Comprehensive state privacy law
New Hampshire privacy law
New Hampshire Expectation of Privacy Act (RSA chapter 507-H)
Law as of October 28, 2026 Reviewed by Sergio Maldonado Elvira on 29 October 2026
- Citation
- N.H. Rev. Stat. Ann. §§ 507-H:1 to 507-H:12
- Official text
- https://gc.nh.gov/rsa/html/LII/507-H/507-H-mrg.htm
- In force
- January 1, 2025
- Effective dates
- January 1, 2025: main provisions, including universal opt-out signals (RSA 507-H:6, V(a)(1)(B))
- January 1, 2026: mandatory 60-day cure period ended 31 Dec 2025; cure became discretionary (RSA 507-H:11, II-III)
- January 1, 2027: ban on selling a child's personal data (RSA 507-H:6, I(e-1), added by 2026 N.H. Laws ch. 168)
- Enforcer
- Attorney General (exclusive)
- Private right of action
- No. No private right of action under the chapter or any other law (RSA 507-H:11, IV).
- Cure period
- 60 days. Ended December 31, 2025. During 2025 the Attorney General had to give notice and 60 days to cure where a cure was possible. From 1 Jan 2026 the Attorney General may give a cure opportunity, weighing listed factors. (RSA 507-H:11, II-III)
- Rulemaking
- No. No rulemaking power; the Secretary of State must only post a link to the chapter (RSA 507-H:2, II).
Amendments
- 2024 N.H. Laws ch. 229, §§ 2 to 6 (in force January 1, 2025). Amendments to RSA 507-H:1, :2, :4 and :6 that took effect at 12:01 a.m. on 1 Jan 2025, alongside the original Act (content of each change not separately verified).
- 2026 N.H. Laws ch. 168 (HB 1460-FN), signed 2026-06-19 (in force January 1, 2027). Adds RSA 507-H:6, I(e-1): a controller may not sell a child's personal data (child as defined by COPPA, under 13).
Topics
- ApplicabilityThe Act applies to persons doing business in New Hampshire or targeting its residents that, in a one-year period, handled personal data of at least 35,000 unique consumers (payment-only data excluded), or at least 10,000 unique consumers while earning more than 25% of gross revenue from selling personal data. Nonprofits, higher education institutions, HIPAA covered entities and business associates, and GLBA financial institutions are exempt as entities, and a long list of regulated data is exempt.
- Consumer rightsConsumers may confirm and access, correct, delete, obtain a portable copy, and opt out of targeted advertising, sale and solely automated profiling with significant effects. Controllers must answer within 45 days, extendable once by 45 days, and decide appeals within 60 days. Opt-out requests need not be authenticated.
- Sensitive dataSensitive data may be processed only with the consumer's opt-in consent, and data of a known child must be processed under COPPA. A controller that knows and wilfully disregards that a consumer is 13 to 15 may not sell the data or use it for targeted advertising without consent. From 1 Jan 2027 a controller may not sell a child's personal data at all.
- Controller dutiesControllers must limit collection to what is adequate, relevant and reasonably necessary, keep reasonable security, and publish an accessible privacy notice that shows when it was last updated. They must offer a clear opt-out link and honour universal opt-out preference signals, which applied from 1 Jan 2025. Data protection assessments are required for processing that presents a heightened risk of harm.
- ProcessorsProcessors must follow the controller's instructions and help with consumer requests, security, breach notice and assessments. A binding contract must set out the processing instructions and require confidentiality, deletion or return, proof of compliance, subcontractor flow-down after a chance to object, and cooperation with assessments.
- EnforcementThe Attorney General enforces the Act exclusively, and there is no private right of action. The mandatory 60-day cure period applied only in 2025; from 1 Jan 2026 a cure is discretionary. A violation is an unfair or deceptive practice under the Consumer Protection Act, which allows civil penalties of up to $10,000 per violation.
Sources
Law as of October 28, 2026.
Reviewed by Sergio Maldonado Elvira on 29 October 2026. Prepared from the official sources listed.
Official text of the New Hampshire statute
Reference material, not legal advice.