New Hampshire Wiretap Act: Privacy Lawsuits, Tracking Pixels and Business Risk

A patient searches a hospital website for a specialist. A student signs into a university portal. A customer opens a support chat. Each interaction has a clear purpose, but the technology behind it may create another record or send information to a company the visitor never intended to contact.

New Hampshire’s wiretapping law has become part of the legal debate over those disclosures. A federal judge allowed a hospital website wiretap claim to proceed in September 2025. Two other hospital tracking cases reached settlement agreements, including an $800,000 proposed fund involving Concord Hospital. Litigation concerning Southern New Hampshire University’s student portal extends the discussion beyond healthcare.

For businesses, the issue is more specific than whether a website has cookies. It concerns the communication being recorded, the technology acquiring it, the parties involved and whether the relevant consent existed when acquisition occurred. A consent banner can help enforce an approved approach, but its appearance alone answers none of those questions.

This article continues Captain Compliance’s privacy lawsuit series covering CIPA, Pennsylvania’s WESCA, Illinois’s eavesdropping law, Ohio’s wiretap law, Washington’s RCW 9.73 and transaction-specific confidentiality restrictions. New Hampshire adds a useful example of why similar-looking state statutes can produce different results for the same category of website technology.

Case and settlement materials reviewed and accurate as of publishing Approval status is identified separately from the existence of a settlement agreement.

What New Hampshire’s wiretapping law actually covers

The statute is RSA Chapter 570-A, Wiretapping and Eavesdropping. Its principal prohibition, RSA 570-A:2, addresses willful interception, attempted interception and procuring another person to intercept telecommunications or oral communications without all parties’ consent, subject to the chapter’s exceptions. It also addresses willful use or disclosure with knowledge or reason to know that the communication was obtained through unlawful interception.

The law distinguishes willful conduct under its felony provision from knowing interception under its misdemeanor provision when the person recording is a participant or has one participant’s prior consent. New Hampshire therefore should not be approached as a state where a business can routinely authorize recording on behalf of every other participant.

Exceptions include specified carrier activities and particular emergency, public utility and law enforcement circumstances. They have conditions. A commercial website operator does not acquire an exception merely by describing analytics as useful to its business.

The definitions in RSA 570-A:1 are especially relevant online. Telecommunications encompass transfers of information through communications common-carrier facilities. Interception includes acquisition or recording through a qualifying device. The definition of contents extends to information about the parties’ identity and the communication’s existence, substance or meaning. Oral communications have an express reasonable-expectation limitation.

Those definitions make the exact data flow important. Counsel should identify whether the challenged material is a protected communication, what the software does to it and whether a statutory exclusion applies. A vendor name is a starting point for investigation, not a conclusion that its installation violates the law.

The civil remedy is separate from criminal enforcement

RSA 570-A:11 gives a civil cause of action to a person whose communication is unlawfully intercepted, disclosed or used. It provides actual damages with a liquidated minimum calculated at $100 for each day of violation or $1,000, whichever is greater, as well as punitive damages and reasonable attorney fees and litigation costs.

That formula is not a fixed $5,000 award for every website visit. Businesses should resist importing CIPA demand-letter arithmetic into New Hampshire. Liability, qualifying days, recoverable damages and any class treatment require their own analysis. Punitive damages are not an automatic addition to every claim.

The section also contains a complete defense for specified good-faith reliance on a court order or representations by designated prosecutors. A marketing vendor’s assurance that its product is “compliant” is not the same statutory defense. Legal review, implementation records and evidence about actual operation remain important even when the business relied on a reputable supplier.

The New Hampshire website cases businesses should know

The most directly relevant public materials concern healthcare websites and portals. They include both a judicial ruling and settlement agreements. These categories establish different things: a motion ruling determines whether claims can proceed under the applicable standard; a settlement resolves disputed claims under agreed terms.

Case	Disputed activity	Verified posture
Cancelmo v. Southern New Hampshire Medical Center, et al. D.N.H., No. 24-cv-245-SE	Google Analytics recording and sharing of hospital website interactions.	September 30, 2025 order allowed the wiretap count to proceed. No later final outcome verified here.
Branson v. Concord Hospital Inc., et al. Hillsborough Superior Court, No. 217-2024-CV-00295	Alleged interception or health-information disclosure through Google Analytics and Geonetric.	$800,000 proposed common fund. Final approval hearing scheduled November 3, 2026.
Fiorillo, et al. v. St. Joseph Hospital of Nashua, N.H. Hillsborough Superior Court, No. 226-2025-CV-00138	Alleged tracking involving patient information and MyChart users.	Agreement provides $50 per valid timely claim, with specified costs paid separately. Administrator lists September 14, 2026 approval hearing; final order not verified here.
Zeolla, et al. v. Southern New Hampshire University D.N.H., No. 1:25-cv-00541	Reported allegations of student-portal information shared with Google and TikTok.	Reviewed public docket records a May 26, 2026 dismissal motion. No later merits decision or settlement verified here.

