New Hampshire Website Tracking, Privacy & Wiretap Litigation

Published by Crandall Consulting · Informational litigation intelligence · Last intelligence update: October 12, 2026

Lawsuits, demand letters, tracked matters, and reported claims are counted separately and are not interchangeable. Last intelligence update: October 12, 2026.

Current Landscape

The supplied data labels New Hampshire’s risk level as elevated and lists the New Hampshire Wiretapping Statute (N.H. Rev. Stat. § 570-A:2). It reports two lawsuits and no demand letters, but also reports zero tracked matters despite providing two case summaries. That inconsistency limits conclusions about the scope of tracking coverage. The broader technology inventory is not tied to specific allegations in the summaries and should not be treated as evidence that every listed tool is involved in these cases.

In Cancelmo v. Southern New Hampshire Medical Center, et al., the plaintiff brought a putative class action alleging that hospital-related defendants shared website interaction information with Google without consent, asserting claims under New Hampshire health-information and wiretap statutes. Her individual allegations concern unauthenticated public webpages. The defendants removed the case to federal court and moved to dismiss both claims, but the supplied excerpt does not disclose the disposition or establish a holding on standing or the merits.

In Branson v. Concord Hospital Inc. et al., a settlement website reports an $800,000 class action settlement concerning allegations that Concord web properties used third-party tracking technology that may have intercepted telecommunications or disclosed protected health information. The court has not decided the merits, and a final approval hearing is scheduled for November 3, 2026. The supplied record does not establish final approval.

Current Litigation Activity

Current litigation component: 19/100.

Important New Filings

• Branson v. Concord Hospital Inc. et al.

Current Filing & Litigation Trends

The two supplied case summaries share a focus on healthcare-related websites and alleged sharing or interception of information through third-party tracking. Cancelmo specifically identifies alleged sharing with Google. This limited record does not establish a filing trend, growth in litigation, activity across other sectors, or case-specific involvement of every technology in the inventory. The discrepancy between the lawsuit count and tracked-matter count should be resolved before publishing quantitative claims about coverage.

Precedent Landscape: What Courts Have Decided

Precedent component: 50/100. Litigation activity (volume) and precedential risk (authority of decisions) are measured separately — a high number of filings does not by itself indicate strong plaintiff-favorable binding precedent.

No decided precedent with a clear substantive direction is currently tracked.

A settlement is not a binding precedent, and a procedural dismissal (for example, for lack of standing) is not a holding that the underlying technology is lawful. Where courts disagree, that disagreement is reflected rather than resolved.

Current Laws & Relevant Statutes

• New Hampshire Wiretapping Statute — N.H. Rev. Stat. § 570-A:2 · all-party consent · private right of action

Regulatory Enforcement

Regulatory enforcement component: 0/100. Regulatory enforcement (agency investigations, sweeps, settlements, guidance, rulemaking) is tracked separately from private litigation and is never counted as a lawsuit.

No specific enforcement actions are itemized for this jurisdiction.

Agency Guidance

Regulatory trend: insufficient data.

Global Privacy Control / Opt-Out Signals

Currently required

GPC / universal opt-out exposure component: 80/100. This component reflects whether the state currently requires or recognizes universal opt-out preference signals (such as GPC) and related enforcement activity, and is a weighted input to the overall risk guideline. It describes the state's legal posture — never any individual website's behavior.

GPC / universal opt-out privacy rights are a different legal theory from wiretap / interception litigation, though both affect third-party website data flows.

Effective since: January 1, 2025.

Statutory baseline: New Hampshire Privacy Act (SB 255) (N.H. Rev. Stat. Ann. ch. 507-H).

GPC evidence confidence: 90%.

Learn more about Global Privacy Control → · How GPC posture is weighted in the risk guideline →

Changes Coming in the Next 24 Months

Forward-looking (24-month) component: 0/100. Enacted changes with future effective dates may affect a jurisdiction's forward-looking risk, but are not presented as currently enforceable.

Coming Into Effect (Enacted)

No enacted future-effective laws identified in our latest research cycle.

Legislation to Watch (Pending)

No pending website-privacy legislation identified for this jurisdiction in our latest research cycle.

