I–VI 359-C:23 Exclusions. This subdivision shall not apply to: I. A federal, state, tribal, or local government entity in the ordinary course of its operation; II. Protected health information that a covered entity or business associate processes in accordance with, or documents that a covered entity or business associate creates for the purpose of complying with, HIPAA; III. Information used only for public health activities and purposes described in 45 C.F.R. § 164.512; IV. Information that identifies a consumerConsumer"Consumer" means an individual who is a resident of the state. "Consumer" shall not include an individual acting in a commercial or employment context or as an employee, owner, director, officer, or contractor of a company, partnership, sole proprietorship, nonprofit, or government agency whose communications or transactions with the covered business occur solely within the context of that individual's role with the company, partnership, sole proprietorship, nonprofit, or government agency.RSA 359-C:22, X in connection with: (a) Activities that are subject to the Federal Policy for the Protection of Human Subjects as set forth in 45 C.F.R. Part 46; (b) Research on human subjects undertaken in accordance with good clinical practice guidelines issued by the International Council for Harmonisation of Technical Requirements for Pharmaceuticals for Human Use; (c) Activities that are subject to the protections provided in 21 C.F.R. Part 50 and 21 C.F.R. Part 56; or (d) Research conducted in accordance with the requirements set forth in subparagraphs (a), (b), and (c) of this paragraph or otherwise in accordance with state or federal law; V. An entity whose primary purpose is journalism and that has a majority of its workforce consisting of individuals engaging in journalism; and VI. A financial institution subject to Title V of the Gramm-Leach-Bliley Act and regulations adopted to implement that act.

I–II 1 I. A covered businessCovered business"Covered business" means a sole proprietorship, partnership, limited liability company, corporation, association, other legal entity, or an affiliate thereof: (a) That conducts business in this state; (b) That generates a majority of its annual revenue from online services; (c) Whose online products, services, or features are reasonably likely to be accessed by a minor; (d) That collects consumers' personal data or has consumers' personal data collected on its behalf by a processor; and (e) That alone or jointly with others determines the purposes and means of the processing of consumers personal data.RSA 359-C:22, XI that processes a covered minorCovered minor"Covered minor" is a consumer who a covered business actually knows is a minor or labels as a minor pursuant to age assurance methods in rules adopted by the attorney general.RSA 359-C:22, XIII's data in any capacity owes a minimum duty of care to the covered minorCovered minor"Covered minor" is a consumer who a covered business actually knows is a minor or labels as a minor pursuant to age assurance methods in rules adopted by the attorney general.RSA 359-C:22, XIII. II. As used in this subdivision, "a minimum duty of care" means the use of the personal data of a covered minorCovered minor"Covered minor" is a consumer who a covered business actually knows is a minor or labels as a minor pursuant to age assurance methods in rules adopted by the attorney general.RSA 359-C:22, XIII and the design of an online service, product, or featureOnline service, product, or feature"Online service, product, or feature" means a digital product that is accessible to the public via the Internet, including a website or application, and does not mean any of the following: (a) Telecommunications service, as defined in 47 U.S.C. § 153; (b) A broadband Internet access service as defined in 47 C.F.R. § 54.400; or (c) The sale, delivery, or use of a physical product.RSA 359-C:22, XXI will not result in: (a) Reasonably foreseeable emotional distress to a covered minorCovered minor"Covered minor" is a consumer who a covered business actually knows is a minor or labels as a minor pursuant to age assurance methods in rules adopted by the attorney general.RSA 359-C:22, XIII; (b) Reasonably foreseeable compulsive use of the online service, product, or featureOnline service, product, or feature"Online service, product, or feature" means a digital product that is accessible to the public via the Internet, including a website or application, and does not mean any of the following: (a) Telecommunications service, as defined in 47 U.S.C. § 153; (b) A broadband Internet access service as defined in 47 C.F.R. § 54.400; or (c) The sale, delivery, or use of a physical product.RSA 359-C:22, XXI by a covered minorCovered minor"Covered minor" is a consumer who a covered business actually knows is a minor or labels as a minor pursuant to age assurance methods in rules adopted by the attorney general.RSA 359-C:22, XIII; or (c) Discrimination against a covered minorCovered minor"Covered minor" is a consumer who a covered business actually knows is a minor or labels as a minor pursuant to age assurance methods in rules adopted by the attorney general.RSA 359-C:22, XIII based upon race, ethnicity, sex, disability, sexual orientation, gender identity, gender expression, religion, or national origin.

III–IV III. The content of the media viewed by a covered minorCovered minor"Covered minor" is a consumer who a covered business actually knows is a minor or labels as a minor pursuant to age assurance methods in rules adopted by the attorney general.RSA 359-C:22, XIII shall not establish emotional distress, compulsive useCompulsive use"Compulsive use" means the repetitive use of a covered business's service that materially disrupts one or more major life activities of a minor, including sleeping, eating, learning, reading, concentrating, communicating, or working.RSA 359-C:22, IX, or discrimination, as those terms are used in subparagraph (2)(b) of this section. IV. Nothing in this section shall be construed to require a covered businessCovered business"Covered business" means a sole proprietorship, partnership, limited liability company, corporation, association, other legal entity, or an affiliate thereof: (a) That conducts business in this state; (b) That generates a majority of its annual revenue from online services; (c) Whose online products, services, or features are reasonably likely to be accessed by a minor; (d) That collects consumers' personal data or has consumers' personal data collected on its behalf by a processor; and (e) That alone or jointly with others determines the purposes and means of the processing of consumers personal data.RSA 359-C:22, XI to prevent or preclude a covered minorCovered minor"Covered minor" is a consumer who a covered business actually knows is a minor or labels as a minor pursuant to age assurance methods in rules adopted by the attorney general.RSA 359-C:22, XIII from accessing or viewing any piece of media or category of media.

