79%
of New Hampshire's 19 requirements are already met by California (CA). Here is what NHDPA adds, biggest gaps first.
ThresholdsWho it coversBig gap
CA0 For-profit businesses with gross revenue over $26,625,000 (2025 adjusted), or buying/selling/sharing data of 100,000+ consumers or households, or 50%+ revenue from selling/sharing.
NHDPA adds2 35,000 unique consumers, or 10,000 consumers plus over 25% of gross revenue from selling personal data; payment-only data excluded.
RSA 507-H:2, I · source ↗
AppealsConsumers' rightsBig gap
CA0 No statutory appeal process for denied requests.
NHDPA adds2 Internal appeal decided within 60 days; denial must give a way to contact the Attorney General.
RSA 507-H:4, IV · source ↗
Sensitive dataSensitive data and minorsGap
CA0 Broad sensitive personal information list, including neural data, IDs and financial log-ins; consumers get a right to limit use rather than opt-in consent.
NHDPA adds1 Opt-in consent to process sensitive data (health, sex life, orientation, immigration, genetic, biometric, known child, precise geolocation).
RSA 507-H:1, XXVIII; 507-H:6, I(d) · source ↗
De-identified dataBusiness dutiesGap
CA2 Deidentified data requires reasonable measures, a public commitment not to reidentify, and contract flow-down to recipients.
NHDPA adds3 Public commitment, contract duties, oversight of recipients, and pseudonymous data exemption with separation.
RSA 507-H:9 · source ↗
Already covered by CA: Exemptions, Children and teens, Data minimization, Rights, Request deadline, Universal opt-out, Assessments, Processor contracts, Privacy notice, Loyalty programs, Who enforces, Cure period, Maximum penalty, Private action, Rulemaking.
A gap means NHDPA is more demanding than CA on that requirement, on our 0 to 3 scale (how we score). Read the cited section before acting. Not legal advice.
