Rhode Island Data Transparency and Privacy Protection Act (RIDTPPA) 6-48.1-3(a): Section 6-48.1-3(a): commercial websites and ISPs designate a controller and disclose data categories and buyers

What does 6-48.1-3(a) require?

Any commercial website or internet service provider doing business in Rhode Island, with Rhode Island customers or otherwise subject to its jurisdiction must designate a controller. If it collects, stores and sells customers' personally identifiable information, the controller must, in its customer agreement or an incorporated addendum or another conspicuous place on its website or platform where such notices are usually posted, identify all categories of personal data it collects about customers through the site or service, identify all third parties to whom it has sold or may sell customers' personally identifiable information, and give an active email address or other online contact mechanism. This section carries no volume threshold; the 35,000 and 10,000 customer thresholds are written into sections 6-48.1-4 to -7 only.