Privacy Law Library

Student Online Personal Information

NH SOPIPA

Students · Children · Data security

New Hampshire's version of the student online privacy model bars K-12 education technology operators from targeted advertising, building student profiles, and selling or disclosing student information gathered through their services. Operators must secure student data and delete it at a school's request, while de-identified data may be used to improve educational products.

Where
New Hampshire
Citation
N.H. Rev. Stat. Ann. 189:68-a
Status
In force
In force since
2016-01-01
Enforced by
Not specified in the section
People can sue
No
Penalties
The section does not state a penalty or enforcement mechanism.
Applies to
  • Operators of websites, online services (including cloud services), online applications and mobile apps with actual knowledge that the service is used primarily for K-12 school purposes and was designed and marketed for K-12 school purposes
  • Does not apply to general-audience websites or apps

Rights it gives people

  • Delete a student's covered information when the school or district requests deletion of data under its control.RSA 189:68-a, II(b)(2)

Practices it requires

  • Do not engage in targeted advertising based on information acquired through the K-12 service, or use such information to amass a profile of a K-12 student.RSA 189:68-a, II(a)(1)-(2)
  • Do not sell, lease, rent, trade or otherwise make available a student's information (a merger or acquisition is allowed if the successor stays bound).RSA 189:68-a, II(a)(3)
  • Do not disclose protected information except to respond to or participate in judicial process.RSA 189:68-a, II(a)(4)

Security duties

  • Implement and maintain reasonable security procedures appropriate to the covered information.RSA 189:68-a, II(b)(1)

Sources

Checked against these sources on 2026-09-25 by research agent (Claude), primary sources.

Unverified: No enforcement provision appears in RSA 189:68-a; whether the Attorney General treats violations under RSA 358-A was not confirmed

Research reference, not legal advice.