I(a)–(h) 2 I. A covered businessCovered business"Covered business" means a sole proprietorship, partnership, limited liability company, corporation, association, other legal entity, or an affiliate thereof: (a) That conducts business in this state; (b) That generates a majority of its annual revenue from online services; (c) Whose online products, services, or features are reasonably likely to be accessed by a minor; (d) That collects consumers' personal data or has consumers' personal data collected on its behalf by a processor; and (e) That alone or jointly with others determines the purposes and means of the processing of consumers personal data.RSA 359-C:22, XI shall configure all default privacy settings provided to a covered minorCovered minor"Covered minor" is a consumer who a covered business actually knows is a minor or labels as a minor pursuant to age assurance methods in rules adopted by the attorney general.RSA 359-C:22, XIII through the online service, product, or featureOnline service, product, or feature"Online service, product, or feature" means a digital product that is accessible to the public via the Internet, including a website or application, and does not mean any of the following: (a) Telecommunications service, as defined in 47 U.S.C. § 153; (b) A broadband Internet access service as defined in 47 C.F.R. § 54.400; or (c) The sale, delivery, or use of a physical product.RSA 359-C:22, XXI to the highest level of privacy, including the following default settings: (a) Not displaying the existence of the covered minorCovered minor"Covered minor" is a consumer who a covered business actually knows is a minor or labels as a minor pursuant to age assurance methods in rules adopted by the attorney general.RSA 359-C:22, XIII's account on a social media platformSocial media platform"Social media platform" means a public or semipublic Internet-based service or application that is primarily intended to connect and allow a user to socially interact within such service or application and enables a user to: (1) Construct a public or semipublic profile for the purposes of signing into and using such service or application; (2) Populate a public list of other users with whom the user shares a social connection within such service or application; or (3) Create or post content that is viewable by other users, including content on message boards and in chat rooms, and that presents the user with content generated by other users. "Social media platform" does not mean a public or semipublic Internet-based service or application that: (1) Exclusively provides email or direct messaging services; or (2) Is used by and under the direction of an educational entity, including a learning management system or a student engagement program.RSA 359-C:22, XXVIII to any known adultKnown adult"Known adult" is a consumer who a covered business actually knows is an adult or labels as an adult pursuant to age assurance methods in rules adopted by the attorney general.RSA 359-C:22, XIX user unless the covered minorCovered minor"Covered minor" is a consumer who a covered business actually knows is a minor or labels as a minor pursuant to age assurance methods in rules adopted by the attorney general.RSA 359-C:22, XIII has expressly and unambiguously allowed a specific known adultKnown adult"Known adult" is a consumer who a covered business actually knows is an adult or labels as an adult pursuant to age assurance methods in rules adopted by the attorney general.RSA 359-C:22, XIX user to view their account or has expressly and unambiguously chosen to make their account's existence public; (b) Not displaying media created or posted by the covered minorCovered minor"Covered minor" is a consumer who a covered business actually knows is a minor or labels as a minor pursuant to age assurance methods in rules adopted by the attorney general.RSA 359-C:22, XIII on a social media platformSocial media platform"Social media platform" means a public or semipublic Internet-based service or application that is primarily intended to connect and allow a user to socially interact within such service or application and enables a user to: (1) Construct a public or semipublic profile for the purposes of signing into and using such service or application; (2) Populate a public list of other users with whom the user shares a social connection within such service or application; or (3) Create or post content that is viewable by other users, including content on message boards and in chat rooms, and that presents the user with content generated by other users. "Social media platform" does not mean a public or semipublic Internet-based service or application that: (1) Exclusively provides email or direct messaging services; or (2) Is used by and under the direction of an educational entity, including a learning management system or a student engagement program.RSA 359-C:22, XXVIII to any known adultKnown adult"Known adult" is a consumer who a covered business actually knows is an adult or labels as an adult pursuant to age assurance methods in rules adopted by the attorney general.RSA 359-C:22, XIX user unless the covered minorCovered minor"Covered minor" is a consumer who a covered business actually knows is a minor or labels as a minor pursuant to age assurance methods in rules adopted by the attorney general.RSA 359-C:22, XIII has expressly and unambiguously allowed a specific known adultKnown adult"Known adult" is a consumer who a covered business actually knows is an adult or labels as an adult pursuant to age assurance methods in rules adopted by the attorney general.RSA 359-C:22, XIX user to view their media or has expressly and unambiguously chosen to make their media publicly available; (c) Not permitting any known adultKnown adult"Known adult" is a consumer who a covered business actually knows is an adult or labels as an adult pursuant to age assurance methods in rules adopted by the attorney general.RSA 359-C:22, XIX users to like, comment on, or otherwise provide feedback on the covered minorCovered minor"Covered minor" is a consumer who a covered business actually knows is a minor or labels as a minor pursuant to age assurance methods in rules adopted by the attorney general.RSA 359-C:22, XIII's media on a social media platformSocial media platform"Social media platform" means a public or semipublic Internet-based service or application that is primarily intended to connect and allow a user to socially interact within such service or application and enables a user to: (1) Construct a public or semipublic profile for the purposes of signing into and using such service or application; (2) Populate a public list of other users with whom the user shares a social connection within such service or application; or (3) Create or post content that is viewable by other users, including content on message boards and in chat rooms, and that presents the user with content generated by other users. "Social media platform" does not mean a public or semipublic Internet-based service or application that: (1) Exclusively provides email or direct messaging services; or (2) Is used by and under the direction of an educational entity, including a learning management system or a student engagement program.RSA 359-C:22, XXVIII unless the covered minorCovered minor"Covered minor" is a consumer who a covered business actually knows is a minor or labels as a minor pursuant to age assurance methods in rules adopted by the attorney general.RSA 359-C:22, XIII has expressly and unambiguously allowed a specific known adultKnown adult"Known adult" is a consumer who a covered business actually knows is an adult or labels as an adult pursuant to age assurance methods in rules adopted by the attorney general.RSA 359-C:22, XIX user to do so; (d) Not permitting direct messaging on a social media platformSocial media platform"Social media platform" means a public or semipublic Internet-based service or application that is primarily intended to connect and allow a user to socially interact within such service or application and enables a user to: (1) Construct a public or semipublic profile for the purposes of signing into and using such service or application; (2) Populate a public list of other users with whom the user shares a social connection within such service or application; or (3) Create or post content that is viewable by other users, including content on message boards and in chat rooms, and that presents the user with content generated by other users. "Social media platform" does not mean a public or semipublic Internet-based service or application that: (1) Exclusively provides email or direct messaging services; or (2) Is used by and under the direction of an educational entity, including a learning management system or a student engagement program.RSA 359-C:22, XXVIII between the covered minorCovered minor"Covered minor" is a consumer who a covered business actually knows is a minor or labels as a minor pursuant to age assurance methods in rules adopted by the attorney general.RSA 359-C:22, XIII and any known adultKnown adult"Known adult" is a consumer who a covered business actually knows is an adult or labels as an adult pursuant to age assurance methods in rules adopted by the attorney general.RSA 359-C:22, XIX user unless the covered minorCovered minor"Covered minor" is a consumer who a covered business actually knows is a minor or labels as a minor pursuant to age assurance methods in rules adopted by the attorney general.RSA 359-C:22, XIII has expressly and unambiguously decided to allow direct messaging with a specific known adultKnown adult"Known adult" is a consumer who a covered business actually knows is an adult or labels as an adult pursuant to age assurance methods in rules adopted by the attorney general.RSA 359-C:22, XIX user; (e) Not displaying the covered minorCovered minor"Covered minor" is a consumer who a covered business actually knows is a minor or labels as a minor pursuant to age assurance methods in rules adopted by the attorney general.RSA 359-C:22, XIII's location to other users, unless the covered minorCovered minor"Covered minor" is a consumer who a covered business actually knows is a minor or labels as a minor pursuant to age assurance methods in rules adopted by the attorney general.RSA 359-C:22, XIII expressly and unambiguously shares their location with a specific user; (f) Not displaying the users connected to the covered minorCovered minor"Covered minor" is a consumer who a covered business actually knows is a minor or labels as a minor pursuant to age assurance methods in rules adopted by the attorney general.RSA 359-C:22, XIII on a social media platformSocial media platform"Social media platform" means a public or semipublic Internet-based service or application that is primarily intended to connect and allow a user to socially interact within such service or application and enables a user to: (1) Construct a public or semipublic profile for the purposes of signing into and using such service or application; (2) Populate a public list of other users with whom the user shares a social connection within such service or application; or (3) Create or post content that is viewable by other users, including content on message boards and in chat rooms, and that presents the user with content generated by other users. "Social media platform" does not mean a public or semipublic Internet-based service or application that: (1) Exclusively provides email or direct messaging services; or (2) Is used by and under the direction of an educational entity, including a learning management system or a student engagement program.RSA 359-C:22, XXVIII unless the covered minorCovered minor"Covered minor" is a consumer who a covered business actually knows is a minor or labels as a minor pursuant to age assurance methods in rules adopted by the attorney general.RSA 359-C:22, XIII expressly and unambiguously chooses to share the information with a specific user; (g) Disabling search engine indexing of the covered minorCovered minor"Covered minor" is a consumer who a covered business actually knows is a minor or labels as a minor pursuant to age assurance methods in rules adopted by the attorney general.RSA 359-C:22, XIII's account profile; and (h) Not sending push notifications to the covered minorsCovered minor"Covered minor" is a consumer who a covered business actually knows is a minor or labels as a minor pursuant to age assurance methods in rules adopted by the attorney general.RSA 359-C:22, XIII.

