New Hampshire Privacy Act (SB 255): What It Requires

Executive Summary

The New Hampshire Privacy Act (effective January 1, 2025) applies to businesses processing personal data of 35,000+ unique New Hampshire consumers annually (excluding payment-only data), or 10,000+ with over 25% of revenue from selling personal data.
It is a close Connecticut copy: access, correction, deletion, portability, and opt-outs of targeted advertising, sale, and significant-decision profiling, with opt-in consent for sensitive data.
Universal opt-out signal recognition (GPC in practice) has been mandatory since January 1, 2025, the law launched with the mandate rather than phasing it in.
Known minors aged 13-15 get consent gates for targeted advertising and sale; the AG's model follows Connecticut's teen provisions.
Enforcement is exclusive to the DOJ under the Consumer Protection Act (penalties up to $10,000 per violation); a 60-day cure right applied through December 31, 2025, then became discretionary.

New Hampshire’s privacy law is deliberately unoriginal, a Connecticut clone passed so New England businesses face one standard rather than three, and that is precisely its compliance meaning: no new machinery, but one more low-threshold state pulling mid-size national businesses into the strict-tier framework as of January 2025. The 35,000-consumer bar and launch-day GPC mandate do the real work.

Law	New Hampshire Privacy Act, RSA ch. 507-H
Effective	January 1, 2025 (GPC mandate from launch)
Thresholds	35,000 consumers, or 10,000 + 25% sale revenue
Max penalty	$10,000 per violation (RSA 358-A)
Regulator	NH DOJ
Statute	RSA ch. 507-H

Folding New Hampshire in

Scope by data, not office locations. The unique-consumer count excludes payment-only processing but includes analytics, accounts, and marketing lists. National e-commerce and media operations should assume coverage and verify, not the reverse.

Reuse the Connecticut build. Sensitive-data consent, DSARs with appeal flows, processor contracts, data protection assessments, and GPC handling transfer without modification from a CTDPA program. Update your applicability register, notices (list New Hampshire in rights disclosures), and DSAR routing.

Watch the teen-privacy trajectory. The 13-15 consent gate is today’s floor; Connecticut’s amendments and the regional legislative pattern suggest duty-of-care expansion. Keep New Hampshire in the children’s privacy matrix review cycle.

January 2025 cohort planning. New Hampshire arrived alongside Delaware, New Jersey, Iowa, and Nebraska; the sane response is a single national baseline at the strict-tier spec, as laid out in the multi-state strategy guide and state comparison.

Confirm your notices, opt-outs, and tracker behavior in one pass with a free scan.

Frequently Asked Questions

Who is covered by RSA 507-H?

Persons conducting business in New Hampshire or targeting its residents that, during a one-year period, controlled or processed personal data of at least 35,000 unique consumers (excluding data processed solely for completing payment transactions), or at least 10,000 unique consumers while deriving more than 25% of gross revenue from selling personal data. With a population of 1.4 million, the 35,000 bar is reachable for any national consumer business; standard entity exemptions (GLBA, HIPAA covered entities, nonprofits, higher ed) apply.

How close is it to Connecticut's law really?

Structurally near-identical: same rights architecture, same sensitive-data consent duty, same 45-day response clock with appeals, same assessment triggers, and the same UOOM mandate. Differences are at the margins, New Hampshire's secretary-of-state rulemaking on notice standards, slightly different exemption drafting, and its own enforcement channel. A CTDPA-compliant program needs only threshold re-scoping to absorb New Hampshire.

What does sensitive data include?

Racial or ethnic origin, religious beliefs, mental or physical health condition or diagnosis, sex life or sexual orientation, citizenship or immigration status, genetic or biometric data for unique identification, known-child data, and precise geolocation (1,750 feet). Processing requires prior opt-in consent by clear affirmative act, with inferred sensitive attributes treated the same as declared ones.

What are the obligations toward minors?

For consumers the controller knows are aged 13 to 15, targeted advertising and sale require consent; under 13, COPPA parental-consent rules govern. New Hampshire has not (yet) matched Connecticut's broader duty-of-care amendments, but the New England trend line, Connecticut, then Vermont's and Maine's proposals, points toward expansion; teen-facing services should track each session.

What is the enforcement posture?

The AG's Consumer Protection and Antitrust Bureau enforces exclusively (no private right of action), with violations actionable under RSA 358-A carrying civil penalties up to $10,000 per violation plus injunctive relief. The statutory 60-day cure right ran through the end of 2025 and is now discretionary, weighing violation severity and history. New Hampshire is a probable participant in coordinated multistate sweeps rather than a solo enforcer.

Regulatory Crosswalk

Connecticut CTDPADelaware DPDPAVirginia VCDPA

Organizations subject to this regulation often operate under these overlapping frameworks. BD Emerson maps controls across frameworks to reduce duplicated compliance effort.

Evaluate your compliance posture now

BD Emerson's automated scanner audits your public-facing properties against your applicable regulations in minutes, not weeks.

Run Free Scan Speak to an Expert