Important Cases & Tracked Matters

Technologies Appearing in Claims

• Google Analytics
• Google AdWords remarketing
• Google Ads
• Google AdWords remarketing service
• Third-party website tracking technology
• Website pixels
• Geonetric
• biometric measurements
• precise geolocation
• automated profiling
• Instagram
• Facebook
• Algorithmic feeds
• Age assurance
• Push notifications
• Beauty filters
• Visible like counts
• Cookies
• Pixels
• Web beacons
• Tags
• Scripts
• Session-replay tools
• Heatmap tools
• Chat widgets

Historical Risk Guideline

What Businesses Should Review

Businesses may consider inventorying website analytics and advertising integrations, mapping the information transmitted to vendors, and comparing those flows with consent notices and privacy disclosures. For healthcare-related sites, review unauthenticated public pages as well as pages that may involve sensitive information. Chat, replay, heatmap, and other tools can be included in a broader technical review, but the supplied summaries do not establish that those tools were involved in these cases. Before publishing case-status updates, verify Cancelmo’s motion disposition and Branson’s final approval status, and reconcile the reported matter counts.

Data Quality

17 source(s), 8 primary; evidence is fresh.

Methodology & Limitations

Statistics on this page are generated by the Crandall Consulting litigation intelligence engine. Publicly available sources (court and government materials, recognized legal press, professional analysis, and industry reports) are discovered through automated web research, classified into a tiered source hierarchy, and reduced to structured facts with full source provenance. Risk guidelines and evidence-confidence scores are computed by a deterministic formula from those stored facts — never by an AI model directly (AI explains findings; it never assigns a score). Counts labeled "tracked" reflect matters identified in our source set and are not official court statistics.

The overall risk guideline is composed of six deterministically weighted components: statutory structure (25%), current litigation activity (25%), prior precedent (18%), GPC / universal opt-out posture (15%), regulatory enforcement (9%), and the forward-looking 24-month horizon (8%). When a state's GPC status is limited data, that component is excluded and the remaining weights are renormalized — limited data never reads as lower exposure. Current litigation activity is measured over recent windows (velocity), not lifetime volume, so a jurisdiction with high historical activity but declining current filings reflects that decline. Litigation activity (volume) and precedential risk (authority of decisions) are measured separately. Full details are on the methodology page.

Sources

• Chapter 507-H: Expectation of Privacy — New Hampshire General Court · Tier A (Primary authority)
• Utah Secures $12.2 Billion Settlement With Meta Over Child Safety Practices — Governor Spencer J. Cox · Tier A (Primary authority)
• Branson v. Concord Hospital Inc. et al. — Official Settlement Website — Branson v. Concord Hospital Settlement Administrator · Tier E (General web)
• Still Tracking, Still Suing: Website Privacy Litigation After SB 690 — Bass, Berry & Sims (via Mondaq) · Tier C (Professional analysis)
• Hutcheson et al v. Verogen, Inc., 3:2024cv01977 - Document 54 (S.D. Cal. 2026) — Justia — U.S. District Court for the Southern District of California · Tier A (Primary authority)
• Hutcheson et al. v. Verogen, Inc. — Order Granting in Part and Denying in Part Motion to Dismiss — U.S. District Court for the Southern District of California via Justia · Tier A (Primary authority)
• Hutcheson et al. v. Verogen, Inc.: Order Granting in Part and Denying in Part Defendants’ Motion to Dismiss the Second Amended Complaint — U.S. District Court for the Southern District of California / Justia · Tier A (Primary authority)
• Branson v. Concord Hospital Inc. et al. — Website Tracking Pixel Settlement — Court-authorized settlement website · Tier A (Primary authority)
• Cancelmo v. Southern New Hampshire Medical Center, et al. — Order on Motion to Dismiss, 2025 DNH 122 — U.S. District Court for the District of New Hampshire · Tier A (Primary authority)
• Still Tracking, Still Suing: Website Privacy Litigation After SB 690 — The Legal 500 · Tier C (Professional analysis)
• Global Privacy Control for Financial Services: A State-by-State Scope Test — RiskTemplates · Tier D (Industry data)
• Universal Opt-Out Mechanisms: Which States Require Them — CookieBeam · Tier D (Industry data)
• Universal Opt-Out Mechanism (UOOM) Compliance: What Every Business Needs to Know in 2026 — PrivacyLawMap · Tier D (Industry data)
• U.S. Cybersecurity and Data Privacy Review and Outlook – 2025 — Gibson, Dunn & Crutcher LLP · Tier E (General web)
• Wyden Letter to Attorneys General on Global Privacy Control — Office of U.S. Senator Ron Wyden · Tier A (Primary authority)
• SNHU Data Sharing Lawsuit: What Students Allege — LegalClarity · Tier E (General web)
• The US State Privacy Law Tracker for 2026: Twenty Laws, One Compliance Baseline — Consenteo · Tier C (Professional analysis)

All State Pages