II(a)–(b) 3 II. A covered businessCovered business"Covered business" means a sole proprietorship, partnership, limited liability company, corporation, association, other legal entity, or an affiliate thereof: (a) That conducts business in this state; (b) That generates a majority of its annual revenue from online services; (c) Whose online products, services, or features are reasonably likely to be accessed by a minor; (d) That collects consumers' personal data or has consumers' personal data collected on its behalf by a processor; and (e) That alone or jointly with others determines the purposes and means of the processing of consumers personal data.RSA 359-C:22, XI shall not: (a) Provide a covered minorCovered minor"Covered minor" is a consumer who a covered business actually knows is a minor or labels as a minor pursuant to age assurance methods in rules adopted by the attorney general.RSA 359-C:22, XIII with a single setting that makes all of the default privacy settings less protective at once; or (b) Request or prompt a covered minorCovered minor"Covered minor" is a consumer who a covered business actually knows is a minor or labels as a minor pursuant to age assurance methods in rules adopted by the attorney general.RSA 359-C:22, XIII to make their privacy settings less protective, unless the change is strictly necessary for the covered minorCovered minor"Covered minor" is a consumer who a covered business actually knows is a minor or labels as a minor pursuant to age assurance methods in rules adopted by the attorney general.RSA 359-C:22, XIII to access a service or feature they have expressly and unambiguously requested.

