---
title: "New Hampshire privacy law (NHPA): consumer rights"
canonical: "https://dposchool.com/state-privacy-laws/state/new-hampshire/consumer-rights"
source: "https://gc.nh.gov/rsa/html/LII/507-H/507-H-mrg.htm"
text_as_of: "2026-10-28"
last_reviewed: "2026-10-29"
language: "en-US"
publisher: "DPO School"
---

New Hampshire Expectation of Privacy Act (RSA chapter 507-H)

# New Hampshire privacy law (NHPA): consumer rights

Law as of October 28, 2026 · [Reviewed by Sergio Maldonado Elvira on 29 October 2026](https://dposchool.com/state-privacy-laws/about#review)

## Summary (not the statute text)

Consumers may confirm and access, correct, delete, obtain a portable copy, and opt out of targeted advertising, sale and solely automated profiling with significant effects. Controllers must answer within 45 days, extendable once by 45 days, and decide appeals within 60 days. Opt-out requests need not be authenticated.

## Key points

1. Rights: confirm and access, correct, delete, portable copy, and opt-outs of targeted advertising, sale and profiling.

   Section: [RSA 507-H:4, I(a)-(e)](https://gc.nh.gov/rsa/html/LII/507-H/507-H-mrg.htm)

2. Respond within 45 days; one 45-day extension if reasonably necessary, notified within the first 45 days with reasons.

   Section: [RSA 507-H:4, III(a)](https://gc.nh.gov/rsa/html/LII/507-H/507-H-mrg.htm)

3. Information is free once per consumer in any 12-month period.

   Section: [RSA 507-H:4, III(c)](https://gc.nh.gov/rsa/html/LII/507-H/507-H-mrg.htm)

4. Opt-out requests need not be authenticated, but may be refused with notice if reasonably believed fraudulent.

   Section: [RSA 507-H:4, III(d)](https://gc.nh.gov/rsa/html/LII/507-H/507-H-mrg.htm)

5. Appeals must be decided in writing within 60 days; if denied, the consumer must be told how to complain to the Attorney General.

   Section: [RSA 507-H:4, IV](https://gc.nh.gov/rsa/html/LII/507-H/507-H-mrg.htm)

6. Authorized agents, including browser or device settings, may exercise opt-out rights.

   Section: [RSA 507-H:5](https://gc.nh.gov/rsa/html/LII/507-H/507-H-mrg.htm)

## Sources

- [RSA chapter 507-H (merged text with source notes)](https://gc.nh.gov/rsa/html/LII/507-H/507-H-mrg.htm)

[Compare consumer rights across all states](https://dposchool.com/state-privacy-laws/topic/consumer-rights)

## Related GDPR articles

Related, not equivalent: the GDPR and the state laws differ in scope, terms and exceptions.

- [Article 15: Right of access by the data subject](https://dposchool.com/gdpr/article/15) (access)
- [Article 17: Right to erasure (‘right to be forgotten’)](https://dposchool.com/gdpr/article/17) (deletion)
- [Article 20: Right to data portability](https://dposchool.com/gdpr/article/20) (portability)

## Status

Law as of October 28, 2026.

[Reviewed by Sergio Maldonado Elvira on 29 October 2026](https://dposchool.com/state-privacy-laws/about#review). Prepared from the official sources listed.

[Official text of the New Hampshire statute](https://gc.nh.gov/rsa/html/LII/507-H/507-H-mrg.htm)

Reference material, not legal advice.

## Other topics for New Hampshire

- [Applicability](https://dposchool.com/state-privacy-laws/state/new-hampshire/applicability)
- [Sensitive data](https://dposchool.com/state-privacy-laws/state/new-hampshire/sensitive-data)
- [Controller duties](https://dposchool.com/state-privacy-laws/state/new-hampshire/controller-duties)
- [Processors](https://dposchool.com/state-privacy-laws/state/new-hampshire/processors)
- [Enforcement](https://dposchool.com/state-privacy-laws/state/new-hampshire/enforcement)

## Navigation

[US State Privacy Laws](https://dposchool.com/state-privacy-laws) / [New Hampshire](https://dposchool.com/state-privacy-laws/state/new-hampshire) / Consumer rights

Previous: [Applicability](https://dposchool.com/state-privacy-laws/state/new-hampshire/applicability)

Next: [Sensitive data](https://dposchool.com/state-privacy-laws/state/new-hampshire/sensitive-data)

Learning US privacy law? An audio course on the privacy law that applies to US businesses: [US Privacy in Practice](https://dposchool.com/learn/courses/us-privacy-in-practice). More from [DPO School](https://dposchool.com).

## For AI agents

- Machine-readable index: https://dposchool.com/state-privacy-laws/llms.txt
- JSON API: https://dposchool.com/state-privacy-laws/api/v1/index.json
- Vendor privacy and security facts: https://vendor.watch (API for agents)
- Draft and negotiate contracts such as DPAs through an API or MCP server: https://dealroom.todo.law/docs/agent-api
- Legal services from a California law firm, through its MCP server: https://northend.law/agents