New Hampshire Privacy Law (NHPA): Compliance Guide
The New Hampshire Privacy Act (SB 255), effective January 1, 2025, pairs small-state numbers with full-strength obligations. Coverage starts at just 35,000 consumers — or 10,000 when a quarter of revenue comes from data sales — Global Privacy Control has been mandatory since the law's first day, and violations run up to $10,000 each. The 60-day cure period gave early violators room to adjust, but it sunset with the end of 2025.
- Effective
- January 1, 2025
- GPC / universal opt-out
- Required since January 1, 2025
- Required link text
- “Your Privacy Choices”
Last reviewed July 19, 2026 · New Hampshire Privacy Act (SB 255)
Applicability
Who must comply with the NHPA
The New Hampshire Privacy Act applies to businesses that meet the following criteria:
- Controls or processes the personal data of 35,000 or more New Hampshire consumers, or
- Controls or processes the personal data of 10,000 or more New Hampshire consumers and derives 25% or more of gross revenue from the sale of personal data
Consumer rights
What New Hampshire consumers can demand
- Right to access personal data
- Right to correct inaccuracies
- Right to delete personal data
- Right to data portability
- Right to opt out of the sale of personal data, targeted advertising, and profiling
Opt-out mechanics
New Hampshire opt-out & GPC requirements
Like every US state privacy law, the NHPA uses an opt-out model: you do not need a GDPR-style cookie banner, but you must provide a clear and conspicuous opt-out link. The accepted text for New Hampshire is “Your Privacy Choices”.
Global Privacy Control: Required since January 1, 2025
New Hampshire requires covered businesses to honor universal opt-out mechanisms such as Global Privacy Control. The requirement has been in force since January 1, 2025 — the law's first day.
Enforcement
NHPA penalties & enforcement
- Up to $10,000 per violation
Cure period: 60-day cure period, available until December 31, 2025.
State quirks
What makes New Hampshire different
New Hampshire calibrated its thresholds to its size: 35,000 consumers in a state of about 1.4 million people is proportionally a much bigger net than California's 100,000. The obligations, though, are full-strength — GPC mandatory from day one, penalties up to $10,000 per violation, and a 60-day cure period that expired December 31, 2025. Businesses that relied on the cure window during the law's first year now face immediate exposure.
Low thresholds for a small state
Coverage starts at 35,000 consumers, or 10,000 when 25% or more of revenue comes from selling personal data.
GPC from day one
Universal opt-out signals had to be honored from January 1, 2025, with no phase-in period.
Automation
How ConsentKit handles New Hampshire
- ConsentKit's widget is served from Cloudflare's edge and receives the visitor's US state server-side, so New Hampshire visitors are identified before any consent UI renders — no client-side geo-lookup delay.
- New Hampshire visitors see a persistent “Your Privacy Choices” link — the exact statutory text — available to new and returning visitors alike.
- Because New Hampshire requires universal opt-out signals, ConsentKit automatically honors Global Privacy Control for New Hampshire visitors: when the browser broadcasts GPC, the widget applies the opt-out and denies analytics and marketing categories with no click required.
- Every opt-out is recorded server-side with a timestamp and jurisdiction metadata, reviewable and exportable (CSV) from the dashboard — the audit trail regulators ask for.
- Google Consent Mode v2 stays in sync: analytics and advertising tags update the moment a New Hampshire visitor makes a choice.
New Hampshire required GPC from day one; ConsentKit honored it automatically — no deploy or configuration change needed.
FAQ
New Hampshire NHPA FAQ
Does the NHPA apply to my business?
It applies if you control or process the personal data of 35,000 or more New Hampshire consumers, or 10,000 or more while deriving 25% or more of gross revenue from selling personal data — low thresholds that bring mid-size businesses into scope.
Is Global Privacy Control required in New Hampshire?
Yes — from the law's first day, January 1, 2025, with no phase-in period. Covered businesses must honor universal opt-out mechanisms for New Hampshire visitors.
What are the penalties under the NHPA?
Up to $10,000 per violation. A 60-day cure period was available, but only until December 31, 2025 — violations now carry full exposure as soon as enforcement begins.
What rights do New Hampshire consumers have?
New Hampshire consumers can access, correct, delete, and obtain a portable copy of their personal data, and can opt out of the sale of personal data, targeted advertising, and profiling.
This guide is for informational purposes and is not legal advice. Work with qualified counsel to confirm your obligations under the NHPA.
Comply with New Hampshire's NHPA — and the other 19 state laws
ConsentKit detects each visitor's state at the Cloudflare edge, renders the exact opt-out link their law requires, honors GPC automatically where mandated, and records every choice for your audit trail.