III(a)–(b) 4 III. A covered businessCovered business"Covered business" means a sole proprietorship, partnership, limited liability company, corporation, association, other legal entity, or an affiliate thereof: (a) That conducts business in this state; (b) That generates a majority of its annual revenue from online services; (c) Whose online products, services, or features are reasonably likely to be accessed by a minor; (d) That collects consumers' personal data or has consumers' personal data collected on its behalf by a processor; and (e) That alone or jointly with others determines the purposes and means of the processing of consumers personal data.RSA 359-C:22, XI shall: (a) Provide a prominent, accessible, and responsive tool to allow a covered minorCovered minor"Covered minor" is a consumer who a covered business actually knows is a minor or labels as a minor pursuant to age assurance methods in rules adopted by the attorney general.RSA 359-C:22, XIII to request the covered minorCovered minor"Covered minor" is a consumer who a covered business actually knows is a minor or labels as a minor pursuant to age assurance methods in rules adopted by the attorney general.RSA 359-C:22, XIII's account on a social media platformSocial media platform"Social media platform" means a public or semipublic Internet-based service or application that is primarily intended to connect and allow a user to socially interact within such service or application and enables a user to: (1) Construct a public or semipublic profile for the purposes of signing into and using such service or application; (2) Populate a public list of other users with whom the user shares a social connection within such service or application; or (3) Create or post content that is viewable by other users, including content on message boards and in chat rooms, and that presents the user with content generated by other users. "Social media platform" does not mean a public or semipublic Internet-based service or application that: (1) Exclusively provides email or direct messaging services; or (2) Is used by and under the direction of an educational entity, including a learning management system or a student engagement program.RSA 359-C:22, XXVIII be unpublished or deleted; and (b) Honor that request not later than 15 days after a covered businessCovered business"Covered business" means a sole proprietorship, partnership, limited liability company, corporation, association, other legal entity, or an affiliate thereof: (a) That conducts business in this state; (b) That generates a majority of its annual revenue from online services; (c) Whose online products, services, or features are reasonably likely to be accessed by a minor; (d) That collects consumers' personal data or has consumers' personal data collected on its behalf by a processor; and (e) That alone or jointly with others determines the purposes and means of the processing of consumers personal data.RSA 359-C:22, XI receives the request.

