New Hampshire

An owner or operator of a computer online service, including an AI chat program, large language model bot, chat bot, or character AI whose sole purpose is open-ended generative communication, commits endangering the welfare of a child under RSA 639:3, III-a if, knowing it is directing the communication to a child, it facilitates, encourages, offers, solicits, or recommends that the child imminently engage in sexually explicit conduct, producing a visual depiction of such conduct, illegal drug or alcohol use, self-harm or suicide, or a crime of violence against another person.

RSA 639:3, V classifies a violation of this paragraph as a misdemeanor rather than the felony reserved for paragraph III of the same section. A separate provision, RSA 507:8-k, exposes the same owner or operator to civil liability for damages proximately caused, with a floor of $1,000 in liquidated damages per violation, but reserves the right to bring that action to the attorney general alone rather than to the child or parent directly.

Neither provision reaches a cloud, telecommunications, or information service provider handling another party's content, or an AI chat feature incidental to a video game, streaming service, or similar entertainment product.

No person may knowingly create, produce, manufacture, or direct an intimate visual representation of an identifiable child for prurient purposes.

The chapter defines the covered representation to include a synthetic image, one that has been altered or created depicting an individual's image in a realistic but false representation, alongside an ordinary photograph, film, video, or digital image, so an AI-generated or AI-altered intimate image of a child falls within the prohibition on the same footing as an authentic one. A violation is a class B felony.

A person is guilty of a class B felony under RSA 638:26-a if the person knowingly creates, distributes, or presents a deepfake, a video, audio, or other media digitally altered so an identifiable individual appears to be someone else or to say or do something they never said or did, for the purpose of embarrassing, harassing, entrapping, defaming, extorting, or otherwise causing that person financial or reputational harm.

A separate civil action under RSA 507:8-j lets the depicted person sue for damages on the same conduct. Both sections exempt an interactive computer service displaying another party's content, a bona fide news report that flags the deepfake's questionable authenticity, a paid political communication that preserves its sponsor's disclaimer, and satire or parody not reliant on AI impersonation.

Within 90 days of an election, a person, corporation, committee, or other entity may not distribute a message it knows or should have known is an AI-generated or generative-AI deepfake of a candidate, election official, or party on the ballot, unless the media carries a prescribed disclosure stating that it was manipulated or generated by artificial intelligence and depicts speech or conduct that did not occur, sized or paced so an average viewer or listener will notice it.

A targeted candidate or election official may sue for damages; the prohibition does not reach an interactive computer service host, a person with no reason to know the material was a deepfake, qualifying news coverage, paid political communications that keep their sponsor's disclaimer, or satire or parody not reliant on artificial intelligence.

A licensee that learns that a cybersecurity event has or may have occurred must conduct, or have an outside vendor or service provider conduct, a prompt investigation. The investigation must determine as much as possible of whether a cybersecurity event has occurred, its nature and scope and the nonpublic information involved, and the licensee or its vendor must perform or oversee reasonable measures to restore the security of the compromised information systems.

Where the event occurs in a system a third-party service provider maintains, the licensee must complete those steps or confirm and document that the provider has completed them. The licensee must maintain records concerning all cybersecurity events for at least 5 years from the date of the event and must produce those records upon demand of the commissioner. The section took effect on January 1, 2020.

Each licensee must notify the commissioner within 3 business days of a determination that a cybersecurity event has occurred when New Hampshire is the licensee's state of domicile as an insurer, or its home state as a producer, and the event has a reasonable likelihood of materially harming a consumer residing in New Hampshire or any material part of the licensee's normal operations.

Each licensee must also notify the commissioner within 3 business days when it reasonably believes that the nonpublic information involves 250 or more consumers residing in New Hampshire and that the event impacts the licensee, in which case notice shall be provided to any government body, self-regulatory agency or other supervisory body, or has a reasonable likelihood of materially harming a consumer residing in New Hampshire or a material part of the licensee's normal operations.

The notice must give as much as possible of the information the paragraph lists, in electronic form as the commissioner directs, and the licensee has a continuing obligation to update it. For a cybersecurity event in a system maintained by a third-party service provider, the licensee treats the event as it would its own unless the provider gives the notice. A licensee that violates the chapter may be penalized in accordance with RSA 400-A:15, III.

