New Hampshire - 14th US State With A Consumer Privacy Law

On March 6, 2024, New Hampshire Governor Chris Sununu signed SB 255, New Hampshire’s consumer privacy law, making the state the 14th US state to adopt a comprehensive privacy law.

Effective as of January 1, 2025, New Hampshire’s privacy law sets lower thresholds for applicability compared to other US states, offers a 60 day cure period for violations, which will be discretionary as of January 1, 2026, and provides no private action rights or detailed penalties, emphasizing the need for businesses to update privacy compliance strategies.

In the official press release, Governor Sununu stated the following: 

New Hampshire is living up to our motto as the Live Free or Die State by ensuring that Granite Staters have control over their personal information [...].This law provides transparency about what information is collected, why, and confidence that in the age of AI, steps are taken to protect that data.

Short summary of New Hampshire’s consumer privacy law

• Effective Date: January 1, 2025
• Applicability: Applies to entities conducting business in New Hampshire or producing products/services for state residents, controlling/processing the personal data of 35,000 unique consumers, or controlling/processing data of 10,000 consumers with over 25% of gross revenue derived from selling personal data
• Controller Obligations:
  • Limit personal data collection to what is necessary
  • Not process personal data beyond disclosed purposes without consent
  • Maintain data security practices
  • Obtain consent for processing sensitive data
  • Not process data for discrimination or targeted advertising without consent
  • Provide a method for consumers to revoke consent
  • Disclose any processing for third-party advertising or sales and offer opt-out methods
• Consumer Rights:
  • Confirm if a controller is processing their data and access it
  • Correct inaccuracies in their personal data
  • Delete personal data
  • Obtain their data in a portable format
  • Opt-out of data processing for targeted advertising, data sales, or profiling
• Enforcement Authority: The New Hampshire Attorney General has exclusive enforcement authority
• Penalties: Violations are treated as unfair competition or deceptive practices under state law, enforceable by the Attorney General. No specific monetary penalties are detailed in the provided sections, but it aligns with state enforcement mechanisms for consumer protection.