I–IV 5 359-C:26 Transparency. A covered businessCovered business"Covered business" means a sole proprietorship, partnership, limited liability company, corporation, association, other legal entity, or an affiliate thereof: (a) That conducts business in this state; (b) That generates a majority of its annual revenue from online services; (c) Whose online products, services, or features are reasonably likely to be accessed by a minor; (d) That collects consumers' personal data or has consumers' personal data collected on its behalf by a processor; and (e) That alone or jointly with others determines the purposes and means of the processing of consumers personal data.RSA 359-C:22, XI shall prominently and clearly provide on their website or mobile application: I. The covered businessCovered business"Covered business" means a sole proprietorship, partnership, limited liability company, corporation, association, other legal entity, or an affiliate thereof: (a) That conducts business in this state; (b) That generates a majority of its annual revenue from online services; (c) Whose online products, services, or features are reasonably likely to be accessed by a minor; (d) That collects consumers' personal data or has consumers' personal data collected on its behalf by a processor; and (e) That alone or jointly with others determines the purposes and means of the processing of consumers personal data.RSA 359-C:22, XI' privacy information, terms of service, policies, and community standards; II. The purpose of each algorithmic recommendation systemAlgorithmic recommendation system"Algorithmic recommendation system" means a system that uses an algorithm to select, filter, and arrange media on a covered business's website for the purpose of selecting, recommending, or prioritizing media for a user.RSA 359-C:22, V in use by the covered businessCovered business"Covered business" means a sole proprietorship, partnership, limited liability company, corporation, association, other legal entity, or an affiliate thereof: (a) That conducts business in this state; (b) That generates a majority of its annual revenue from online services; (c) Whose online products, services, or features are reasonably likely to be accessed by a minor; (d) That collects consumers' personal data or has consumers' personal data collected on its behalf by a processor; and (e) That alone or jointly with others determines the purposes and means of the processing of consumers personal data.RSA 359-C:22, XI; III. Inputs used by the algorithmic recommendation systemAlgorithmic recommendation system"Algorithmic recommendation system" means a system that uses an algorithm to select, filter, and arrange media on a covered business's website for the purpose of selecting, recommending, or prioritizing media for a user.RSA 359-C:22, V and how each input: (a) Is measured or determined; (b) Uses the personal dataPersonal data"Personal data" means any information, including derived data and unique identifiers, that is linked or reasonably linkable, alone or in combination with other information, to an identified or identifiable individual or to a device that identifies, is linked to, or is reasonably linkable to one or more identified or identifiable individuals in a household; and Personal data does not include de-identified data or publicly available information.RSA 359-C:22, XXII of covered minorsCovered minor"Covered minor" is a consumer who a covered business actually knows is a minor or labels as a minor pursuant to age assurance methods in rules adopted by the attorney general.RSA 359-C:22, XIII; (c) Influences the recommendation issued by the system; and (d) Is weighed relative to the other inputs reported in this paragraph; and IV. Descriptions, for every feature of the service that uses the personal dataPersonal data"Personal data" means any information, including derived data and unique identifiers, that is linked or reasonably linkable, alone or in combination with other information, to an identified or identifiable individual or to a device that identifies, is linked to, or is reasonably linkable to one or more identified or identifiable individuals in a household; and Personal data does not include de-identified data or publicly available information.RSA 359-C:22, XXII of covered minorsCovered minor"Covered minor" is a consumer who a covered business actually knows is a minor or labels as a minor pursuant to age assurance methods in rules adopted by the attorney general.RSA 359-C:22, XIII, of: (a) The purpose of the service feature; (b) The personal dataPersonal data"Personal data" means any information, including derived data and unique identifiers, that is linked or reasonably linkable, alone or in combination with other information, to an identified or identifiable individual or to a device that identifies, is linked to, or is reasonably linkable to one or more identified or identifiable individuals in a household; and Personal data does not include de-identified data or publicly available information.RSA 359-C:22, XXII collected by the service feature; (c) The personal dataPersonal data"Personal data" means any information, including derived data and unique identifiers, that is linked or reasonably linkable, alone or in combination with other information, to an identified or identifiable individual or to a device that identifies, is linked to, or is reasonably linkable to one or more identified or identifiable individuals in a household; and Personal data does not include de-identified data or publicly available information.RSA 359-C:22, XXII used by the service feature; (d) How the personal dataPersonal data"Personal data" means any information, including derived data and unique identifiers, that is linked or reasonably linkable, alone or in combination with other information, to an identified or identifiable individual or to a device that identifies, is linked to, or is reasonably linkable to one or more identified or identifiable individuals in a household; and Personal data does not include de-identified data or publicly available information.RSA 359-C:22, XXII is used by the service feature; (e) Any personal dataPersonal data"Personal data" means any information, including derived data and unique identifiers, that is linked or reasonably linkable, alone or in combination with other information, to an identified or identifiable individual or to a device that identifies, is linked to, or is reasonably linkable to one or more identified or identifiable individuals in a household; and Personal data does not include de-identified data or publicly available information.RSA 359-C:22, XXII transferred to or shared with a processorProcessor"Processor" means a person who processes personal data on behalf of: (a) A covered business; (b) Another processor; or (c) A federal, state, tribal, or local government entity.RSA 359-C:22, XXIV or third party by the service feature, the identity of the processorProcessor"Processor" means a person who processes personal data on behalf of: (a) A covered business; (b) Another processor; or (c) A federal, state, tribal, or local government entity.RSA 359-C:22, XXIV or third party, and the purpose of the transfer or sharing; and (f) How long the personal dataPersonal data"Personal data" means any information, including derived data and unique identifiers, that is linked or reasonably linkable, alone or in combination with other information, to an identified or identifiable individual or to a device that identifies, is linked to, or is reasonably linkable to one or more identified or identifiable individuals in a household; and Personal data does not include de-identified data or publicly available information.RSA 359-C:22, XXII is retained.

