NHDPA requirements
New Hampshire's law took effect January 1, 2025 and applies to controllers handling data on 35,000 consumers, or 10,000 where more than a quarter of revenue comes from selling personal data. It follows the Connecticut model: opt-outs of targeted advertising, sale, and profiling; opt-in consent for sensitive data; and a requirement, from day one, to honor universal opt-out signals such as Global Privacy Control. The Attorney General enforces. The 60-day cure period expired at the end of 2025, and civil penalties of up to $10,000 per violation under the state consumer protection act now apply at the AG's discretion, with a criminal tier for purposeful violations. For a national site the obligation that matters is the opt-out signal: once GPC is honored for Colorado and California, New Hampshire expects the same behavior.
Other US State Privacy Laws
See what your sites and apps actually send
Get a free site analysis: every tracker, mapped to the laws that apply to it.