New Hampshire's Privacy Act, RSA 507-H: Low Thresholds, Teen Consent and a Discretionary Cure

The Chapter and Its Amendments

New Hampshire placed its comprehensive privacy statute in Title LII, Actions, Process, and Service of Process, as RSA chapter 507-H, "Expectation of Privacy." The source notes on the General Court's codified text credit 2024 Laws chapter 5 with creating each section effective January 1, 2025, and 2024 Laws chapter 229 with amendments to the definitions, application, rights and controller-duty sections, effective "Jan. 1, 2025 at 12:01 a.m." A third act, 2026 Laws chapter 168, amends RSA 507-H:6 effective January 1, 2027. Everything below was read from the codified chapter.

Thresholds Under RSA 507-H

RSA 507-H:2, I covers persons conducting business in New Hampshire or producing products or services targeted to its residents that, "during a one year period," controlled or processed the personal data of at least 35,000 unique consumers, or of at least 10,000 unique consumers while deriving "more than 25 percent of their gross revenue from the sale of personal data." Data handled "solely for the purpose of completing a payment transaction" does not count toward the 35,000 figure. The chapter does not define "one year period" further.

The consumer definition in RSA 507-H:1, VIII is drafted differently from the individual-or-household formula used in Iowa or Kentucky. It covers any New Hampshire resident, then excludes people acting in a commercial or employment context or "as an employee, owner, director, officer or contractor" of a company, nonprofit or government agency whose dealings with the controller occur solely in that role. A sale includes "monetary or other valuable consideration."

RSA 507-H:3, I excludes government bodies, nonprofits exempt under sections 501(c)(3), (4), (6) or (12), institutions of higher education, financial institutions and Gramm-Leach-Bliley data, HIPAA covered entities and business associates, and "national securities association[s]" registered under the Securities Exchange Act. Paragraph II lists eighteen data exemptions, among them air-carrier data to the extent the Airline Deregulation Act preempts the chapter, listed-chemical compliance records, and HIPAA limited data sets.

Consumer Rights and Universal Opt-Out Signals

RSA 507-H:4, I grants access, correction, deletion of data "provided by, or obtained about" the consumer, a portable copy of data "processed by the controller," and opt-outs of targeted advertising, sale, and profiling "in furtherance of solely automated decisions" with legal or similarly significant effects. Paragraph II lets a guardian or conservator act for a consumer under a protective arrangement, in addition to a parent acting for a known child. Paragraph II's reference to authorized agents points to "RSA 507-H:4, III(e)," a subparagraph dealing with deletion of third-party-sourced data; the opt-out rights themselves are in paragraph I(e).

Under paragraph III, responses are due within 45 days, extendable by 45, and are free "once per consumer during any twelve-month period," rather than twice. A controller "shall not be required to authenticate an opt-out request," but may deny one on "a good faith, reasonable and documented belief" that it is fraudulent, and must then tell the requester why. Appeals are decided within 60 days.

The signal requirement sits in RSA 507-H:6, V(a)(1)(B). Not later than January 1, 2025, controllers had to allow opt-outs of targeted advertising and sale "through an opt-out preference signal sent, with such consumer's consent, by a platform, technology, or mechanism." The mechanism must not use a default setting, must be consumer-friendly, must be as consistent as possible with similar mechanisms required elsewhere, and must let the controller determine residency and legitimacy. Under paragraph (2), when a signal conflicts with a controller-specific privacy setting or loyalty-program participation, the controller "shall comply with such consumer's opt-out preference signal" but may notify the consumer and offer a choice to confirm. RSA 507-H:5 separately allows authorized agents, including browser settings and global device settings.

The privacy notice under RSA 507-H:6, III must be reasonably accessible to consumers with disabilities and must include "an active electronic mail address or other online mechanism" for contacting the controller and "the date the privacy notice was last updated."

Sensitive Data, Teens and Children

Sensitive data under RSA 507-H:1, XXVIII includes a "mental or physical health condition or diagnosis" and "sex life," two items absent from the Kentucky and Iowa lists, along with the usual categories. RSA 507-H:6, I(d) bars processing it without consent, and paragraph I(f) requires a revocation mechanism "at least as easy" as the one used to give consent, with processing ending within 15 days of a revocation.

Two age-based rules go further. Paragraph I(g) bars targeted advertising or sale without consent "under circumstances where a controller has actual knowledge, and wilfully disregards, that the consumer is at least 13 years of age but younger than 16 years of age." And the codified page shows a new paragraph I(e-1), bracketed as "effective January 1, 2027" and credited to 2026 Laws chapter 168: a controller shall "[n]ot sell a child's personal data." Child carries COPPA's meaning under RSA 507-H:1, VI. The new paragraph contains no consent exception.

RSA 507-H:12 addresses overlap with other privacy laws. Where a direct conflict prevents compliance with both, the entity follows the statute giving "the greater measure of privacy protection," and an opt-in procedure is deemed more protective than the chapter's opt-out procedure.

Data Protection Assessments

RSA 507-H:8 is titled "Heightened Risk of Harm." It requires a documented assessment for each processing activity presenting such a risk and defines the category to include targeted advertising, sale, risky profiling and sensitive data. The usual benefit-and-risk weighing applies. The Attorney General "may require" disclosure of a relevant assessment, which stays confidential under RSA 91-A without waiving privilege. Paragraph VI limits the duty to processing activities "created or generated after July 1, 2024," six months before the chapter took effect.

Processors carry part of the load. RSA 507-H:7, I(c) requires them to provide information the controller needs for assessments, and paragraph II(e) requires contracts allowing controller assessments of the processor or, alternatively, an assessment by "a qualified and independent assessor" using an accepted control framework, with a report on request.

Attorney General Enforcement, and No Rulemaking Provision

The outline paired enforcement with rulemaking. The chapter contains no rulemaking grant to the Attorney General or any agency; the only administrative duty it assigns is in RSA 507-H:2, II, directing the Secretary of State to "notice and post a link to RSA 507-H" on the office's website. The heading is rewritten accordingly.

RSA 507-H:11 gives the Attorney General exclusive authority. From January 1 through December 31, 2025, the office "shall" issue a notice of violation before suing where a cure is possible, with 60 days to cure; after that period it "may." Paragraph III lists six factors for deciding whether to offer a cure from January 1, 2026: the number of violations, the size and complexity of the business, the nature and extent of its processing, the likelihood of injury to the public, the safety of persons or property, and whether the violation likely stemmed from human or technical error.

Paragraph V makes a violation an unfair or deceptive practice under RSA 358-A:2. Under RSA 358-A:4, III(b), a court may award civil penalties "up to $10,000 for each violation," counting unlawful acts "without regard to the number of persons affected," and a good-faith misunderstanding of the requirements is an affirmative defense to penalties. RSA 507-H:11, IV rules out a private right of action under the chapter "or any other law."

The New Hampshire Department of Justice website returned an HTTP 403 access error to every request made for this post on October 26, 2026, as it did during the August state-page research, so the office's releases could not be read. No enforcement action under RSA 507-H was located through other sources, and the record here is zero. That figure reflects an unreachable source, not a confirmed absence.

Frequently Asked Questions