New Hampshire

An owner or operator of a computer online service, including an AI chat program, large language model bot, chat bot, or character AI whose sole purpose is open-ended generative communication, commits endangering the welfare of a child under RSA 639:3, III-a if, knowing it is directing the communication to a child, it facilitates, encourages, offers, solicits, or recommends that the child imminently engage in sexually explicit conduct, producing a visual depiction of such conduct, illegal drug or alcohol use, self-harm or suicide, or a crime of violence against another person.

RSA 639:3, V classifies a violation of this paragraph as a misdemeanor rather than the felony reserved for paragraph III of the same section. A separate provision, RSA 507:8-k, exposes the same owner or operator to civil liability for damages proximately caused, with a floor of $1,000 in liquidated damages per violation, but reserves the right to bring that action to the attorney general alone rather than to the child or parent directly.

Neither provision reaches a cloud, telecommunications, or information service provider handling another party's content, or an AI chat feature incidental to a video game, streaming service, or similar entertainment product.

No person may knowingly create, produce, manufacture, or direct an intimate visual representation of an identifiable child for prurient purposes.

The chapter defines the covered representation to include a synthetic image, one that has been altered or created depicting an individual's image in a realistic but false representation, alongside an ordinary photograph, film, video, or digital image, so an AI-generated or AI-altered intimate image of a child falls within the prohibition on the same footing as an authentic one. A violation is a class B felony.

A person is guilty of a class B felony under RSA 638:26-a if the person knowingly creates, distributes, or presents a deepfake, a video, audio, or other media digitally altered so an identifiable individual appears to be someone else or to say or do something they never said or did, for the purpose of embarrassing, harassing, entrapping, defaming, extorting, or otherwise causing that person financial or reputational harm.

A separate civil action under RSA 507:8-j lets the depicted person sue for damages on the same conduct. Both sections exempt an interactive computer service displaying another party's content, a bona fide news report that flags the deepfake's questionable authenticity, a paid political communication that preserves its sponsor's disclaimer, and satire or parody not reliant on AI impersonation.

Within 90 days of an election, a person, corporation, committee, or other entity may not distribute a message it knows or should have known is an AI-generated or generative-AI deepfake of a candidate, election official, or party on the ballot, unless the media carries a prescribed disclosure stating that it was manipulated or generated by artificial intelligence and depicts speech or conduct that did not occur, sized or paced so an average viewer or listener will notice it.

A targeted candidate or election official may sue for damages; the prohibition does not reach an interactive computer service host, a person with no reason to know the material was a deepfake, qualifying news coverage, paid political communications that keep their sponsor's disclaimer, or satire or parody not reliant on artificial intelligence.

A person doing business in New Hampshire that owns or licenses computerized data including personal information must, on becoming aware of a security breach, determine the likelihood of misuse and notify affected individuals and the Attorney General's office as soon as possible, with notice to consumer reporting agencies required once more than 1,000 residents are affected. "Personal information" excludes information lawfully made available to the public from government records.

The codified text's own source note dates this subdivision to 2006, 242:1, effective January 1, 2007. Unlike the comprehensive act, this statute arms an injured person with a private right of action, including treble damages for a willful or knowing violation.

NHDPA governs private-sector processing of New Hampshire residents' personal data. It applies to a person conducting business in New Hampshire, or producing a product or service targeted to New Hampshire residents, that in a year controlled or processed the personal data of at least 35,000 unique consumers (excluding data processed solely to complete a payment transaction), or 10,000 consumers while deriving more than 25 percent of gross revenue from the sale of personal data.

Controllers must limit collection to what is adequate, relevant, and reasonably necessary and describe their purposes in a privacy notice; processors act only on the controller's instructions and assist with rights requests, security, and breach notification.

NHDPA gives a New Hampshire consumer the right to confirm and access their personal data, correct inaccuracies, delete data, obtain a portable copy, and opt out of targeted advertising, the sale of personal data, and profiling with legal or similarly significant effects.

A controller must respond without undue delay and no later than 45 days after receipt, with one 45-day extension available if the controller informs the consumer within the initial period, and must offer an internal appeal of a denial, decided within 60 days, after which the consumer may complain to the Attorney General.

The New Hampshire Attorney General has exclusive authority to enforce NHDPA. The Attorney General was required to give a controller a notice of violation and 60 days to cure through December 31, 2025, and may do so at its discretion afterward; an uncured violation is treated as an unfair trade practice under RSA 358-A, subject to a civil penalty of up to $10,000 per violation, and the chapter creates no private right of action.

NHDPA classifies genetic or biometric data processed to uniquely identify a person, along with racial or ethnic origin, religious belief, a health condition, sexual orientation, citizenship or immigration status, a known child's data, and precise geolocation, as sensitive data requiring the consumer's opt-in consent.

"Biometric data" means data from automatic measurement of a biological characteristic, such as a fingerprint, voiceprint, or eye retina or iris, used to identify a specific individual; the definition excludes a photograph, or data from an audio or video recording, only until that data is generated to identify a specific individual, at which point the exclusion lifts and the data is biometric, and sensitive, data.

RSA 638:17, I makes it the computer crime of unauthorized access when a person, knowing they are not authorized, knowingly accesses or causes to be accessed a computer or computer network; affirmative defenses excuse a reasonable good-faith belief that the owner had authorized access, would have authorized it without payment, or that the access could not reasonably have been known to be unauthorized.

RSA 638:17, IV separately makes it misuse of computer information to knowingly make an unauthorized display, use, disclosure, or copy of data obtained through such access, which can reach downstream use of data taken beyond the scope of any authorization, not only the initial access itself.

RSA 638:16, II defines authorization as the express or implied consent of the computer's owner, so ordinary access to an unauthenticated public page is authorized unless and until that consent is withdrawn; no New Hampshire case addresses whether or how notice revokes implied authorization for automated collection specifically.

RSA 638:18 grades the offense by the dollar value of the property or computer services affected, from a misdemeanor at $1,000 or less up to a class A felony above $1,500 or on a repeat offense, and lets a court substitute a fine of double the defendant's gain from the offense; New Hampshire's general felony fine cap under RSA 651:2 applies where the offense does not itself state one.

Amends the New Hampshire Privacy Act to prohibit a controller from selling a known child's personal data, including location data, to a third party for money or other value, regardless of consent, going beyond the prior opt in framework that applied only to minors 13 to 15. Passed the House 214 to 145 on February 12, 2026, passed the Senate with amendment on April 9, 2026, the House concurred on May 7, 2026, and Governor Ayotte signed it on June 19, 2026.

Bars a controller from processing personal data for targeted advertising or from selling it, without consent, where the controller has actual knowledge or willfully disregards that the consumer is at least 13 and under 16 years old, and requires a data protection assessment for any processing activity that presents a heightened risk of harm to consumers, including minors.