Requires that any covered entity that develops/provides online services, products, or features that children are reasonably likely to access shall consider the best interest of children when designing/developing such online service, product, or feature.
S0903 creates a new Rhode Island chapter on an “age-appropriate design code” for online services, products, and features that are likely to be accessed by children. It applies to for-profit entities operating in Rhode Island that meet specified size or data-processing thresholds, and it defines a wide range of privacy and data terms, including personal data, profiling, dark patterns, precise geolocation, sharing, and sale. The bill requires covered entities to use reasonable care to avoid heightened risks of harm to children when designing and offering online products and services.
The bill imposes several affirmative obligations on covered entities, including conducting and updating data protection impact assessments, setting high-privacy default settings for known children, providing age-appropriate privacy notices, and offering accessible tools for children and parents to exercise privacy rights and report concerns. It also restricts certain practices involving children’s data, such as unnecessary processing, default profiling, precise geolocation collection, dark patterns, and undisclosed monitoring or tracking. The attorney general is given enforcement authority, including the ability to seek injunctions and civil penalties, while the bill expressly creates no private right of action. The act would take effect on January 1, 2026.
The bill would add a new chapter to Title 6, Chapter 48.2, and would materially expand state privacy regulation for online services that are reasonably likely to be used by children. It would create new compliance duties for covered businesses, especially those with significant revenue or data-processing activity, and would require them to document child-safety and privacy assessments that are exempt from public disclosure. It also preserves existing obligations under Rhode Island’s other data privacy law and excludes certain health information and clinical-trial data from coverage.
No committee transcript or vote record is provided, so there is no recorded debate or roll-call history to indicate formal support or opposition. Based on the bill text and caption, the measure appears to be framed as a child-protection and privacy bill, with a policy emphasis on safer online design for minors. The absence of recorded votes or hearing remarks means the overall sentiment cannot be measured from the supplied materials, but the bill’s structure suggests a consumer-privacy and child-safety rationale rather than a partisan or procedural one.
The main points of potential contention are the scope of the law and the compliance burden on covered entities. Businesses may object to the revenue and data-volume thresholds, the broad definitions of profiling and sharing, the restrictions on targeted advertising and product design features, and the requirement to produce impact assessments on short timelines for the attorney general. Privacy advocates, by contrast, would likely support the bill’s limits on dark patterns, geolocation tracking, and profiling of children, as well as its high-privacy default settings and age-appropriate disclosures. Another possible point of debate is the attorney general’s enforcement authority and civil penalties, though the bill does include a cure period for substantial compliance and does not create a private right of action.