Under RSA 400-A:15, III a person who knowingly violates a statute, rule, regulation or order of the commissioner may be subject to an administrative fine not to exceed $2,500 per violation. The chapter shall not be construed to create or imply a private cause of action for violation of its provisions. The chapter took effect on January 1, 2020.

A person doing business in New Hampshire that owns or licenses computerized data including personal information must, on becoming aware of a security breach, determine the likelihood of misuse and notify affected individuals and the Attorney General's office as soon as possible, with notice to consumer reporting agencies required once more than 1,000 residents are affected. "Personal information" excludes information lawfully made available to the public from government records.

The codified text's own source note dates this subdivision to 2006, 242:1, effective January 1, 2007. Unlike the comprehensive act, this statute arms an injured person with a private right of action, including treble damages for a willful or knowing violation.

The department of education must create, maintain and make publicly available an annually updated index of data elements containing definitions of the individual student personally identifiable data fields it holds or proposes to collect. The security plan must require the department to issue an annual data security breach report, which is posted to the department's public website.

Each local education agency must develop a data and privacy governance plan, updated annually and presented to the school board, that includes an inventory of all software applications, digital tools and extensions. Copies of written parental consent for a student's registration on a technology platform must be retained as part of the student's educational record.

NHDPA governs private-sector processing of New Hampshire residents' personal data. It applies to a person conducting business in New Hampshire, or producing a product or service targeted to New Hampshire residents, that in a year controlled or processed the personal data of at least 35,000 unique consumers (excluding data processed solely to complete a payment transaction), or 10,000 consumers while deriving more than 25 percent of gross revenue from the sale of personal data.

Controllers must limit collection to what is adequate, relevant, and reasonably necessary and describe their purposes in a privacy notice; processors act only on the controller's instructions and assist with rights requests, security, and breach notification.

A controller must conduct and document a data protection assessment for each processing activity that presents a heightened risk of harm to a consumer, which includes targeted advertising, the sale of personal data, some profiling and the processing of sensitive data. The attorney general may require a controller to disclose any data protection assessment that is relevant to an investigation, and the controller must make it available to the attorney general.

Data protection assessments are confidential and exempt from disclosure under RSA 91-A. The assessment requirements apply to processing activities created or generated after July 1, 2024, and are not retroactive. The section took effect on January 1, 2025.

All medical information in the medical records in the possession of any health care provider, or of a third-party vendor with whom a provider contracts to store, handle and issue copies of the records, is deemed the property of the patient. The patient or the patient's requestor is entitled to a copy of the records upon request, as regulated by the Health Insurance Portability and Accountability Act of 1996.

Records provided to a requestor must be provided within 30 days of receipt of the request, and any records not provided within 30 days shall be provided at no cost. For a requestor, the cost for paper copies shall not exceed $5 for the first page, $.41 per page for pages 2 through 50 and $.30 per page for pages 51 and higher, and electronic copies shall be charged at a reasonable rate not to exceed $50.00.

When the requestor is the person's health care provider, the transfer must be made within 14 days of the request at no cost. A health care provider includes any person, corporation, facility or institution either licensed by New Hampshire or otherwise lawfully providing health care services, including the department of health and human services. The section was most recently amended by 2025, 233:1, effective September 13, 2025.

Release or use of patient identifiable medical information for the purpose of sales or marketing of services or products shall be prohibited without written authorization. The provisions this entry describes came into force on different days.

When an individual's medical record is maintained in electronic form, the individual has the right to a report, based on whatever audit trail of that record is then maintained, of access to the record by a health care provider the individual names within an identified period in the prior 3 years.

The health information organization must maintain an audit log of the transactions transmitted through it, and the parties transmitting or receiving information through it must maintain audit logs in accordance with nationally accepted interoperability standards, including the identity of the health care provider accessing the information, the identity of the individual whose protected health information was accessed, the date of access and the area of the record accessed.

NHDPA gives a New Hampshire consumer the right to confirm and access their personal data, correct inaccuracies, delete data, obtain a portable copy, and opt out of targeted advertising, the sale of personal data, and profiling with legal or similarly significant effects.

A controller must respond without undue delay and no later than 45 days after receipt, with one 45-day extension available if the controller informs the consumer within the initial period, and must offer an internal appeal of a denial, decided within 60 days, after which the consumer may complain to the Attorney General.