I–II 6 359-C:27 Prohibited Data and Design Practices. A covered businessCovered business"Covered business" means a sole proprietorship, partnership, limited liability company, corporation, association, other legal entity, or an affiliate thereof: (a) That conducts business in this state; (b) That generates a majority of its annual revenue from online services; (c) Whose online products, services, or features are reasonably likely to be accessed by a minor; (d) That collects consumers' personal data or has consumers' personal data collected on its behalf by a processor; and (e) That alone or jointly with others determines the purposes and means of the processing of consumers personal data.RSA 359-C:22, XI shall not: I. Collect, sell, share, or retain any personal data of a covered minorCovered minor"Covered minor" is a consumer who a covered business actually knows is a minor or labels as a minor pursuant to age assurance methods in rules adopted by the attorney general.RSA 359-C:22, XIII that is not necessary to provide an online service, product, or featureOnline service, product, or feature"Online service, product, or feature" means a digital product that is accessible to the public via the Internet, including a website or application, and does not mean any of the following: (a) Telecommunications service, as defined in 47 U.S.C. § 153; (b) A broadband Internet access service as defined in 47 C.F.R. § 54.400; or (c) The sale, delivery, or use of a physical product.RSA 359-C:22, XXI with which the covered minorCovered minor"Covered minor" is a consumer who a covered business actually knows is a minor or labels as a minor pursuant to age assurance methods in rules adopted by the attorney general.RSA 359-C:22, XIII is actively and knowingly engaged; II. Use previously collected personal data of a covered minorCovered minor"Covered minor" is a consumer who a covered business actually knows is a minor or labels as a minor pursuant to age assurance methods in rules adopted by the attorney general.RSA 359-C:22, XIII for any purpose other than a purpose for which the personal dataPersonal data"Personal data" means any information, including derived data and unique identifiers, that is linked or reasonably linkable, alone or in combination with other information, to an identified or identifiable individual or to a device that identifies, is linked to, or is reasonably linkable to one or more identified or identifiable individuals in a household; and Personal data does not include de-identified data or publicly available information.RSA 359-C:22, XXII was collected, unless necessary to comply with any obligation under this chapter;

III 7 III. Permit any individual, including a parent or guardian of a covered minorCovered minor"Covered minor" is a consumer who a covered business actually knows is a minor or labels as a minor pursuant to age assurance methods in rules adopted by the attorney general.RSA 359-C:22, XIII, to monitor the online activity of a covered minorCovered minor"Covered minor" is a consumer who a covered business actually knows is a minor or labels as a minor pursuant to age assurance methods in rules adopted by the attorney general.RSA 359-C:22, XIII or to track the location of the covered minorCovered minor"Covered minor" is a consumer who a covered business actually knows is a minor or labels as a minor pursuant to age assurance methods in rules adopted by the attorney general.RSA 359-C:22, XIII without providing a conspicuous signal to the covered minorCovered minor"Covered minor" is a consumer who a covered business actually knows is a minor or labels as a minor pursuant to age assurance methods in rules adopted by the attorney general.RSA 359-C:22, XIII when the covered minorCovered minor"Covered minor" is a consumer who a covered business actually knows is a minor or labels as a minor pursuant to age assurance methods in rules adopted by the attorney general.RSA 359-C:22, XIII is being monitored or tracked;

IV(a)–(c) 8 IV. Use the personal data of a covered minorCovered minor"Covered minor" is a consumer who a covered business actually knows is a minor or labels as a minor pursuant to age assurance methods in rules adopted by the attorney general.RSA 359-C:22, XIII to select, recommend, or prioritize media for the covered minorCovered minor"Covered minor" is a consumer who a covered business actually knows is a minor or labels as a minor pursuant to age assurance methods in rules adopted by the attorney general.RSA 359-C:22, XIII, unless the personal dataPersonal data"Personal data" means any information, including derived data and unique identifiers, that is linked or reasonably linkable, alone or in combination with other information, to an identified or identifiable individual or to a device that identifies, is linked to, or is reasonably linkable to one or more identified or identifiable individuals in a household; and Personal data does not include de-identified data or publicly available information.RSA 359-C:22, XXII is: (a) The covered minorCovered minor"Covered minor" is a consumer who a covered business actually knows is a minor or labels as a minor pursuant to age assurance methods in rules adopted by the attorney general.RSA 359-C:22, XIII's express and unambiguous request to receive: (1) Media from a specific account, feed, or user, or to receive more or less media from that account, feed, or user; (2) A specific category of media, such as "cat videos" or "breaking news," or to see more or less of that category of media; or (3) More or less media with similar characteristics as the media they are currently viewing; (b) User-selected privacy or accessibility settings; or (c) A search query, provided the search query is only used to select and prioritize media in response to the search;

V 9 V. Send push notifications to a covered minorCovered minor"Covered minor" is a consumer who a covered business actually knows is a minor or labels as a minor pursuant to age assurance methods in rules adopted by the attorney general.RSA 359-C:22, XIII between 12:00 a.m. (midnight) and 6:00 a.m.

