---
title: "New Hampshire privacy law (NHPA): sensitive data"
canonical: "https://dposchool.com/state-privacy-laws/state/new-hampshire/sensitive-data"
source: "https://gc.nh.gov/rsa/html/LII/507-H/507-H-mrg.htm"
text_as_of: "2026-10-28"
last_reviewed: "2026-10-29"
language: "en-US"
publisher: "DPO School"
---

New Hampshire Expectation of Privacy Act (RSA chapter 507-H)

# New Hampshire privacy law (NHPA): sensitive data

Law as of October 28, 2026 · [Reviewed by Sergio Maldonado Elvira on 29 October 2026](https://dposchool.com/state-privacy-laws/about#review)

## Summary (not the statute text)

Sensitive data may be processed only with the consumer's opt-in consent, and data of a known child must be processed under COPPA. A controller that knows and wilfully disregards that a consumer is 13 to 15 may not sell the data or use it for targeted advertising without consent. From 1 Jan 2027 a controller may not sell a child's personal data at all.

## Key points

1. Sensitive data: racial or ethnic origin, religious beliefs, mental or physical health condition or diagnosis, sex life, sexual orientation, citizenship or immigration status, genetic or biometric data for identification, data collected from a known child, and precise geolocation (within 1,750 feet).

   Section: [RSA 507-H:1, XX, XXVIII](https://gc.nh.gov/rsa/html/LII/507-H/507-H-mrg.htm)

2. Opt-in consent is required; known-child data must be processed under COPPA.

   Section: [RSA 507-H:6, I(d)](https://gc.nh.gov/rsa/html/LII/507-H/507-H-mrg.htm)

3. No targeted advertising or sale without consent where the controller has actual knowledge and wilfully disregards that the consumer is at least 13 and under 16.

   Section: [RSA 507-H:6, I(g)](https://gc.nh.gov/rsa/html/LII/507-H/507-H-mrg.htm)

4. From 1 Jan 2027 a controller may not sell a child's personal data (child as defined in COPPA).

   Section: [RSA 507-H:6, I(e-1)](https://gc.nh.gov/rsa/html/LII/507-H/507-H-mrg.htm)

5. Complying with COPPA verifiable parental consent satisfies any parental consent duty under the chapter.

   Section: [RSA 507-H:3, III](https://gc.nh.gov/rsa/html/LII/507-H/507-H-mrg.htm)

## Sources

- [RSA chapter 507-H (merged text with source notes)](https://gc.nh.gov/rsa/html/LII/507-H/507-H-mrg.htm)
- [HB 1460-FN (2026) bill status: signed 06/19/2026, chapter 168, effective 01/01/2027](https://gc.nh.gov/bill_status/billinfo.aspx?id=2443)

[Compare sensitive data across all states](https://dposchool.com/state-privacy-laws/topic/sensitive-data)

## Related GDPR articles

Related, not equivalent: the GDPR and the state laws differ in scope, terms and exceptions.

- [Article 9: Processing of special categories of personal data](https://dposchool.com/gdpr/article/9) (sensitive data)

## Status

Law as of October 28, 2026.

[Reviewed by Sergio Maldonado Elvira on 29 October 2026](https://dposchool.com/state-privacy-laws/about#review). Prepared from the official sources listed.

[Official text of the New Hampshire statute](https://gc.nh.gov/rsa/html/LII/507-H/507-H-mrg.htm)

Reference material, not legal advice.

## Other topics for New Hampshire

- [Applicability](https://dposchool.com/state-privacy-laws/state/new-hampshire/applicability)
- [Consumer rights](https://dposchool.com/state-privacy-laws/state/new-hampshire/consumer-rights)
- [Controller duties](https://dposchool.com/state-privacy-laws/state/new-hampshire/controller-duties)
- [Processors](https://dposchool.com/state-privacy-laws/state/new-hampshire/processors)
- [Enforcement](https://dposchool.com/state-privacy-laws/state/new-hampshire/enforcement)

## Navigation

[US State Privacy Laws](https://dposchool.com/state-privacy-laws) / [New Hampshire](https://dposchool.com/state-privacy-laws/state/new-hampshire) / Sensitive data

Previous: [Consumer rights](https://dposchool.com/state-privacy-laws/state/new-hampshire/consumer-rights)

Next: [Controller duties](https://dposchool.com/state-privacy-laws/state/new-hampshire/controller-duties)

Learning US privacy law? An audio course on the privacy law that applies to US businesses: [US Privacy in Practice](https://dposchool.com/learn/courses/us-privacy-in-practice). More from [DPO School](https://dposchool.com).

## For AI agents

- Machine-readable index: https://dposchool.com/state-privacy-laws/llms.txt
- JSON API: https://dposchool.com/state-privacy-laws/api/v1/index.json
- Vendor privacy and security facts: https://vendor.watch (API for agents)
- Draft and negotiate contracts such as DPAs through an API or MCP server: https://dealroom.todo.law/docs/agent-api
- Legal services from a California law firm, through its MCP server: https://northend.law/agents