On January 18, the New Hampshire legislature passed SB255, which will make New Hampshire the 14th U.S. state to pass a consumer data privacy law if the governor signs the bill into law.

While New Jersey's recently passed SB332, discussed further here, shares similarities with the California Consumer Privacy Act, the New Hampshire bill more closely tracks the version of the Connecticut Data Privacy Act (CTDA) passed in 2022.

Key features of SB255 include:

• Applicability: the bill has relatively low consumer applicability thresholds and would apply to entities controlling or processing the personal data of 35,000 unique consumers or controlling or processing the personal data of 10,000 unique consumers and deriving more than 25% of their gross revenue from the sale of personal data.
• Consumer Rights: the bill guarantees New Hampshire consumers certain rights, including the rights to: (i) know what personal data is being collected; (ii) access that data; (iii) have data provided in a portable format; (iv) have personal data deleted; (v)  correct inaccuracies; and (vi) the right to opt-out of the sale of personal data, targeted advertising and certain types of profiling. 
• Role of the Secretary of State: the Secretary of State is required to establish secure and reliable means for consumers to exercise their rights and provide standards for privacy notices.
• Right to Cure: the bill provides a 60-day right to cure noncompliance but the cure period sunsets after 12 months.
• Compliance with Other Law: where an individual or entity is subject to both SB255 and other laws regarding third-party providers of information, to the extent there is a direct conflict between the two, the individual or entity shall comply with the law that provides the greater measure of protection to individuals. Importantly, it goes on to clarify that an opt-in mechanism provides greater protection than an opt-out mechanism.

Assuming the bill passes through the required procedural formalities and becomes law, its effective date is January 1, 2025.