I–VI 10 359-C:28 Age AssuranceAge assurance"Age assurance" encompasses a range of methods used to determine, estimate, or communicate the age or an age range of an online user.RSA 359-C:22, III Privacy. During the process of conducting age assuranceAge assurance"Age assurance" encompasses a range of methods used to determine, estimate, or communicate the age or an age range of an online user.RSA 359-C:22, III, covered businessesCovered business"Covered business" means a sole proprietorship, partnership, limited liability company, corporation, association, other legal entity, or an affiliate thereof: (a) That conducts business in this state; (b) That generates a majority of its annual revenue from online services; (c) Whose online products, services, or features are reasonably likely to be accessed by a minor; (d) That collects consumers' personal data or has consumers' personal data collected on its behalf by a processor; and (e) That alone or jointly with others determines the purposes and means of the processing of consumers personal data.RSA 359-C:22, XI and processorsProcessor"Processor" means a person who processes personal data on behalf of: (a) A covered business; (b) Another processor; or (c) A federal, state, tribal, or local government entity.RSA 359-C:22, XXIV shall: I. Only collect personal data of a user that is strictly necessary for age assuranceAge assurance"Age assurance" encompasses a range of methods used to determine, estimate, or communicate the age or an age range of an online user.RSA 359-C:22, III; II. Immediately upon determining whether a user is a covered minorCovered minor"Covered minor" is a consumer who a covered business actually knows is a minor or labels as a minor pursuant to age assurance methods in rules adopted by the attorney general.RSA 359-C:22, XIII, delete any personal dataPersonal data"Personal data" means any information, including derived data and unique identifiers, that is linked or reasonably linkable, alone or in combination with other information, to an identified or identifiable individual or to a device that identifies, is linked to, or is reasonably linkable to one or more identified or identifiable individuals in a household; and Personal data does not include de-identified data or publicly available information.RSA 359-C:22, XXII collected of that user for age assuranceAge assurance"Age assurance" encompasses a range of methods used to determine, estimate, or communicate the age or an age range of an online user.RSA 359-C:22, III, except the determination of the user's age range; III. Not use any personal data of a user collected for age assuranceAge assurance"Age assurance" encompasses a range of methods used to determine, estimate, or communicate the age or an age range of an online user.RSA 359-C:22, III for any other purpose; IV. Not combine personal data of a user collected for age assuranceAge assurance"Age assurance" encompasses a range of methods used to determine, estimate, or communicate the age or an age range of an online user.RSA 359-C:22, III, except the determination of the user's age range, with any other personal data of the user; V. Not disclose personal data of a user collected for age assuranceAge assurance"Age assurance" encompasses a range of methods used to determine, estimate, or communicate the age or an age range of an online user.RSA 359-C:22, III to a third party that is not a processorProcessor"Processor" means a person who processes personal data on behalf of: (a) A covered business; (b) Another processor; or (c) A federal, state, tribal, or local government entity.RSA 359-C:22, XXIV; and VI. Implement a review process to allow users to appeal their age determination.

I I. The attorney general shall, on or before January 1, 2027, adopt rules pursuant to RSA 359-C:27 that prohibits data processing or design practices of a covered businessCovered business"Covered business" means a sole proprietorship, partnership, limited liability company, corporation, association, other legal entity, or an affiliate thereof: (a) That conducts business in this state; (b) That generates a majority of its annual revenue from online services; (c) Whose online products, services, or features are reasonably likely to be accessed by a minor; (d) That collects consumers' personal data or has consumers' personal data collected on its behalf by a processor; and (e) That alone or jointly with others determines the purposes and means of the processing of consumers personal data.RSA 359-C:22, XI that, in the opinion of the attorney general, lead to compulsive useCompulsive use"Compulsive use" means the repetitive use of a covered business's service that materially disrupts one or more major life activities of a minor, including sleeping, eating, learning, reading, concentrating, communicating, or working.RSA 359-C:22, IX or subvert or impair user autonomy, decision making, or choice during the use of an online service, product, or feature of the covered businessCovered business"Covered business" means a sole proprietorship, partnership, limited liability company, corporation, association, other legal entity, or an affiliate thereof: (a) That conducts business in this state; (b) That generates a majority of its annual revenue from online services; (c) Whose online products, services, or features are reasonably likely to be accessed by a minor; (d) That collects consumers' personal data or has consumers' personal data collected on its behalf by a processor; and (e) That alone or jointly with others determines the purposes and means of the processing of consumers personal data.RSA 359-C:22, XI. The attorney general shall, at least once every 2 years, review and update these rules as necessary to keep pace with emerging technology.