The rule governs the treatment of nonpublic personal health information and nonpublic personal financial information about individuals by all licensees of the state insurance department.

A licensee must give a customer a clear and conspicuous notice of its privacy policies and practices not later than when it establishes the customer relationship, and must give a consumer such a notice before it discloses any nonpublic personal financial information about the consumer to a nonaffiliated third party, other than as the rule authorizes.

A licensee must give a customer such a notice not less than annually during the customer relationship, subject to an exception for a licensee whose disclosures and policies have not changed. A licensee may not disclose nonpublic personal financial information about a consumer to a nonaffiliated third party unless it has given the initial notice and an opt-out notice, has given the consumer a reasonable opportunity to opt out, and the consumer does not opt out.

A licensee shall not disclose nonpublic personal health information about a consumer or customer unless an authorization is obtained from that person, except for the insurance functions the rule lists. A licensee shall not unfairly discriminate against a consumer or customer because that person has opted out of the disclosure of nonpublic personal financial information. A violation of the rule shall be subject to the penalty provisions of RSA 400-A:15, III and RSA 417:13.

The rule does not apply to information about companies or about individuals who obtain products or services for business, commercial or agricultural purposes. The history notes show an original rule effective July 1, 2001 that expired July 1, 2009, a new rule effective May 6, 2011, and a rule readopted effective May 6, 2019.

The New Hampshire Attorney General has exclusive authority to enforce NHDPA. The Attorney General was required to give a controller a notice of violation and 60 days to cure through December 31, 2025, and may do so at its discretion afterward; an uncured violation is treated as an unfair trade practice under RSA 358-A, subject to a civil penalty of up to $10,000 per violation, and the chapter creates no private right of action.

No employer, labor organization, employment agency or licensing agency may directly or indirectly solicit, require or administer genetic testing relating to any individual as a condition of employment, labor organization membership or licensure. No such body may affect the terms, conditions or privileges of employment, membership or licensure, or terminate any individual, based on genetic testing.

No person may sell or otherwise provide to such a body any genetic testing relating to an employee, member or licensee or to a prospective one, except as the section allows. The section does not prohibit genetic testing of an employee who requests it and gives written and informed consent for investigating a workers' compensation claim or for determining susceptibility to or exposure to toxic substances in the workplace.

The section does not prohibit or limit genetic testing for evidence of insurability with respect to life, disability income or long-term care insurance under the terms of an employee benefit plan. An aggrieved individual may bring a civil action under the chapter and, if successful, shall be awarded special or general damages of not less than $1,000 for each violation, and costs and reasonable legal fees.

A health insurer in connection with providing health insurance may not require or request, directly or indirectly, any individual or family member to undergo genetic testing, or to reveal whether the individual or a family member has undergone genetic testing or the results.

A health insurer may not condition health insurance coverage or benefits on whether an individual or a family member has undergone genetic testing or the results, and may not consider that in the determination of rates or any other aspect of coverage or benefits.

A person in the business of providing life, disability income or long-term care insurance who obtains information about genetic testing of an individual or a family member may not use that information in writing a type of insurance coverage other than those three types. An aggrieved individual may bring a civil action under the chapter and, if successful, shall be awarded special or general damages of not less than $1,000 for each violation, and costs and reasonable legal fees.

Except as RSA 141-H:5, II provides, the provisions of the chapter do not apply to the provision of life insurance, disability income insurance or long-term care insurance.

No individual or member of the individual's family may be required to undergo genetic testing as a condition of doing business with another person. Subject to listed exceptions, no genetic testing may be done in New Hampshire on any individual, or anywhere on any resident of New Hampshire based on bodily materials obtained in New Hampshire, without the prior written and informed consent of the individual to be tested or of the parent, guardian, custodian or conservator.

The results of a test may be provided only to the persons the individual approves in writing, and no person may refuse to do business with an individual solely because the individual refuses to consent to providing the test results to some or all persons. Except as the section provides, no person may disclose that an individual has undergone genetic testing, or the results of the testing, without the prior written and informed consent of the individual.

An aggrieved individual may bring a civil action under the chapter and, if successful, shall be awarded special or general damages of not less than $1,000 for each violation, and costs and reasonable legal fees.

