Cookies operate in silence.

This page covers one piece of the picture. For the full scope of the NHDPA — who must comply, the thresholds, the consumer rights and the penalties — start with our complete guide to the NHDPA and cookies.

You install an advertising pixel, set up Google Analytics, add a support chat widget. Each of these tools places something on the visitor's device and starts collecting data, usually before any question is asked.

The New Hampshire Data Privacy Act (NHDPA, RSA 507-H), in effect since January 1, 2025, broke that silence for good.

This article focuses exclusively on what the NHDPA requires from a Cookies Policy: what the document must contain, how tracker consent must work, what is prohibited, and what the law says specifically about each point.

The cookie banner is what the visitor sees when they first access the site. It is the visual interface for consent, where the user chooses what they accept. It must be clear, offer real options, and block non-consented trackers before they fire.

The Cookies Policy is the detailed document. It is where the user finds complete information about every technology operating on the site.

Both need to exist. Both need to be aligned. And the Policy must be accessible through a simple link within the consent notice itself.

RSA 507-H:6, I, b prohibits processing data for purposes incompatible with those disclosed to the consumer, unless new consent is obtained. And RSA 507-H:6, III, b requires the purpose of processing to be included in the privacy notice.

For cookies, this translates into specific descriptions for each category. Writing "we use cookies to improve your experience" does not work. It is not a purpose. It is a phrase that offers the business no protection whatsoever.

What works:

"Analytics cookies: collect browsing behavior data, including pages visited and traffic source. Used to identify opportunities to improve site content and experience."

"Advertising cookies: collect behavioral data across different websites to build interest profiles and display personalized ads. Includes pixels from platforms such as Meta Ads and Google Ads."

The Policy must list the categories of trackers operating on the site. The main ones:

Necessary cookies: essential for basic functionality. Authentication, session security. These do not require consent but must be documented.

Analytics cookies: measure browsing behavior. Google Analytics, Hotjar, and similar tools. These require consent because they collect data that may identify the user through cross-referencing.

Advertising cookies: feed ad pixels, build behavioral profiles, enable remarketing. These always require explicit consent.

Functional cookies: remember user preferences. May or may not require consent depending on the nature of the data.

Third-party cookies: fired by external services integrated into the site. Correct tag categorization is what makes it possible to document each one accurately.

RSA 507-H:6, III, d and e require the Policy to disclose the categories of data shared with third parties and the categories of third parties that receive them.

If the site has a Meta Pixel, data goes to Meta. If it uses Google Analytics, to Google. If it uses HubSpot, to HubSpot. Each data flow must be categorized and declared.

RSA 507-H:6, IV goes further: if the business sells data or processes it for targeted advertising, this practice must be clearly and conspicuously disclosed, along with the opt-out mechanism.

The minimization principle in RSA 507-H:6, I, a requires that collection be limited to what is adequate, relevant, and reasonably necessary for the stated purposes.

For cookies, this translates into the need to disclose how long data is stored, both on the user's device and in the company's systems.

The NHDPA guarantees consumers the right to opt out of the processing of their data for targeted advertising, under RSA 507-H:4, I, e.

RSA 507-H:6, V, a, 1 specifically requires a clear and conspicuous link on the site directing consumers to a page where they can exercise this opt-out.

If the site uses a Meta Pixel, Google Ads, TikTok Pixel, or any programmatic advertising tool, it is operating targeted advertising. The Policy must state this and the opt-out must actually work.

A well-configured consent management platform ensures that when the user exercises the opt-out, the corresponding trackers immediately stop firing.

RSA 507-H:6, V, a, 1, B requires businesses to honor opt-out preference signals sent by platforms, technologies, or mechanisms indicating the consumer's intent to opt out of processing.

But there is an important nuance directly in the text of the law: the signal must "require the consumer to make an affirmative, freely given, and unambiguous choice to opt-out." The GPC is only valid when the consumer configured it actively and deliberately, not as an automatic default setting of the device or browser.

The Cookies Policy must state that the site respects the GPC when actively configured by the user, not as an automatic default. And the cookie notice operation must be configured to detect and honor that signal correctly.

RSA 507-H:6, I, f is direct: after consent is revoked, the business must cease processing "as soon as practicable, but not later than 15 days after the receipt of such request."

This has a direct operational impact. When a user revokes consent for advertising or analytics cookies, marketing and tracking systems must be updated within 15 days.

A CMP integrated with the company's systems automates a large part of this process.

RSA 507-H:1, VII defines consent as a clear affirmative act signifying a consumer's freely given, specific, informed, and unambiguous agreement.

What is not valid consent:

Accepting general terms that contain data processing descriptions alongside other information.

Hovering over, muting, pausing, or closing a piece of content.

Any agreement obtained through dark patterns.

The correct standard: necessary cookies on, all others off by default. The user chooses what to enable, not what to disable.

Dark patterns are defined in RSA 507-H:1, XII as interfaces designed with the substantial effect of subverting or impairing the autonomy, decision-making, or choice of the user.

