New Hampshire Privacy Act
Amended New Hampshire · In force Jan 1, 2025 · next deadline Jan 1, 2027 (in 3 months)
Deadlines
Summaries for reference, not legal advice. Check the official text.
What it does
Comprehensive consumer privacy law giving New Hampshire residents access, correction, deletion, portability and opt-out rights (sale, targeted ads, profiling), with opt-in consent for sensitive data, universal opt-out signal support and data protection assessments. A 2026 amendment (HB 1460) bans selling the personal data of children under 13 starting in 2027.
- Who it applies to
- Persons conducting business in NH or targeting NH residents that in a one-year period controlled or processed personal data of at least 35,000 unique consumers (excluding payment-only data), or at least 10,000 unique consumers while deriving more than 25% of gross revenue from selling personal data (RSA 507-H:2). Usual GLBA, HIPAA, nonprofit and higher-ed exemptions.
- Penalties
- Violations are unfair or deceptive acts under the Consumer Protection Act (RSA 358-A): civil penalties up to $10,000 per violation (RSA 358-A:4). 60-day cure notice was mandatory Jan 1 to Dec 31, 2025; from Jan 1, 2026 the AG may offer a cure at its discretion (RSA 507-H:11). No private right of action.
- Enforced by
- New Hampshire Attorney General (exclusive)
- Official name
- New Hampshire Privacy Act (SB 255, 2024), RSA chapter 507-H
- Citation
- RSA 507-H (Laws 2024, ch. 5; amended 2026, ch. 168 (HB 1460))
- Topics
- privacy, children
Research notes
SB 255 signing date (March 6, 2024) is from contemporaneous reporting; RSA source note confirms Laws 2024, ch. 5. HB 1460 signed June 19, 2026 (chapter 168); Jan 1, 2027 effective date is per Covington Inside Privacy, cross-checked against the NH bill status page showing the bill was signed. The Secretary of State publishes the law link per RSA 507-H:2 II; AG rulemaking is not provided for.
Related
Alabama Personal Data Protection Act (APDPA)
CCPA / CPRA
Colorado AI Act
Connecticut Data Privacy Act (CTDPA)Questions about New Hampshire Privacy Act
- What are the New Hampshire Privacy Act compliance deadlines?
- Jan 1, 2025: New Hampshire Privacy Act takes effect. Jan 1, 2026: Mandatory 60-day cure period expires. Jan 1, 2027: Ban on selling personal data of children under 13 (HB 1460).
- When does New Hampshire Privacy Act take effect?
- New Hampshire Privacy Act took effect on Jan 1, 2025. The next milestone is Jan 1, 2027: Ban on selling personal data of children under 13 (HB 1460).
- Who does New Hampshire Privacy Act apply to?
- Persons conducting business in NH or targeting NH residents that in a one-year period controlled or processed personal data of at least 35,000 unique consumers (excluding payment-only data), or at least 10,000 unique consumers while deriving more than 25% of gross revenue from selling personal data (RSA 507-H:2). Usual GLBA, HIPAA, nonprofit and higher-ed exemptions.
- What are the penalties under New Hampshire Privacy Act?
- Violations are unfair or deceptive acts under the Consumer Protection Act (RSA 358-A): civil penalties up to $10,000 per violation (RSA 358-A:4). 60-day cure notice was mandatory Jan 1 to Dec 31, 2025; from Jan 1, 2026 the AG may offer a cure at its discretion (RSA 507-H:11). No private right of action.