The section does not limit genetic testing or genetic analysis used for diagnosis and treatment of a consenting patient by a clinical laboratory that has received a specimen referral from the individual patient's treating physician, genetic counselor or another clinical laboratory, and allows disclosure to entities participating in the clinical care of the patient.

Except as RSA 141-H:5, II provides, the provisions of the chapter do not apply to the provision of life insurance, disability income insurance or long-term care insurance.

A health care provider, or a business associate of the provider, shall obtain an authorization for any use or disclosure of protected health information for marketing. For use or disclosure of protected health information for fundraising, a provider or business associate shall, in a clear and conspicuous manner, provide an opportunity for any intended recipient of fundraising communications to elect not to receive them.

Protected health information disclosed for marketing or fundraising shall not be disclosed by voice mail, an unattended facsimile, or other methods of communication that are not secure. When a provider or business associate uses or discloses protected health information in a way federal law allows but RSA 332-I:4 does not permit, the provider shall promptly notify in writing the individuals whose information was disclosed.

An aggrieved individual may bring a civil action under RSA 332-I:4 or RSA 332-I:5 and, if successful, shall be awarded special or general damages of not less than $1,000 for each violation, and costs and reasonable legal fees. The sections took effect on January 1, 2010.

NHDPA classifies genetic or biometric data processed to uniquely identify a person, along with racial or ethnic origin, religious belief, a health condition, sexual orientation, citizenship or immigration status, a known child's data, and precise geolocation, as sensitive data requiring the consumer's opt-in consent.

"Biometric data" means data from automatic measurement of a biological characteristic, such as a fingerprint, voiceprint, or eye retina or iris, used to identify a specific individual; the definition excludes a photograph, or data from an audio or video recording, only until that data is generated to identify a specific individual, at which point the exclusion lifts and the data is biometric, and sensitive, data.

An operator is the operator of an Internet website, online service, online application or mobile application with actual knowledge that it is used primarily for K-12 school purposes and was designed and marketed for those purposes. No operator may knowingly engage in targeted advertising on its own or any other site, service or application based on information it acquired because of the use of its site, service or application.

No operator may knowingly use information created or gathered by its site, service or application to amass a profile about a K-12 student, or sell, lease, rent, trade or otherwise make available a student's information, including covered information.

An operator shall implement and maintain reasonable security procedures and practices appropriate to the nature of the covered information, and shall delete a student's covered information if the school or district requests deletion of data under its control. The section does not apply to general audience Internet websites, online services, online applications or mobile applications. The section was added by 2015, 128:1, effective January 1, 2016.

Videotape rental or sales records which contain the names or other personal identifying information regarding the renters or purchasers of videotapes shall be confidential and shall not be disclosed by any person or other entity renting or selling such videotapes, except as paragraph II provides. Records may be disclosed to the extent necessary for the proper operation of videotape rental and sales establishments.

The records shall be disclosed upon request by or consent of the renter or the renter's or buyer's parent or guardian in the case of a minor, to law enforcement agencies for an ongoing criminal investigation regarding theft or failure to return videotapes, pursuant to subpoena or court order, where otherwise required by statute, and to any person if the disclosure is limited to debt collection activities, order fulfillment, request processing or the transfer of ownership.

A videotape rental or sales establishment may release statistical information and other data regarding the circulation or use of videotape rental or sales materials, provided that the identity of the renters or purchasers is considered confidential and is not disclosed to the general public except as paragraph II provides.

In the case of mail order sales, such statistical information and other data may include the names and addresses of persons who have purchased videotapes and the subject matter of such videotapes, as long as no other information about the videotapes, including title and content, is disclosed.

RSA 638:17, I makes it the computer crime of unauthorized access when a person, knowing they are not authorized, knowingly accesses or causes to be accessed a computer or computer network; affirmative defenses excuse a reasonable good-faith belief that the owner had authorized access, would have authorized it without payment, or that the access could not reasonably have been known to be unauthorized.

RSA 638:17, IV separately makes it misuse of computer information to knowingly make an unauthorized display, use, disclosure, or copy of data obtained through such access, which can reach downstream use of data taken beyond the scope of any authorization, not only the initial access itself.

RSA 638:16, II defines authorization as the express or implied consent of the computer's owner, so ordinary access to an unauthenticated public page is authorized unless and until that consent is withdrawn; no New Hampshire case addresses whether or how notice revokes implied authorization for automated collection specifically.

