One more US state has entered the data privacy map.

The New Hampshire Data Privacy Act (NHDPA), codified under RSA 507-H, came into effect on January 1, 2025. It guarantees rights for consumers in the state and creates clear obligations for businesses that process the personal data of those individuals.

If your website serves users from New Hampshire, this guide is for you.

The New Hampshire Data Privacy Act (RSA 507-H) is New Hampshire's state-level personal data protection law. It follows the same logic as the major modern privacy regulations: giving people back control over the data companies collect about them.

If you are already familiar with the LGPD, the GDPR, or the CCPA, the NHDPA framework will feel familiar. The differences are in the details, and some of those details matter quite a bit.

Enforcement falls under the Data Privacy Unit within the Consumer Protection and Antitrust Bureau of the New Hampshire Department of Justice. The state's Attorney General holds exclusive authority to enforce the law.

On January 1, 2025.

There is no grace period. There are no friendly warnings from regulators. Any business that meets the criteria should already be in compliance.

Under RSA 507-H:2, the law applies to persons that conduct business in New Hampshire or produce products or services targeted to state residents and that, during a calendar year:

Control or process personal data of at least 35,000 unique consumers, excluding data processed solely to complete a payment transaction, or

Control or process personal data of at least 10,000 unique consumers and derive more than 25% of gross revenue from the sale of personal data.

The law does not focus on where the business is headquartered. It focuses on who the users are. If you have traffic from New Hampshire and process data from those people at scale, the law may reach you.

Understanding the difference between controller and processor is the first step in defining which role your business plays and what your responsibilities are.

Under RSA 507-H:3, the following are exempt:

State and local government bodies and their subdivisions.

Nonprofit organizations.

Higher education institutions.

Financial institutions regulated by the Gramm-Leach-Bliley Act.

Entities regulated by HIPAA.

National securities associations registered with the SEC.

Under RSA 507-H:1, XIX, personal data is any information linked or reasonably linkable to an identified or identifiable individual. This includes name, email, IP address, browsing history, location data, device identifiers, and any information that allows a person to be tracked.

De-identified data and publicly available information are excluded.

A well-executed data mapping exercise reveals where this data is being generated and processed in your digital environment.

Under RSA 507-H:1, XXVIII, sensitive data includes:

Data revealing racial or ethnic origin, religious beliefs, mental or physical health condition or diagnosis, sex life, sexual orientation, citizenship or immigration status.

Genetic or biometric data processed to identify an individual.

Personal data collected from known children (under 13 as defined by COPPA).

Precise geolocation data (within a radius of 1,750 feet).

Sensitive data cannot be processed without the consumer's explicit prior consent, as required by RSA 507-H:6, I, d.

The NHDPA goes beyond protections for children under 13. RSA 507-H:6, I, g expressly prohibits controllers from processing data of consumers for targeted advertising or data sale purposes without consent when the controller has actual knowledge and deliberately ignores that the consumer is between 13 and 15 years old.

This additional protection for teenagers is a distinguishing feature of the NHDPA compared to other US state laws.

Under RSA 507-H:4, the law guarantees residents of New Hampshire the following rights:

Right to access and confirmation: knowing whether the business processes their data and obtaining a readable copy.

Right to correction: correcting inaccuracies in personal data.

Right to deletion: requesting the deletion of data they provided or that was collected about them.

Right to portability: obtaining data in a portable, usable format, when processing is carried out by automated means.

Right to opt-out: refusing processing for targeted advertising, personal data sale, and profiling with legal or similarly significant effects.

Right to appeal: challenging any request denied by the controller.

The controller has 45 days to respond. The deadline can be extended by another 45 days in complex cases, as long as the consumer is notified within the initial timeframe (RSA 507-H:4, III, a).

Service is free once per year per consumer. For requests that are manifestly unfounded, excessive, or repetitive, the business may charge a reasonable fee or refuse, but the burden of proving the excessive nature of the request lies with the business (RSA 507-H:4, III, c).

Under RSA 507-H:1, VII, consent is a clear affirmative act signifying a consumer's freely given, specific, informed, and unambiguous agreement.

What is not valid consent: accepting general terms of use that contain data processing descriptions alongside unrelated information, hovering over or closing a piece of content, and any agreement obtained through dark patterns.

Dark patterns, defined in RSA 507-H:1, XII, are interfaces designed with the substantial effect of subverting or impairing the autonomy, decision-making, or choice of the user.

A specific and important point of the NHDPA is in RSA 507-H:6, I, f: after a consumer revokes consent, the business must cease processing the data as soon as practicable, but no later than 15 days after receiving the request.

This is a shorter deadline than the DSAR response period and directly impacts how marketing and tracking systems are configured.

