• by Wendy Davis  @wendyndavis, January 22, 2024

Lawmakers in New Hampshire have approved a privacy bill that, if signed into law, will give residents the right to reject online behavioral ad targeting.

The bill, passed last week, awaits signature by Governor Chris Sununu. If enacted, New Hampshire will join more than a dozen other states in enacting comprehensive privacy legislation.

As with other recent state privacy bills, the measure (Senate Bill 255) essentially defines targeted advertising as ads based on people's activity over time and across non-affiliated websites. That definition excludes ads served based on first-party data.

In addition to giving residents the right to opt out of ad targeting, the measure also requires companies to obtain opt-in consent before processing residents' “sensitive” data -- including information about consumer's race, ethnicity, religion, health condition, sexual orientation, immigration status, and precise location.

The measure additionally prohibits companies from processing “personal” data -- meaning non-public information that's linked or “reasonably” linkable to individuals -- in ways that would violate federal or state anti-discrimination laws.

Another provision would prohibit companies from knowingly serving targeted ads to teens between the ages of 13 and 15 without their consent.

Like privacy laws in at least eight other states, the New Hampshire bill requires companies to allow people to reject targeted advertising via a universal mechanism like the Global Privacy Control. Such mechanisms allow people to opt out of all targeted advertising, as opposed to opting out company-by-company.

The New Hampshire law specifies requirements for this type of mechanism, including that it can't “unfairly disadvantage” other data controllers or be turned on by default. The mechanism also must allow controllers to determine whether consumers are state residents, and whether they have made a “legitimate” opt-out request.

The bill calls for enforcement by the state attorney general.

If enacted, the law will take effect in January 2025.

Separately, New Jersey Governor Phil Murphy signed that state's new privacy law last week.

“I am heartened that consumers will now be given a say in the distribution of their personal information, and I have full confidence that the Attorney General will fully and appropriately enforce the law to ensure a transparent process that allows consumers to maintain control over how their personal data is collected and used,” Murphy stated at the time.

Ad organizations unsuccessfully urged Murphy to veto the measure, arguing more time was needed to study it.

“Several significant and material changes were made to the bill in the last few days of the legislative session, leaving affected stakeholders and consumers little to no time to provide input on substantive edits prior to the bill’s passage,” the Association of National Advertisers, American Association of Advertising Agencies, Interactive Advertising Bureau, American Advertising Federation, and Digital Advertising Alliance said in a January 10 letter to the governor.