New Hampshire Privacy Act AI Compliance 2026: The Cure Period Just Sunset
NHPA follows the full Virginia-style template — profiling opt-out, data protection assessments, and correction rights all included — but the temporary right-to-cure window businesses relied on early has since expired on its statutory schedule. AI companies compliant elsewhere still need to check NHPA on its own terms.
Does NHPA Apply to Your AI Product?
NHPA applies to a business that conducts business in New Hampshire or produces products or services targeted at New Hampshire residents, and that during a calendar year controls or processes the personal data of at least 35,000 consumers (excluding data processed solely to complete a payment transaction), or controls or processes the data of at least 10,000 consumers while deriving more than 25% of gross revenue from the sale of personal data.
That 25%-revenue alternate trigger is meaningfully lower than the 50% threshold used in states like Iowa, which means smaller data-monetization business models can fall into scope in New Hampshire even when they would stay under the radar elsewhere. AI companies with lighter-weight data-sharing or licensing arrangements should check this trigger specifically rather than assuming the 35,000-consumer floor is the only relevant number.
What New Hampshire Consumers Get
Targeted advertising opt-out
Consumers can opt out of personal data being used for targeted advertising, including AI-driven ad personalization.
Sale of data opt-out
Consumers can opt out of the sale of their personal data to third parties, including data-licensing arrangements with AI model developers.
Profiling opt-out
Consumers can opt out of profiling in furtherance of decisions that produce legal or similarly significant effects — covering AI-driven eligibility, pricing, and access decisions.
Right to correct and access
Consumers can request access to, correction of, and deletion of their personal data, plus a portable copy — the full consumer rights set most Virginia-template states provide.
A Cure Period That's No Longer There
Several Virginia-template state privacy laws gave businesses a temporary right-to-cure window early on to soften the transition into enforcement, with the window closing on a fixed sunset date written into the statute. NHPA took this approach, and that window has since expired on schedule. AI companies still treating New Hampshire as a cure-first, low-risk enforcement environment because of early guidance are working from outdated assumptions — the New Hampshire Attorney General can now pursue enforcement without offering a mandatory cure opportunity first.
NHPA Compliance Checklist for AI Companies
- ☐Check New Hampshire resident counts against the 35,000 threshold separately from any national or other-state count
- ☐Check the 10,000-consumer / 25%-revenue-from-data-sales alternate trigger, which is lower than many peer states
- ☐Re-run the threshold check annually as user growth or new monetization models can change scope
- ☐Build a full opt-out flow covering targeted advertising, sale, and profiling for significant-effect AI decisions
- ☐Support access, correction, deletion, and portability requests within statutory timelines
- ☐Document the legal-or-similarly-significant-effects standard as it applies to your specific AI decisioning features
- ☐Identify which AI-driven processing activities present a heightened risk of harm under the statute
- ☐Conduct and retain data protection assessments before deploying qualifying high-risk AI features
- ☐Build assessment review into your product launch process rather than treating it as a one-time exercise
- ☐Do not rely on a right-to-cure opportunity — the statutory window has already sunset
- ☐Retain records supporting your scope, threshold, and assessment determinations
- ☐Monitor New Hampshire Attorney General enforcement activity now that direct enforcement is available
See where your AI product is exposed
RatedWithAI helps SaaS and platform teams surface compliance and trust gaps across their web properties. Start with a free scan to understand how your product presents to users and regulators alike.
Scan Your Product for Free →Frequently Asked Questions
If we're compliant with Virginia's VCDPA, are we automatically compliant with NHPA?
In most respects, yes — NHPA closely tracks the Virginia template, including the profiling opt-out, data protection assessments, and full consumer rights set. The main gap to check is the lower 10,000-consumer / 25%-revenue alternate threshold, which can pull smaller companies into scope in New Hampshire even when Virginia's numbers would exclude them.
Why did New Hampshire's cure period expire?
The cure period was written into the statute as a temporary transition measure with a fixed sunset date, the same design several other Virginia-template states used. Once the window closed, enforcement reverted to the state attorney general's ordinary authority without a mandatory cure step, which is the design intent rather than an oversight.
Does NHPA apply to nonprofits or government contractors serving New Hampshire residents?
NHPA's scope tracks the standard Virginia-template approach, which generally exempts government entities and certain nonprofits, but AI vendors selling into those sectors should not assume their own compliance obligations are waived just because their customer is exempt — the vendor's own processing activity is assessed independently.