In the context of cookies, common examples include:

An "accept all" button in a prominent position, with the reject button hidden or low-contrast.

Non-essential cookies enabled by default, requiring the user to go through multiple clicks to disable them.

Confusing language in the choice options.

Cookie walls: blocking access to content until all cookies are accepted.

Consent pop-ups that reappear until the user accepts.

Any of these patterns invalidates consent obtained under the NHDPA.

The answer is: in most cases, yes.

The NHDPA defines personal data as any information linked or reasonably linkable to an individual. Analytics cookies from major platforms collect data that, when cross-referenced with other information, can identify a specific user.

The ANPD Cookie Guidance already flagged this point in Brazil: major providers have the ability to cross-reference seemingly anonymous identifiers with other data they possess.

The safest approach: treat analytics cookies as non-necessary in the banner, block them before acceptance, and document this in the Cookies Policy.

RSA 507-H:6, I, g prohibits using cookies for targeted advertising and selling data without consent when the controller knows the consumer is between 13 and 15 years old.

If your site may have teenage users, the Cookies Policy must mention this protection and explain how it is implemented operationally.

Whenever the site begins using a new tool that fires cookies. RSA 507-H:6, III, g requires the date of last update to be clearly visible in the document.

Situations that require an update:

Adding a new advertising pixel.

A new analytics tool.

A new chat or support plugin.

A new CRM or email platform integration.

Any new partner that receives behavioral data.

Data mapping is what keeps this in sync. When the inventory of tools on the site changes, the Cookies Policy must change with it.

In 2025, there was a guaranteed 60-day cure period before litigation. From 2026 onward, the cure period is discretionary (RSA 507-H:11, III). An inadequate Cookies Policy may result in direct action with no guaranteed time to correct.

Violations are treated under RSA 358-A:2, with reference penalties of up to US$ 10,000 per violation.

AdOpt's automatic scan identifies all technologies active on the site, feeding the list of categories that must appear in the Policy.

The cookie notice configured through AdOpt blocks non-necessary trackers before acceptance, presents categories with clear descriptions, offers real choice options, respects the GPC when actively configured by the user, and logs every interaction for auditing purposes.

The integration with the company's systems helps process revocations within the 15-day deadline required by law.

Over 60,000 websites already run with AdOpt.

Privacy is not a banner. It is a position.

Want to build a Cookies Policy for your site that complies with the NHDPA? Talk to our team.

Visible link in the footer and within the cookie banner itself.

Listing of cookie categories with a description of what each one does.

Specific purpose for each category, without vague descriptions.

Categories of data shared with third parties and categories of partners that receive them (RSA 507-H:6, III, d and e).

Retention period for each category.

Disclosure of targeted advertising with an opt-out mechanism accessible via a conspicuous link (RSA 507-H:6, IV and V, a, 1).

GPC honored when actively configured by the user, with the nuance of affirmative choice (RSA 507-H:6, V, a, 1, B).

15-day deadline to cease processing after revocation (RSA 507-H:6, I, f).

Non-necessary cookies disabled by default in the banner, without dark patterns (RSA 507-H:1, XII).

Protection for teenagers between 13 and 15 years old (RSA 507-H:6, I, g).

Date of last update visible in the document (RSA 507-H:6, III, g).

No cookie walls.

Accessible language, without legal jargon.

1. Does the NHDPA require a document specifically called a "Cookies Policy"?
Not by name. But RSA 507-H:6, III, IV, and V require the privacy notice to cover cookie-based collection practices with specific purposes, information about sharing with third parties, a targeted advertising opt-out mechanism, and an update date. A dedicated Cookies Policy is the clearest way to organize this information.

2. Does the 15-day deadline apply to any consent revocation?
Yes. RSA 507-H:6, I, f states that after receiving a revocation request, the business must cease processing as soon as practicable, no later than 15 days. This applies to any consent revocation, including the opt-out of non-essential cookies.

3. Does the GPC need to be automatically honored by the site?
RSA 507-H:6, V, a, 1, B requires respect for the opt-out preference signal, but with the condition that it represents an affirmative and free choice by the consumer, not an automatic default setting. The site must be configured to detect and honor the GPC when the user has activated it deliberately.

4. Do analytics cookies require consent under the NHDPA?
In most cases, yes. Analytics cookies from major platforms collect data that may identify users through cross-referencing, falling within the definition of personal data in RSA 507-H:1, XIX. Tools with genuine anonymization and no individual identification capability may be an exception.

5. What changed in NHDPA enforcement from 2026?
In 2025, RSA 507-H:11, II guaranteed 60 days to cure before litigation. From 2026, RSA 507-H:11, III made the cure period discretionary. The Attorney General may or may not grant it, considering factors such as the number of violations, company size, and probability of harm to the public.

With AdOpt, you're covered.

Ready to bring your Cookies Policy into compliance with the NHDPA? Talk to our team.