New Hampshire consumer privacy law (SB 255, Laws 2024, ch. 5; RSA 507-H, Expectation of Privacy): profiling opt-out and data protection assessments

Summary

New Hampshire's comprehensive consumer privacy law, SB 255 (2024, chapter 5), codified as RSA chapter 507-H ('Expectation of Privacy') and in force since January 1, 2025. It applies to persons doing business in New Hampshire or targeting its residents that, in a year, controlled or processed the personal data of 35,000 or more unique consumers (excluding payment-only data), or 10,000 or more consumers while deriving over 25 percent of gross revenue from selling personal data. Consumers may opt out of profiling in furtherance of solely automated decisions that produce legal or similarly significant effects, which include decisions on financial or lending services, housing, insurance, education, criminal justice and employment. Controllers must conduct and document a data protection assessment for profiling that presents a reasonably foreseeable risk of unfair or deceptive treatment, unlawful disparate impact, or financial, physical or reputational injury. Financial institutions and data subject to Title V of the Gramm-Leach-Bliley Act are excluded. The Attorney General has exclusive enforcement authority; a violation is an unfair or deceptive practice under the Consumer Protection Act (RSA 358-A:2), and there is no private right of action. A 2026 act amends the controller-duties section from January 1, 2027.

Key dates

1. March 6, 2024Enacted
2. January 1, 2025Takes effect
3. October 16, 2026Checked against sources
4. October 21, 2026Checked against sources

Developments are added when the record is reviewed. Next review: January 15, 2027.

Evidence

Each passage is quoted from its source. The quoted passages are re-checked against the live pages every month.

1. Source. 2024, 5:1, eff. Jan. 1, 2025; 229:2, eff. Jan. 1, 2025 at 12:01 a.m.

   Supports: Session law chapter and effective date

   or profiling in furtherance of solely automated decisions that produce legal or similarly significant effects concerning the consumer.

   Supports: Profiling opt-out

   means decisions made by the controller that result in the provision or denial by the controller of financial or lending services, housing, insurance, education enrollment or opportunity, criminal justice, employment opportunities

   Supports: Legal or similarly significant effects include financial or lending services

   The processing of personal data for the purposes of profiling, where such profiling presents a reasonably foreseeable risk of unfair or deceptive treatment of, or unlawful disparate impact on, consumers, financial, physical or reputational injury to consumers

   Supports: Data protection assessment for risky profiling

   Controlled or processed the personal data of not less than 35,000 unique consumers, excluding personal data controlled or processed solely for the purpose of completing a payment transaction

   Supports: Threshold

   Controlled or processed the personal data of not less than 10,000 unique consumers and derived more than 25 percent of their gross revenue from the sale of personal data

   Supports: Alternative threshold

   Financial institution or data subject to Title V of the Gramm-Leach-Bliley Act, 15 U.S.C. 6801 et seq.

   Supports: GLBA exclusion

   The attorney general shall have exclusive authority to enforce violations under this chapter.

   Supports: Exclusive Attorney General enforcement

   A violation under this chapter shall constitute an unfair method of competition or any unfair or deceptive act or practice in the conduct of any trade or commerce within this state under RSA 358-A:2

   Supports: Consumer Protection Act route

   Nothing in this chapter shall be construed as providing the basis for, or be subject to, a private right of action for violations under this chapter or any other law.

   Supports: No private right of action

   2026, 168:1, eff. Jan. 1, 2027.

   Supports: Pending 2026 amendment to RSA 507-H:6

   RSA chapter 507-H, Expectation of Privacy New Hampshire General Court Primary source

2. On March 6, 2024, New Hampshire Governor Chris Sununu signed Senate Bill 255 into law

   Supports: Signing date and bill number

   New Hampshire Enacts Comprehensive Privacy Law – SB 255 Troutman Pepper Locke Reporting or analysis

3. On March 6, 2024, Governor Chris Sununu signed into law SB 255

   Supports: Signing date (second source)

   New Hampshire Becomes 15th State to Enact a Comprehensive State Privacy Law Hunton Andrews Kurth Reporting or analysis