RSA 638:18 grades the offense by the dollar value of the property or computer services affected, from a misdemeanor at $1,000 or less up to a class A felony above $1,500 or on a repeat offense, and lets a court substitute a fine of double the defendant's gain from the offense; New Hampshire's general felony fine cap under RSA 651:2 applies where the offense does not itself state one.

Each licensee must develop, implement, and maintain a comprehensive written information security program based on the licensee's risk assessment and that contains administrative, technical, and physical safeguards for the protection of nonpublic information and the licensee's information system.

A licensee is any person licensed, authorized to operate, or registered, or required to be licensed, authorized, or registered, pursuant to the insurance laws of New Hampshire, other than a purchasing group or a risk retention group chartered and licensed in another state or a person acting as an assuming insurer domiciled in another state or jurisdiction.

Each licensee must establish, as part of its program, a written incident response plan designed to promptly respond to, and recover from, any cybersecurity event. Each insurer domiciled in New Hampshire must submit to the commissioner by March 1 each year a written statement certifying that the insurer is in compliance with the requirements of RSA 420-P:4.

A licensee that learns that a cybersecurity event has or may have occurred must conduct a prompt investigation, or have a designated outside vendor or service provider conduct it. A licensee with fewer than 20 employees, including any independent contractors, is exempt from RSA 420-P:4. A licensee that complies with the Health Insurance Portability and Accountability Act (HIPAA) safe harbor must continue to comply with the commissioner notification requirements of RSA 420-P:6, I and II.

A licensee that is in compliance with 23 NYCRR Part 500 is considered to meet the requirements of the chapter if it submits a written statement to the commissioner certifying that compliance, but it remains subject to the investigation requirements of RSA 420-P:5 and the notification requirements of RSA 420-P:6, I, II and III. A licensee that violates the chapter may be penalized in accordance with RSA 400-A:15, III. The chapter took effect on January 1, 2020.

The governing body, or chief administrative officer or designee, of any political subdivision who knows of or suspects a cybersecurity incident within the political subdivision's information systems, or within any vendor acting as an agent of the political subdivision, must immediately report the incident upon discovery to the New Hampshire cyber integration center of the department of information technology.

The political subdivision's reporter must disclose all known information and interactions to the cyber integration center. A cybersecurity incident is an occurrence that actually or potentially jeopardizes the confidentiality, integrity, or availability of an information system or the information it processes, stores, or transmits, or that constitutes a violation or imminent threat of violation of security policies, security procedures, or acceptable use policies. The section took effect on August 16, 2022.

RSA 570-B:2 makes it an offense for a person to install or use a pen register or a trap and trace device without first obtaining a superior court order under the chapter; a first violation is a misdemeanor and a second or subsequent violation is a class B felony.

A pen register is a device that records or decodes the impulses identifying the numbers dialed or otherwise transmitted on the telephone line to which it is attached, and a trap and trace device captures the incoming impulses identifying the originating number of a telecommunication. The pen register definition excludes a device a provider or customer of a telecommunication service uses for billing or cost accounting in the ordinary course of its business.

The chapter's exceptions, in RSA 570-B:3, run only to a provider of telecommunication service: operating, maintaining or protecting its own service, recording that a call was made or completed to guard against fraudulent or unlawful use, and acting with the consent of the user of that service. The chapter creates no private civil action; its only stated remedy is the criminal offense in RSA 570-B:2.

Section 570-A:2 makes it a class B felony to wilfully intercept, disclose, or use the contents of a telecommunication or oral communication without the consent of every party to it, except where the chapter specifically provides otherwise.

A party to the communication, or a person who has obtained only one party's prior consent, who knowingly intercepts it without the law-enforcement approval that section 570-A:2, II(d) requires is guilty of a misdemeanor rather than a felony, so a participant may not lawfully record a conversation on their own consent alone.

A telecommunication is the transfer of any form of information in whole or in part through the facilities of a communications common carrier, and is covered whether or not either party expected privacy, while an oral communication is covered only where the speaker had a reasonable expectation, justified by the circumstances, that it would not be intercepted.

Telephone equipment furnished by a carrier and used by the subscriber in the ordinary course of its business is not an intercepting device under the chapter.

