New Hampshire (US)
Full entry AI-checked Checked 5 November 2026
Read this together with United States (federal), which also applies.
| Law | Citation | Status | In force from |
|---|---|---|---|
| New Hampshire privacy law (Expectation of Privacy) | RSA ch. 507-H (Laws 2024, ch. 5) | In force | 1 January 2025 |
| Notice of security breach | RSA 359-C:19 to 359-C:21 | In force | 1 January 2007 |
| AI chat services and children (responsive generative communication) | RSA 507:8-k and RSA 639:3, III-a (Laws 2025, ch. 270, HB 143) | In force | 1 January 2026 |
- New Hampshire privacy law (Expectation of Privacy): Laws 2026, ch. 168 (HB 1460, signed on 19 June 2026) bars selling a child’s personal data from 1 January 2027; the online RSA doesn’t show it yet.
- AI chat services and children (responsive generative communication): Signed on 1 August 2025. Creates civil liability and a misdemeanour for AI chat services that knowingly push a child toward listed harms.
Regulators
Section titled “Regulators”What builders must do
Section titled “What builders must do”Who it covers
Section titled “Who it covers”Applies to businesses operating in New Hampshire or targeting its residents that in a year control or process data of 35,000+ unique consumers (excluding payment-only data), or 10,000+ while earning over 25% of revenue from selling data. Non-profits, colleges, government, GLBA financial institutions and HIPAA-regulated bodies are exempt. Employees and B2B contacts aren’t consumers.
Sources: gc.nh.gov/rsa/html/LII/507-H/507-H-2.htm · gc.nh.gov/rsa/html/LII/507-H/507-H-3.htm
Lawful bases
Section titled “Lawful bases”No GDPR-style lawful bases. Controllers give a privacy notice and honour rights to access, correct, delete and port data and to opt out of targeted advertising, sale and solely automated profiling for significant decisions, within 45 days (extendable by 45). Sensitive data needs opt-in consent, which must be as easy to withdraw as to give; processing stops within 15 days of withdrawal.
Sources: gc.nh.gov/rsa/html/LII/507-H/507-H-4.htm · gc.nh.gov/rsa/html/LII/507-H/507-H-6.htm
Consent age for online services
Section titled “Consent age for online services”A child is under 13 (as in COPPA), and a known child’s data must be processed as COPPA requires. Teens aged 13 to 15 must opt in before their data is sold or used for targeted advertising, where the controller has actual knowledge of their age and wilfully disregards it.
Sources: gc.nh.gov/rsa/html/LII/507-H/507-H-1.htm · gc.nh.gov/rsa/html/LII/507-H/507-H-6.htm
Children
Section titled “Children”Data from a known child (under 13, as in COPPA) is sensitive data and needs COPPA-compliant handling. From 1 January 2027, Laws 2026, ch. 168 bars selling a child’s personal data. Since 1 January 2026, an AI chat service whose sole purpose is open-ended generative conversation is liable if it knowingly sends a child messages meant to get them to imminently engage in sexual conduct, illegal drug or alcohol use, self-harm or violence. We found no New Hampshire age-appropriate design law.
Sources: gc.nh.gov/rsa/html/LII/507-H/507-H-6.htm · gc.nh.gov/rsa/html/LII/507-H/507-H-1.htm · gc.nh.gov/bill_status/billinfo.aspx · gc.nh.gov/rsa/html/LII/507/507-8-k.htm · gc.nh.gov/rsa/html/LXII/639/639-3.htm
Cookies and similar technologies
Section titled “Cookies and similar technologies”No cookie-consent rule. Controllers must offer a clear opt-out link for targeted advertising and sale, and since 1 January 2025 must honour opt-out preference signals such as Global Privacy Control. A signal that conflicts with a loyalty programme or existing setting must still be honoured, though the controller may ask the consumer to confirm.