Under RSA 507-H:6, the controller must:

Limit data collection to what is adequate, relevant, and reasonably necessary for the stated purposes.

Not process data for purposes incompatible with those disclosed, except with consent.

Implement reasonable technical, administrative, and physical security practices proportionate to the volume and nature of the data.

Not process sensitive data without prior consent.

Not discriminate against consumers who exercise their rights.

Offer a consent revocation mechanism that is as easy to use as the consent mechanism itself.

Provide a clear and meaningful privacy notice covering all elements required by law.

Conduct Data Protection Assessments for high-risk activities.

A Records of Processing Activities (ROPA) document that is kept up to date records all of these activities and serves as evidence of compliance in the event of an investigation.

Cookies that collect personal data or allow user identification fall directly within the scope of the NHDPA.

Before firing any non-essential cookie, the website must display a clear cookie notice, obtain affirmative consent, block trackers until acceptance, and offer real opt-out options without dark patterns.

Correct tag categorization is what makes it possible to identify which cookies are necessary and which require consent.

The law also requires respect for the opt-out preference signal, such as the Global Privacy Control (GPC), under RSA 507-H:6, V, a, 1, B. But with an important nuance: the signal is only valid when the consumer configured it in an affirmative and voluntary manner, not as an automatic device default.

Under RSA 507-H:11, the Attorney General holds exclusive authority to enforce the NHDPA. There is no private right of action.

In 2025 (RSA 507-H:11, II): the Attorney General was required to issue a notice of violation and give the controller 60 days to cure before filing a lawsuit.

From 2026 onward (RSA 507-H:11, III): the cure period became discretionary. The Attorney General may or may not grant the cure period, considering factors such as the number of violations, the size and complexity of the business, the nature of the processing, the risk to the population, and whether the violation was caused by human or technical error. There is no longer an automatic right to an opportunity to correct.

Violations are treated as unfair trade practices under RSA 358-A:2 (New Hampshire Consumer Protection Act), which provides for significant civil penalties. The market reference value is up to US$ 10,000 per violation.

Understand what you collect, where it lives, how it is used, and with whom it is shared. Data mapping is the foundation of everything.

The document must cover all requirements of RSA 507-H:6, III, with the date of the last update clearly visible.

A cookie banner that blocks, records, respects the GPC as an affirmative choice, and offers real control options.

At least one secure and reliable mechanism to receive requests. No requirement for the consumer to create a new account.

Ensure your systems can cease processing within 15 days of a consent revocation.

ROPA, data protection assessments, processor agreements. This documentation is your defense.

Applying privacy by design from the conception of products is what makes compliance sustainable.

AdOpt records every consent interaction, blocks trackers before acceptance, automatically respects the GPC when configured by the user, and generates the auditable log you would need to present in an investigation.

The automatic scan identifies all active trackers on the site, feeding the data inventory. And when the law changes, the platform updates automatically.

Over 60,000 websites already run with AdOpt.

Privacy is not a banner. It is a position.

Ready to bring your website into compliance with the NHDPA? Talk to our team.

To understand how these privacy laws compare in terms of structure, our comparative guide goes deeper on the subject.

Compliance with the NHDPA rests on three documents that have to agree with each other: the cookies policy, which declares every tracker and its purpose; the privacy policy, which explains what you do with the data; and the privacy portal, where the consumer exercises their rights and you keep the record of it.

1. What is the NHDPA and when did it come into effect?
The New Hampshire Data Privacy Act (RSA 507-H) is New Hampshire's state-level data protection law. It came into effect on January 1, 2025. It guarantees rights to consumers in the state and imposes compliance obligations on businesses that process the personal data of those individuals.

2. Who needs to comply with the NHDPA?
Businesses that conduct operations in New Hampshire or target products and services to its residents, and that process data from at least 35,000 unique consumers per year, or from at least 10,000 consumers while deriving more than 25% of revenue from the sale of personal data (RSA 507-H:2).

3. What is the penalty for non-compliance?
Violations are treated as unfair trade practices under RSA 358-A:2. The reference value is up to US$ 10,000 per violation. In 2025, there was a guaranteed 60-day cure period. From 2026 onward, the cure period is discretionary and may not be granted (RSA 507-H:11).

4. How long does a business have to respond to a consumer request?
45 days from the receipt of an authenticated request. The deadline can be extended by another 45 days in complex cases, with notification within the initial period. For appeals, 60 days. Free once per year per consumer (RSA 507-H:4, III).

5. What is the deadline to cease processing after consent is revoked?
15 days from the receipt of the revocation request, under RSA 507-H:6, I, f. This deadline is separate from the DSAR response period and must be factored into the configuration of marketing and tracking systems.

Want to bring your website into compliance with the NHDPA? Talk to our team.