both. The lesser tier under section 11-52-4.1 (property value of five hundred dollars or less) is a misdemeanor punishable by not more than one year and a one-thousand-dollar fine, a different fine amount from the chapter's general misdemeanor tier of five hundred dollars.

Section 11-52-6 gives any person injured by a violation of the chapter a private civil right of action for compensatory damages, punitive damages, court costs, and reasonable attorney's fees, broader than the federal CFAA's civil-suit route, which is conditioned on specific categories of loss.

RIDTPPA's definition of "personal data" at section 6-48.1-2(18) excludes "publicly available information," defined at (24) as information that is lawfully made available through federal, state, or municipal government records or widely distributed media, or that a controller has a reasonable basis to believe a customer has lawfully made available to the general public.

Unlike California's four-prong CCPA exemption, Rhode Island's exemption has no separate prong reaching information a third party (rather than the data subject) disclosed without restricting the audience, so personal data a scraper pulls from a re-hosted directory or an aggregator that is neither a government record nor the data subject's own act falls outside the exemption and inside RIDTPPA's reach for a controller the Act otherwise covers.

RIDTPPA applies only to for-profit entities that conduct business in, or target products or services to, Rhode Island residents and meet its 35,000-customer or 10,000-customer-plus-20-percent-revenue thresholds; its enforcement and further customer-rights detail are researched in this jurisdiction's privacy topic document.

A municipal agency, a state agency, or a person who or that stores, collects, processes, maintains, acquires, uses, owns, or licenses personal information about a Rhode Island resident must implement and maintain a risk-based information security program with reasonable security procedures and practices appropriate to the size and scope of the organization, the nature of the information, and the purpose for which it was collected, to protect the personal information from unauthorized access, use, modification, destruction, or disclosure and to preserve its confidentiality, integrity, and availability.

Personal information may not be retained longer than reasonably required to provide the requested services, meet the purpose for which it was collected, or comply with a written retention policy or legal requirement. It must be destroyed securely, including by shredding, pulverization, incineration, or erasure, regardless of the medium.

A municipal agency, state agency, or person that discloses personal information about a Rhode Island resident to a nonaffiliated third party must require by written contract that the third party implement and maintain the same kind of reasonable security procedures and practices. Sec. 11-49.3-5 makes each reckless violation of the chapter a civil violation of up to $100 per record.

Each knowing and willful violation is a civil violation of up to $200 per record, brought solely by the Attorney General; no private right of action was found in the text read. Both sections originate in P.L. 2015, ch. 138 and P.L. 2015, ch. 148, and neither section's own history note prints a same-page effective date for the 2015 enactment.