Sources: gc.nh.gov/rsa/html/LII/507-H/507-H-6.htm
Electronic marketing
Section titled “Electronic marketing”Anyone using an automatic dialling system to solicit must register with the Department of Justice’s Consumer Protection and Antitrust Bureau at least 10 business days before. Telemarketers must not call numbers on the do-not-call registry, must say at once who is calling and why, and must not block caller ID. Violations can cost $5,000 each, and people can sue. Federal CAN-SPAM and the TCPA apply too.
Sources: gc.nh.gov/rsa/html/XXXI/359-E/359-E-mrg.htm
Breach notification
Section titled “Breach notification”After learning of a breach, promptly assess whether the data has been or will be misused. Unless misuse is unlikely, notify affected people as soon as possible, and notify the Attorney General’s office (or your primary regulator) with the expected notice date and the number of New Hampshire residents affected. If more than 1,000 people are notified, also tell the national consumer reporting agencies.
Sources: gc.nh.gov/rsa/html/XXXI/359-C/359-C-20.htm
Registration and fees
Section titled “Registration and fees”The privacy law has no registration or fee, and we found no New Hampshire data broker registry. Users of automatic dialling systems for solicitation register with the Department of Justice and pay a $20 annual fee.
Sources: gc.nh.gov/rsa/html/LII/507-H/507-H-mrg.htm · gc.nh.gov/rsa/html/XXXI/359-E/359-E-mrg.htm
Data protection officer
Section titled “Data protection officer”No duty to appoint a data protection officer.
Sources: gc.nh.gov/rsa/html/LII/507-H/507-H-mrg.htm
International transfers
Section titled “International transfers”New Hampshire law has no cross-border transfer rules (federal rules are in us-federal).
Sources: gc.nh.gov/rsa/html/LII/507-H/507-H-mrg.htm
Impact assessments
Section titled “Impact assessments”Controllers must conduct and document an assessment before targeted advertising, sale, sensitive data processing or risky profiling, for processing activities created after 1 July 2024. The Attorney General can require one in an investigation; it stays confidential.
Sources: gc.nh.gov/rsa/html/LII/507-H/507-H-8.htm
Automated decisions and AI
Section titled “Automated decisions and AI”Consumers can opt out of profiling in furtherance of solely automated decisions with legal or similarly significant effects, and risky profiling needs a documented assessment. Since 1 January 2026, an AI chat service whose sole purpose is open-ended generative conversation faces civil liability and a misdemeanour charge if it knowingly pushes a child toward imminent sexual conduct, drug or alcohol use, self-harm or violence. Cloud and telecom providers, and chatbots built into games, TV or streaming, are excluded.
Sources: gc.nh.gov/rsa/html/LII/507-H/507-H-4.htm · gc.nh.gov/rsa/html/LII/507-H/507-H-8.htm · gc.nh.gov/rsa/html/LII/507/507-8-k.htm · gc.nh.gov/rsa/html/LXII/639/639-3.htm · gc.nh.gov/bill_status/billinfo.aspx
Penalties
Section titled “Penalties”Only the Attorney General enforces. The required 60-day cure notice applied only during 2025; since 2026 a cure is at the AG’s discretion. Violations are unfair or deceptive acts under RSA 358-A, with civil penalties up to $10,000 per violation. The privacy law gives no private right of action. Under the AI chat law, only the AG can sue, after written notice and 90 days to give assurances of a cure, for the child’s damages (at least $1,000 per violation) or an injunction.
Sources: gc.nh.gov/rsa/html/LII/507-H/507-H-11.htm · gc.nh.gov/rsa/html/XXXI/358-A/358-A-mrg.htm · gc.nh.gov/rsa/html/LII/507/507-8-k.htm
History
Section titled “History”| Date | Change |
|---|---|
| 5 November 2026 | First entry. Checked against official sources with AI assistance, then corrected after an independent AI-assisted review. |
Report a change
Section titled “Report a change”If a law, a date or a figure here has changed, open an issue with the official source. The data lives in laws/full/us-nh.yaml.