II II. The attorney general shall, on or before January 1, 2027, adopt rules pursuant to RSA 359-C:28, II that identify commercially reasonable and technically feasible methods for covered businessesCovered business"Covered business" means a sole proprietorship, partnership, limited liability company, corporation, association, other legal entity, or an affiliate thereof: (a) That conducts business in this state; (b) That generates a majority of its annual revenue from online services; (c) Whose online products, services, or features are reasonably likely to be accessed by a minor; (d) That collects consumers' personal data or has consumers' personal data collected on its behalf by a processor; and (e) That alone or jointly with others determines the purposes and means of the processing of consumers personal data.RSA 359-C:22, XI and processorsProcessor"Processor" means a person who processes personal data on behalf of: (a) A covered business; (b) Another processor; or (c) A federal, state, tribal, or local government entity.RSA 359-C:22, XXIV to determine if a user is a covered minorCovered minor"Covered minor" is a consumer who a covered business actually knows is a minor or labels as a minor pursuant to age assurance methods in rules adopted by the attorney general.RSA 359-C:22, XIII, describing appropriate review processes for users appealing their age designations, and providing any additional privacy protections for age assuranceAge assurance"Age assurance" encompasses a range of methods used to determine, estimate, or communicate the age or an age range of an online user.RSA 359-C:22, III data. The attorney general shall periodically review and update these rules as necessary to keep pace with emerging technology. In adopting these rules, the attorney general shall: (a) Prioritize user privacy and accessibility over the accuracy of age assuranceAge assurance"Age assurance" encompasses a range of methods used to determine, estimate, or communicate the age or an age range of an online user.RSA 359-C:22, III methods; and (b) Consider: (1) The size, financial resources, and technical capabilities of covered businessesCovered business"Covered business" means a sole proprietorship, partnership, limited liability company, corporation, association, other legal entity, or an affiliate thereof: (a) That conducts business in this state; (b) That generates a majority of its annual revenue from online services; (c) Whose online products, services, or features are reasonably likely to be accessed by a minor; (d) That collects consumers' personal data or has consumers' personal data collected on its behalf by a processor; and (e) That alone or jointly with others determines the purposes and means of the processing of consumers personal data.RSA 359-C:22, XI and processorsProcessor"Processor" means a person who processes personal data on behalf of: (a) A covered business; (b) Another processor; or (c) A federal, state, tribal, or local government entity.RSA 359-C:22, XXIV; (2) The costs and effectiveness of available age assuranceAge assurance"Age assurance" encompasses a range of methods used to determine, estimate, or communicate the age or an age range of an online user.RSA 359-C:22, III methods; (3) The impact of age assuranceAge assurance"Age assurance" encompasses a range of methods used to determine, estimate, or communicate the age or an age range of an online user.RSA 359-C:22, III methods on users' safety, utility, and experience; (4) Whether and to what extent transparency measures would increase consumerConsumer"Consumer" means an individual who is a resident of the state. "Consumer" shall not include an individual acting in a commercial or employment context or as an employee, owner, director, officer, or contractor of a company, partnership, sole proprietorship, nonprofit, or government agency whose communications or transactions with the covered business occur solely within the context of that individual's role with the company, partnership, sole proprietorship, nonprofit, or government agency.RSA 359-C:22, X trust in an age assuranceAge assurance"Age assurance" encompasses a range of methods used to determine, estimate, or communicate the age or an age range of an online user.RSA 359-C:22, III method; and (5) The efficacy of requiring covered businessesCovered business"Covered business" means a sole proprietorship, partnership, limited liability company, corporation, association, other legal entity, or an affiliate thereof: (a) That conducts business in this state; (b) That generates a majority of its annual revenue from online services; (c) Whose online products, services, or features are reasonably likely to be accessed by a minor; (d) That collects consumers' personal data or has consumers' personal data collected on its behalf by a processor; and (e) That alone or jointly with others determines the purposes and means of the processing of consumers personal data.RSA 359-C:22, XI and processorsProcessor"Processor" means a person who processes personal data on behalf of: (a) A covered business; (b) Another processor; or (c) A federal, state, tribal, or local government entity.RSA 359-C:22, XXIV to: (i) Use previously collected data to determine user age; (ii) Adopt interoperable age assuranceAge assurance"Age assurance" encompasses a range of methods used to determine, estimate, or communicate the age or an age range of an online user.RSA 359-C:22, III methods; and (iii) Provide users with multiple options for age assuranceAge assurance"Age assurance" encompasses a range of methods used to determine, estimate, or communicate the age or an age range of an online user.RSA 359-C:22, III.

III III. The attorney general shall adopt rules pursuant to RSA 359-C:30 relative to the enforcement of this subdivision. Such rulemaking authority shall include the ability to conduct civil investigations, bring civil actions, and enter into assurances of discontinuance.

I I. A covered businessCovered business"Covered business" means a sole proprietorship, partnership, limited liability company, corporation, association, other legal entity, or an affiliate thereof: (a) That conducts business in this state; (b) That generates a majority of its annual revenue from online services; (c) Whose online products, services, or features are reasonably likely to be accessed by a minor; (d) That collects consumers' personal data or has consumers' personal data collected on its behalf by a processor; and (e) That alone or jointly with others determines the purposes and means of the processing of consumers personal data.RSA 359-C:22, XI or processorProcessor"Processor" means a person who processes personal data on behalf of: (a) A covered business; (b) Another processor; or (c) A federal, state, tribal, or local government entity.RSA 359-C:22, XXIV that violates this subdivision or rules adopted pursuant to this subdivision commits an unfair or deceptive act in trade or commerce in violation of RSA 358-A:2.

II–IV II. Nothing in this subdivision shall be interpreted or construed to: (a) Impose liability in a manner that is inconsistent with 47 U.S.C. section 230; or (b) Prevent or preclude any covered minorCovered minor"Covered minor" is a consumer who a covered business actually knows is a minor or labels as a minor pursuant to age assurance methods in rules adopted by the attorney general.RSA 359-C:22, XIII from deliberately or independently searching for, or specifically requesting, any media. III. Nothing in this subdivision may be construed to infringe on the existing rights and freedoms of covered minorsCovered minor"Covered minor" is a consumer who a covered business actually knows is a minor or labels as a minor pursuant to age assurance methods in rules adopted by the attorney general.RSA 359-C:22, XIII or be construed to discriminate against the covered minorsCovered minor"Covered minor" is a consumer who a covered business actually knows is a minor or labels as a minor pursuant to age assurance methods in rules adopted by the attorney general.RSA 359-C:22, XIII based on race, ethnicity, sex, disability, sexual orientation, gender identity, gender expression, religion, or national origin. IV. If any provision of this subdivision or the application thereof to any person or circumstance is held invalid, the invalidity does not affect other provisions or applications of the subdivision which can be given effect without the invalid provisions or applications, and to this end the provisions of the subdivision are severable.