New Hampshire
From US state consumer privacy laws: Which US states have comprehensive consumer privacy laws, who do they apply to, and what happens if a business breaks them?
Law: Not looked at yet
The act's official or short title as the statute or the state's official page gives it, with its code citation if stated.
No source we could use stated this. A blank never means no.
Takes effect: Jan. 1, 2025
The first date the law's main consumer-privacy duties apply to businesses, as stated by the statute or state. Ignore later phase-ins for specific provisions.
Source. 2024, 5:1, eff. Jan. 1, 2025
Source: https://gc.nh.gov/rsa/html/LII/507-H/507-H-mrg.htm. Read 2026-11-01. Read once.
Who it applies to: Controlled or processed the personal data of not less than 35,000 unique consumers, excluding personal data controlled or processed solely for the purpose of completing a payment transaction
The law's applicability threshold in short form, as the statute states it, such as revenue or number of consumers processed.
Controlled or processed the personal data of not less than 35,000 unique consumers, excluding personal data controlled or processed solely for the purpose of completing a payment transaction
Source: https://gc.nh.gov/rsa/html/LII/507-H/507-H-mrg.htm. Read 2026-11-01. Read once.
Consumers threshold: 35000 consumers
The lowest number of state consumers whose personal data triggers the law on its own, without a revenue test. Null if the law has no such number.
Controlled or processed the personal data of not less than 35,000 unique consumers
Source: https://gc.nh.gov/rsa/html/LII/507-H/507-H-mrg.htm. Read 2026-11-01. Read once.
Cure period: 60 days
Days the statute gives a business to fix a violation before enforcement. Null if the law gives no right to cure.
If the controller fails to cure such violation within 60 days of receipt of the notice of violation
Source: https://gc.nh.gov/rsa/html/LII/507-H/507-H-mrg.htm. Read 2026-11-01. Read once.
Cure period ends: December 31, 2025
The date the right to cure sunsets, as stated in the statute. Null if there is no cure period or it does not expire.
During the period beginning January 1, 2025 and ending December 31, 2025, the attorney general shall
Source: https://gc.nh.gov/rsa/html/LII/507-H/507-H-mrg.htm. Read 2026-11-01. Read once.
Enforced by: attorney general
The official or agency the statute names as enforcer.
The attorney general shall have exclusive authority to enforce violations under this chapter.
Source: https://gc.nh.gov/rsa/html/LII/507-H/507-H-mrg.htm. Read 2026-11-01. Read once.
Maximum penalty: Not looked at yet
The highest civil penalty per violation stated in the statute, including higher tiers such as intentional violations. Use the statute's base figure, not inflation-adjusted amounts, unless the statute itself states the adjusted figure.
No source we could use stated this. A blank never means no.
Private right of action: No
True if consumers can sue directly under the law for any violation. False if the statute says it creates no private right of action or leaves enforcement solely to the state.
Nothing in this chapter shall be construed as providing the basis for, or be subject to, a private right of action for violations under this chapter or any other law.
Source: https://gc.nh.gov/rsa/html/LII/507-H/507-H-mrg.htm. Read 2026-11-01. Read once.
Opt-out signal required: Yes
True if the statute requires businesses to honor a universal opt-out signal or preference signal, such as Global Privacy Control, now or by a stated date.
the controller shall comply with such consumer's opt-out preference signal
Source: https://gc.nh.gov/rsa/html/LII/507-H/507-H-mrg.htm. Read 2026-11-01. Read once.