New Hampshire Consumer Data Privacy Law: Thresholds, Consumer Rights & Deadlines

What New Hampshire’s consumer data privacy law requires, maintained by Stauss PLLC. Last reviewed August 2026.

What You Need to Know

New Hampshire's law largely tracks the Connecticut law as originally passed in 2022, without the 2023 amendments (e.g., adding consumer health data to the definition of sensitive data). The law applies to controllers that process the personal data of 35,000 consumers. In 2026, the law was amended to prohibit the sale of personal data belonging to children under 13.

Official law text

Who the law applies to

Threshold	Requirement
Annual gross revenue	N/A
Consumers whose data is processed	35,000 consumers 2.5% of state's 1.4 million population
Revenue from sale of personal data	Derives more than 25% of gross revenue from sale of personal data and controls or processes personal data of not less than 10,000 consumers.

Consumer rights under New Hampshire's law15

Right	Provided?
Know	Yes
Access	Yes
Obtain list of third parties to which personal data was disclosed	No
Data portability	Yes
Delete	Yes
Correct inaccuracies	Yes
Not be discriminated against for exercising rights	Yes
Opt-out of sale	Yes
Opt-out of targeted advertising/sharing	Yes
Opt-out of certain types of profiling	Yes
Opt-out of ADMT	No
Recognize opt-out signals	Yes
Revoke consent	Yes
Not process data in discriminatory manner	No
Appeal	Yes

Tracking New Hampshire’s privacy law? We write about it as the law changes.

Categories treated as sensitive data10

Racial or ethnic origin
Religious beliefs
Mental or physical health diagnosis
Mental or physical health condition
Sexual orientation
Sex life
Citizenship or immigration status
Genetic or biometric data for purposes of uniquely identifying an individual
Personal data of known child
Precise geolocation
note
Connecticut, Maryland, Oregon, and Virginia ban the sale of precise geolocation data.

How sensitive data must be treated2

Obtain Consent to Process
Conduct Data Protection or Risk Assessment

Requirements for minors' data3

Process personal data of children under 13 in accordance with COPPA or parental/legal guardian consent
Cannot sell personal data of children under 13
note
Some states create additional restrictions on selling of sensitive data generally, which includes the personal data of children under 13. See Treatment of Sensitive Data chart for further information.
Opt-in for selling or sharing of personal data of children ages 13-15

Activities that trigger a risk or impact assessment4

Targeted advertising (“sharing”)
Sale of personal data
Processing of sensitive data
Processing personal data for purposes of profiling where it presents reasonably foreseeable risk of unfair or deceptive treatment of, or unlawful disparate impact on, consumers; financial, physical, or reputational injury to consumers; physical or other intrusion upon the solitude or seclusion, or the private affairs or concerns, of consumers, where such intrusion would be offensive to a reasonable person; other subject injury to consumers

Other notable provisions7

Definition of “Sale” Includes “Other Valuable Consideration”
Data Processing Agreements
Privacy Policy
Implement Reasonable Data Security Measures
Duty to Avoid Secondary Use
Data Minimization
Attorney General Enforcement

Key dates2

Date	What happens
January 1, 2025	New Hampshire's consumer data privacy law takes effect
January 1, 2027	New Hampshire HB 1460 (2026) amendments take effect

Questions about New Hampshire’s privacy law?

Stauss PLLC advises companies on state privacy, AI, and data broker compliance.

Contact Stauss PLLC

Follow New Hampshire’s privacy law

Our analysis, by email, as the law moves.

This page is provided for general informational purposes only, is not legal advice, and does not create an attorney-client relationship. State laws change frequently; coverage reflects this tool’s most recent update. Contact Stauss PLLC to confirm how these requirements apply to your organization.