Law / United States / 
New Hampshire
SB 255, New Hampshire Privacy Act
N.H. Rev. Stat. Ann. ch. 507-H (2024 N.H. Laws ch. 5)
In force since .
An age-appropriate design code rule binding private bodies.
- Audit expectation
- on_request
- Who audits it
- Regulator
- Where the report goes
- Produced on request
What it requires
- Applies to controllers subject to the New Hampshire Privacy Act under circumstances where the controller has actual knowledge, and wilfully disregards, that a consumer is at least 13 years of age but younger than 16 years of age.
- Do not process that consumer's personal data for targeted advertising, or sell it, without consent.NIST Privacy FrameworkCT.PO-P1
- Complete a data protection assessment for any processing activity that presents a heightened risk of harm to consumers, including minors.NIST Privacy FrameworkID.RA-P4
These lines are LexLint's reading of the law's text. Also read by: New Hampshire Department of Justice (guidance, recorded ).
In the frameworks
- NIST Privacy Framework
- ID.RA-P4Problematic data actions, likelihoods, and impacts are used to determine and prioritize risk.
- CT.PO-P1Policies, processes, and procedures for authorizing data processing (e.g., organizational decisions, individual consent), revoking authorizations, and maintaining authorizations are established and in place.
Our reading of where this law's duties sit in each framework, and in the NIST Privacy Framework, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
If you get it wrong
Private right of actionNo
Penalties
Enforced as a violation of the Consumer Protection Act by the Attorney General, with a mandatory cure period through
Who enforces it
Enforcement body
New Hampshire Department of Justice, Data Privacy Unit
Settledness
- As of
- Guidance link
- https://www.doj.nh.gov/data-privacy-enforcement
- Guidance body
- New Hampshire Department of Justice
- Open questions
- Does 'actual knowledge, and wilfully disregards' in RSA 507-H:6 require both actual knowledge and willful disregard that a consumer is at least 13 and younger than 16 before consent is required, or does either alone trigger the duty?
What it reaches
Age threshold
16
Covered services
Controllers subject to the New Hampshire Privacy Act processing data of a known minor age 13 to 15
How the hook was established
express
What makes it apply
Market targeting, Data subject residence
What it makes you log
Who may demand the log
Regulator
Logging duty
The record is the controller's data protection assessment of each processing activity that presents a heightened risk of harm to a consumer, which the row's third requirement names. RSA 507-H:6, I(g) itself names no log or record of an age check.
- Kind
- Explicit
- As of
- Provision
- RSA 507-H:8, I
- Trigger
- personal_data_processing
What this law does
Bars a controller from processing personal data for targeted advertising or from selling it, without consent, under circumstances where the controller has actual knowledge, and wilfully disregards, that the consumer is at least 13 years of age but younger than 16 years of age, and requires a data protection assessment for any processing activity that presents a heightened risk of harm to consumers, including minors.
When LexLint raises it
When your app profile says your app serves under-18s.
Back to the example · Lint your app
Page updated .