iQ Cookie State Law Series
Cookie & Privacy Law in New Hampshire
Educational purposes only — not legal advice. This guide is intended to help you understand New Hampshire’s data privacy law as it relates to cookie consent and website compliance. Laws change, and your specific situation may vary. Always consult a qualified legal professional before making compliance decisions. iQ Cookie is a technology tool, not a law firm.
The short version
New Hampshire’s NHDPA took effect January 1, 2025 with GPC recognition required from day one — no delayed phase-in like several peer states used. Its mandatory 60-day cure period ran through the end of 2025 and then expired, so as of January 1, 2026 the Attorney General can pursue enforcement at its own discretion, with no guaranteed notice-and-fix window.
New Hampshire does not have a separate cookie law. Cookie compliance flows from the NHDPA itself — its opt-out and sensitive-data rules apply directly to cookies and tracking technology.
Who does it apply to?
The NHDPA covers businesses that conduct business in New Hampshire or target New Hampshire residents, and meet at least one of these thresholds:
Controls or processes personal data of 35,000 or more New Hampshire consumers during a calendar year (payment-completion data excluded from the count).
Controls or processes data of 10,000 or more consumers AND derives more than 25% of gross revenue from selling personal data.
Check current statute text for the full exemption list, including GLBA, HIPAA, and government-entity carve-outs standard across this series.
Consumer rights
New Hampshire residents whose data is covered by the NHDPA can:
Businesses must respond within 45 days, extendable once by 45 more. There is no private right of action under the NHDPA itself — only the Attorney General can enforce.
What makes New Hampshire different
Cure period expired on a hard calendar date. The 60-day mandatory cure window ran through December 31, 2025 and then simply ended. Since January 1, 2026, the Attorney General has discretionary authority to enforce without any advance notice-and-fix requirement.
GPC required from day one — no phase-in. Unlike states that gave businesses a runway before mandating universal opt-out recognition, New Hampshire required it starting with the law’s January 1, 2025 effective date.
Payment data is explicitly carved out of the threshold count. When calculating whether you hit the 35,000-consumer bar, data tied to completing a payment transaction does not count — a detail worth checking if you are near the line.
Enforcement rides on the state’s consumer protection statute. Violations are treated as unfair or deceptive trade practices under RSA 358-A, which brings both civil penalties and, notably, potential criminal exposure — a misdemeanor for individuals, a felony for entities in serious cases.
Minors’ protection spans a specific age band. Consumers age 13 through 15 need opt-in consent before their data is used for targeted advertising or sale — distinct from the under-13 sensitive-data-by-default rule that covers younger children.
Sensitive data & children
Processing sensitive data requires opt-in consent before any collection begins. Sensitive data includes:
Data from known children under 13 is treated as sensitive by default; COPPA-compliant consent satisfies the explicit consent requirement. For ages 13–15, opt-in consent is required specifically before targeted advertising or sale of that consumer’s data.
What this means for your cookies
| Cookie / data type | Requirement | What to do |
|---|---|---|
| Sensitive data cookies (health, biometric, geolocation) | Opt-in required | Gate these behind affirmative consent before they fire. |
| Sale / targeted advertising cookies | Opt-out required | Provide a clear opt-out mechanism. |
| GPC / universal opt-out signals | Required since Jan 1, 2025 | Confirm your consent tool honors GPC with no phase-in exceptions. |
| Profiling cookies (certain automated decisions) | Opt-out required | Offer an opt-out for covered profiling activity. |
| Any cookies — users 13–15 | Opt-in required | No targeted-ad or sale cookies without consent for known minors. |
Enforcement
The New Hampshire Attorney General has exclusive enforcement authority under the Consumer Protection Act, with civil penalties up to $10,000 per violation plus recoverable legal costs. With the cure period now expired, businesses should not assume they will get advance warning before an enforcement action begins.
Your action checklist
With no cure period left, these need to be handled now:
Check your thresholds. Do you process data on 35,000+ New Hampshire consumers (excluding payment data), or 10,000+ while earning over a quarter of your revenue from data sales? If yes, you are in scope.
Confirm GPC recognition is fully live. There was no phase-in period — it has been required since the law took effect.
Audit sensitive data cookies. Health, biometric, and precise geolocation data need opt-in consent before collection.
Gate targeted-ad and sale cookies for ages 13–15. Confirm your age-gating logic covers this specific band, not just under-13.
Update your privacy policy. Cover data categories, processing purposes, third-party recipients, and how to exercise every consumer right.
Complete data protection assessments for targeted advertising, data sales, risky profiling, and sensitive data processing.
Review vendor contracts. Any processor handling New Hampshire resident data must be covered by a written agreement specifying processing instructions and confidentiality obligations.
iQ Cookie scans your site for compliance gaps and deploys a lightweight US-built consent banner.
iQ Cookie State Law Series · Guide 15 of 25 · Next: New Jersey →