The chapter's exceptions in section 570-A:2, II reach a communications common carrier's own operators and employees, investigative and law enforcement officers acting under the chapter, Federal Communications Commission monitors, emergency responders and public utilities handling emergency calls, school buses, and police video, body-worn and TASER-mounted recorders; none of them lets an ordinary business record its own marketing, customer-service or support calls under a one-party consent standard.

Section 570-A:11 gives any person whose telecommunication or oral communication is intercepted, disclosed or used in violation of the chapter a civil action for actual damages, but not less than liquidated damages of $100 a day for each day of violation or $1,000, whichever is higher, plus punitive damages and a reasonable attorney's fee and litigation costs.

RSA 359-E:2 requires anyone intending to use an automatic telephone dialing system, equipment that stores or produces numbers to call randomly or sequentially and delivers a prerecorded message without a live operator, for solicitation in New Hampshire to register with the consumer protection and antitrust bureau at least 10 business days beforehand and pay a $20 annual fee.

Solicitation means the unrequested initiation of a telephone call to a residential telephone subscriber to give, sell or lease goods or services, to gain a pledge, promise or contribution where there is no pre-existing relationship with the person called, or to obtain information, data or opinions. Transmissions must be generated randomly at unequal intervals and may not reach any emergency line.

A solicitation message sent through the system must disclose immediately after contact the name of the person, company or organization calling, the purpose of the call and any goods or services offered, and the system must disconnect within 30 seconds after the called party hangs up.

No person using an automatic telephone dialing system, or any other method, for solicitation may block caller identification information from reaching the called party, and that information must contain a number at which the solicitor can receive calls and may not be misleading, inaccurate or deceptive; the section was last amended effective January 1, 2020.

A violation of this subdivision is an unfair or deceptive act or practice under RSA 358-A:2, and every remedy RSA 358-A gives is available to enforce it, including the Attorney General's civil-penalty and injunctive powers under RSA 358-A:4, a private action under RSA 358-A:10 for actual damages or $1,000, whichever is greater, trebled for a willful or knowing violation, with attorney's fees, and criminal prosecution under RSA 358-A:6.

RSA 359-E:8 prohibits a telemarketer from making a telemarketing sales call to a customer, a natural person resident in New Hampshire, who has registered with the do-not-call registry the Federal Trade Commission maintains, and RSA 359-E:9 requires a telemarketer calling customers in the state to obtain the registry's quarterly listings from the Commission.

A person required to comply with the Federal Trade Commission's Telemarketing Sales Rule must also comply with it for telemarketing sales calls made within New Hampshire, as must a person who would be required to comply if the calls were interstate.

Telemarketing is a plan, program or campaign to induce payment for goods or services by telephone, and whether a campaign counts as telemarketing turns on the call-volume test in RSA 359-E:7, X; a telemarketer is a person who makes such calls for financial profit or commercial purposes or controls or supervises one who does.

A telemarketing sales call is a call made to induce payment or an extension of credit for goods or services, or to obtain information for a direct solicitation of one, but not a call made at the customer's own express written or verbal request, in connection with an established business relationship as the Telemarketing Sales Rule defines it, on behalf of a nonprofit charity, or on behalf of a political campaign unless a vendor places it with automatic dialing equipment.

The Department of Justice must impose a civil penalty of $5,000 for each violation it finds after investigating a complaint, and a person injured by a violation may separately recover actual damages or $1,000, whichever is greater, trebled (at least doubled) for a willful or knowing violation, plus the costs of suit and reasonable attorney's fees.

A telemarketer is not liable if it proves, by clear and convincing evidence, that as a routine business practice it maintains written procedures, trains its personnel, screens against the current quarterly registry and keeps records of doing so, monitors compliance, uses a list no more than three months old, and that the call was a good-faith error outside any pattern of violations.

Amends the New Hampshire Privacy Act to prohibit a controller from selling a child's personal data. Passed the House 214 to 145 on February 12, 2026, passed the Senate with amendment on April 9, 2026, the House concurred on May 7, 2026, and Governor Ayotte signed it on June 19, 2026.

Bars a controller from processing personal data for targeted advertising or from selling it, without consent, under circumstances where the controller has actual knowledge, and wilfully disregards, that the consumer is at least 13 years of age but younger than 16 years of age, and requires a data protection assessment for any processing activity that presents a heightened risk of harm to consumers, including minors.