Key Facts
Overview
New Hampshire's NHPA uniquely includes criminal penalties for intentional noncompliance ($100,000) alongside civil penalties ($10,000). The discretionary cure period uses a multi-factor assessment considering violation count, business size, public injury likelihood, and whether the violation was human or technical error.
What This Means for Your Website
- GPC/universal opt-out signals must be honored
- Opt-in consent required for sensitive data
- Intentional noncompliance can trigger criminal penalties up to $100,000, unusual among US states
- Children 13-16 are protected from data sale and targeted advertising
- The cure period is discretionary with a multi-factor assessment
Key Requirements
The New Hampshire AG enforces the NHPA with civil penalties up to $10,000 and criminal penalties up to $100,000 for intentional violations. Consumer requests must be fulfilled within 45 days (extendable by 45). The multi-factor cure period assessment considers business size, violation severity, and whether errors were human or technical.
How ConsentStack Handles This
ConsentStack detects New Hampshire visitors, honors GPC signals, applies opt-in for sensitive data, and protects 13-16 year olds from data sale and targeted advertising.
Penalties
Up to $10,000 per violation (civil); up to $100,000 per violation for intentional noncompliance (criminal).
Key Requirements
- Honor GPC/universal opt-out signals
- Opt-in consent for sensitive data
- Consumer rights: access, correct, delete, portability, opt-out
- 45-day response window extendable by 45 days
- Data security measures
Notable Provisions
- Criminal penalties for intentional noncompliance ($100,000), unusual
- Discretionary cure period with multi-factor assessment
- Children 13-16: sale and targeted advertising prohibited
Data Subject Rights
Confirm whether a controller is processing your personal data and access that data, unless doing so would require the controller to reveal a trade secret.
Correct inaccuracies in your personal data, taking into account the nature of the data and the purposes of the processing.
Have a controller delete personal data you provided or that it obtained about you.
Obtain a copy of your personal data in a portable and, where technically feasible, readily usable format you can transmit to another controller, where the processing is carried out by automated means.
Opt out of the processing of your personal data for targeted advertising, including through an opt-out preference signal such as a browser or device setting.
Opt out of the sale of your personal data, including through an opt-out preference signal such as a browser or device setting.
Opt out of profiling in furtherance of solely automated decisions that produce legal or similarly significant effects, such as decisions about lending, housing, insurance, education, employment, health care or essential goods.
Designate another person, including through a browser setting, browser extension or global device setting, to opt out on your behalf of targeted advertising, sale or profiling; this agent right covers opt-outs only.
Appeal a controller's refusal to act on your request through an appeal process that must be conspicuously available and similar to the process for submitting requests.
If your appeal is denied, the controller must give you an online mechanism, if available, or other method to contact the New Hampshire Attorney General and submit a complaint.
Revoke consent you gave, for example to the processing of sensitive data, through a mechanism at least as easy as the one you used to give it, after which the controller must stop processing that data.
A controller may not discriminate against you for exercising your rights, including by denying goods or services, charging different prices or rates, or providing a different level of quality.
US State Specifics
Other North America Regulations
Frequently Asked Questions
NHPA requires you to recognize an opt-out preference signal such as Global Privacy Control. Check whether GPC is working on your site to confirm the signal reaches you and that trackers actually stop firing when it does.
Stay compliant with NHPA
ConsentStack helps you implement Opt-out consent for New Hampshire, United States automatically.