DPO SchoolDPO School

New Hampshire Expectation of Privacy Act (RSA chapter 507-H)

New Hampshire privacy law (NHPA): sensitive data

Law as of October 28, 2026 Reviewed by Sergio Maldonado Elvira on 29 October 2026

Summary (not the statute text)

Sensitive data may be processed only with the consumer's opt-in consent, and data of a known child must be processed under COPPA. A controller that knows and wilfully disregards that a consumer is 13 to 15 may not sell the data or use it for targeted advertising without consent. From 1 Jan 2027 a controller may not sell a child's personal data at all.

Key points

  1. Sensitive data: racial or ethnic origin, religious beliefs, mental or physical health condition or diagnosis, sex life, sexual orientation, citizenship or immigration status, genetic or biometric data for identification, data collected from a known child, and precise geolocation (within 1,750 feet).

    Section: RSA 507-H:1, XX, XXVIII

  2. Opt-in consent is required; known-child data must be processed under COPPA.

    Section: RSA 507-H:6, I(d)

  3. No targeted advertising or sale without consent where the controller has actual knowledge and wilfully disregards that the consumer is at least 13 and under 16.

    Section: RSA 507-H:6, I(g)

  4. From 1 Jan 2027 a controller may not sell a child's personal data (child as defined in COPPA).

    Section: RSA 507-H:6, I(e-1)

  5. Complying with COPPA verifiable parental consent satisfies any parental consent duty under the chapter.

    Section: RSA 507-H:3, III

Sources

Compare sensitive data across all states

Related GDPR articles

Related, not equivalent: the GDPR and the state laws differ in scope, terms and exceptions.

Law as of October 28, 2026.

Reviewed by Sergio Maldonado Elvira on 29 October 2026. Prepared from the official sources listed.

Official text of the New Hampshire statute

Reference material, not legal advice.