New Hampshire
New Hampshire Privacy Act
New Hampshire’s consumer privacy law. It gives New Hampshire residents rights over their personal data and sets rules for businesses that meet its size limits.
- Status
- In effect since January 1, 2025
- Citation
- N.H. Rev. Stat. ch. 507-H
- Official text
- Read the law(opens in a new tab)
Who it covers
Businesses that handle data of 35,000+ New Hampshire residents a year, or 10,000+ if they earn revenue from selling data.
What it asks of your website
- A privacy notice explaining what you collect, why, who you share it with and how people use their rights.
- Let people access, delete and correct their data, and opt out of targeted ads and the sale of their data.
- Honor Global Privacy Control as an opt-out (from Jan 1, 2025).
- Get opt-in consent before using sensitive data (health, precise location, children’s data and more).
- Offer an appeal when you turn down a privacy request.
- Don’t sell a child’s personal data (from Jan 1, 2027).
Who has to comply
New Hampshire’s privacy law (RSA 507-H) took effect on January 1, 2025. It applies to businesses that handle the personal data of 35,000 or more unique New Hampshire consumers in a year (not counting payment-only data), or 10,000 or more while getting over 25% of gross revenue from selling personal data.
Nonprofits are exempt, as are state bodies, colleges, Gramm-Leach-Bliley financial institutions and HIPAA covered entities.
Visitors’ rights and your deadlines
- Rights to confirm and access, correct, delete, get a portable copy, and opt out of targeted advertising, sale and certain profiling.
- Respond within 45 days, extendable by 45 more when reasonably necessary. Free once every 12 months.
- Appeals: answer in writing within 60 days; a denial must say how to complain to the Attorney General.
Global Privacy Control since January 1, 2025
Since January 1, 2025, businesses must let consumers opt out of targeted advertising and sale through an opt-out preference signal such as Global Privacy Control. The signal can’t be a default setting. If it conflicts with a setting on your site, follow the signal; you may ask the consumer to confirm.
Sensitive data, teens and children
Sensitive data needs consent, and if consent is withdrawn, processing must stop within 15 days. For consumers you know, or willfully disregard, are 13 to 15, you need consent before targeted advertising or sale.
A 2026 law (HB 1460, signed June 19, 2026) bans selling a child’s personal data from January 1, 2027.
Your privacy notice
Give a clear and meaningful privacy notice in a reasonably accessible format. It must cover the categories of data and why you process them, how to use and appeal rights, what you share with third parties, a way to contact you, and the date it was last updated. Sales and targeted advertising must be disclosed clearly and conspicuously.
Enforcement
The Attorney General has exclusive authority, through a Data Privacy Unit created in 2024; there’s no private right of action. Through 2025 the Attorney General had to give notice and 60 days to cure; since January 1, 2026 that is discretionary. A violation is an unfair or deceptive practice under the Consumer Protection Act, with civil penalties of up to $10,000 per violation.
Where GoConsent helps
Privacy Policy builder
A Privacy Policy with a Notice at Collection, written from your settings and your latest scan, drafted to cover the points privacy laws describe. Review it with your lawyer.
Opt-outs and requests
Your Privacy Choices with a Marketing switch, “Opt out using your email”, and a Requests tab with deadlines and reminders.
Copy and delete requests (Pro)
Visitors ask for a copy of their information or for it to be deleted from Your Privacy Choices, with a 45-day deadline, a checklist and reminders.
Global Privacy Control
On by default. Honored as an opt-out, shown to the visitor, and logged with the consent record.
Children’s Privacy Policy (Pro)
A children’s privacy notice page for sites that may collect information from children under 13.
A plain-English summary, last reviewed October 25, 2026. It isn’t legal advice, and some duties depend on how your business handles data, such as security programs and answering access requests. Read the official text and talk to a lawyer about your situation.
FAQ
Questions, answered
Does New Hampshire require honoring Global Privacy Control?
Yes, since January 1, 2025.
Are nonprofits covered in New Hampshire?
No. Nonprofit organizations are exempt.
What changes in 2027?
From January 1, 2027, selling a child’s personal data is banned.
Check your site against this law
GoConsent scans your site, tells you which laws likely apply and what to fix. Free, with no visit limits.
