New Hampshire HB 1694: relative to the regulation of and protections for personal data obtained by websites and data brokers.

Bill Text

HB 1694-FN - AS INTRODUCED

2026 SESSION

 26-2612

 07/06

HOUSE BILL 1694-FN

AN ACT relative to the regulation of and protections for personal data obtained by websites and data brokers.

SPONSORS: Rep. Wade, Straf. 15; Rep. Long, Hills. 26; Rep. H. Howard, Straf. 4; Rep. Giasson, Hills. 29; Rep. Barton, Graf. 1

COMMITTEE: Judiciary

-----------------------------------------------------------------

ANALYSIS

This bill:

 I. Requires data brokers that operate in this state to register with the secretary of state.

 II. Requires the secretary of state to create and maintain an online data broker registry portal.

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - 

Explanation: Matter added to current law appears in bold italics.

 Matter removed from current law appears [in brackets and struckthrough.]

 Matter which is either (a) all new or (b) repealed and reenacted appears in regular type.

 26-2612

 07/06

STATE OF NEW HAMPSHIRE

In the Year of Our Lord Two Thousand Twenty-Six

AN ACT relative to the regulation of and protections for personal data obtained by websites and data brokers.

Be it Enacted by the Senate and House of Representatives in General Court convened:

 1 Actions, Process, and Service of Process; Expectation of Privacy; Consumer Expectation of Privacy. Amend RSA 507-H:4, I(e) to read as follows: 

 (e) Opt-out of the processing of the personal data for [purposes of targeted advertising, the sale of personal data] any purpose, except as provided in RSA 507-H:6 and RSA 507-H:10, or profiling in furtherance of solely automated decisions that produce legal or similarly significant effects concerning the consumer. 

 2 New Subparagraph; Actions, Process, and Service of Process; Expectation of Privacy; Consumer Expectation of Privacy. Amend RSA 507-H:4, III by inserting after subparagraph (e) the following new subparagraph: 

 (f) A controller or registered data broker that receives a request for deletion of data or opt-out of data processing shall notify the consumer, by secure and reliable means, within 15 days of completing the request, confirming that such personal data has been deleted and/or that the consumer has been opted out of any future collection or processing. 

 3 New Subdivision; Registration of Data Brokers. Amend RSA 507-H by inserting after section 12 the following new subdivision: 

Registration of Data Brokers

 507-H:13 Definitions. In this subdivision: 

 I. "Data broker" means a controller or processor that knowingly collects, aggregates, or sells personal data of consumers who are residents of this state, who do not have a direct business relationship with the controller or processor, and who derive more than 25 percent of their gross revenue from the sale of personal data. 

 II. "Digital service" means a website, an application, a program, or software that collects or processes personal identifying information with Internet connectivity. 

 III. "Digital service provider" means a person who: 

 (a) Owns or operates a digital service; 

 (b) Determines the purpose of collecting and processing the personal identifying information of users of the digital service; and

 (c) Determines the means used to collect and process the personal identifying information of users of the digital service. 

 IV. "Known minor" means a person that a digital service provider knows to be a minor. 

 V. "Minor" means a child who is younger than 18 years of age who has not had the disabilities of minority removed for general purposes. 

 VI. "Personal identifying information" means any information, including sensitive information, that is linked or reasonably linkable to an identified or identifiable individual. Personal identifying information shall include pseudonymous information when the information is used by a controller or processor in conjunction with additional information that reasonably links the information to an identified or identifiable individual.

 VII. "Verified parent" means the parent or guardian of a known minor whose identity and relationship to the minor have been verified by a digital service provider. 

 507-H:14 Registration. 

 I. To conduct business in this state, a data broker to which this chapter applies shall register with the secretary of state by filing a registration statement and paying a registration fee of $300. 

 II. The registration statement shall include: 

 (a) The legal name of the data broker;

 (b) A contact person and the primary physical address, e-mail address, telephone number, and Internet website address for the data broker;

 (c) A description of the categories of data the data broker processes and transfers;

 (d) A statement of whether or not the data broker implements a purchaser credentialing process;

 (e) If the data broker has actual knowledge that the data broker possesses personal data of a known child:

 (1) A statement detai