Cancelmo: the wiretap claim survived even though another privacy claim did not

In Cancelmo, Opinion No. 2025 DNH 122, Judge Samantha D. Elliott found sufficient allegations under the interception and disclosure provisions. The plaintiff’s own allegations concerned public, unauthenticated webpages. The court accepted an inference of contemporaneous recording, rejected the proposed exclusion for “tracking devices” and declined to infer consent from website use.

The order also recognized New Hampshire’s broad contents definition. It dismissed the separate health-information marketing count without prejudice because the plaintiff-specific allegations were insufficient. These were pleading decisions, not findings that unlawful transmissions actually occurred. The wiretap analysis nevertheless gives website operators a concrete reason to examine recording and consent separately from whether data meets another statute’s health-information requirements.

Concord Hospital: an $800,000 proposed settlement

The official Concord settlement website identifies allegations under both the wiretapping statute and New Hampshire patient privacy law. The dispute names Concord Hospital, its Laconia and Franklin entities, and Capital Region Healthcare Corporation. Concord denies wrongdoing; the settlement does not resolve who was correct.

The administrator’s FAQ describes two settlement classes covering alleged interception or disclosure through the relevant web properties from May 9, 2021 through June 12, 2026. The agreement provides an $800,000 fund, with valid claims sharing the net amount after approved fees and other expenses. The November 3, 2026 final approval hearing remains future as of this article’s review.

For healthcare operators, a fund of that size puts the review of website integrations on the same management agenda as other material operational exposures. It does not establish that every visit generated protected health information or that every analytics deployment is unlawful. The appropriate response is to examine the actual configuration and the information involved.

St. Joseph Hospital: patient-portal allegations and a different settlement structure

The St. Joseph settlement agreement describes allegations that Microsoft tracking technologies captured health-related website activity and identifiers without informed consent. It identifies RSA 570-A among the asserted legal theories. St. Joseph denies the claims.

The official notice covers eligible MyChart users from January 1, 2023 through the applicable class period and provides $50 for each valid timely claim. Administration and specified court-approved costs are separate. The FAQ says counsel will seek up to $1.25 million in attorney fees and expenses; that requested amount is not a verified award or the total customer payout.

The administrator lists a September 14, 2026 final approval hearing. Although that date has passed, a final approval order was not verified for this article. The agreement should therefore be described through its documented terms rather than assumed to have produced payments.

A portal deserves its own technical review. The fact that a public marketing site and an authenticated account use the same domain or template does not mean they should use the same tracking configuration. Login status can change both the available information and what the visitor understands the interaction to involve.

Southern New Hampshire University: reported student-data allegations

New Hampshire Public Radio’s December 23, 2025 report described allegations that Google and TikTok tools on mySNHU transmitted student information, including academic and contact details. The university said it was reviewing the allegations and remained committed to protecting privacy.

The reviewed public docket records a consolidated complaint filed March 27, 2026 and a dismissal motion filed May 26. Its displayed update is not a complete current docket, and no subsequent merits ruling was verified here. The reported allegations should not be presented as established disclosures.

For universities and education platforms, the review extends beyond recruitment pages. Student dashboards, financial-aid workflows and course-related interfaces can expose information that has no reason to enter an advertising event. The data available inside an account should determine the tracking policy for that account, rather than inheriting the marketing website’s defaults.

The older decisions explain why consent depends on the function

New Hampshire’s Supreme Court addressed electronic recording well before modern pixels. Those decisions are useful because they focus on what participants intended and what the technology necessarily did. They are not blanket exemptions for contemporary analytics.

In State v. Lott, 152 N.H. 436 (2005), the court treated recording by an instant-messaging program as interception but found implicit consent to the relevant recording. Displaying the exchanged messages was an inherent function of the chosen communication medium, and preserving that visible history did not require extraordinary steps. The decision did not approve every possible separate archiving process.

The operational distinction is between a record necessary to deliver the interaction a person knowingly chose and an additional collection serving another purpose. A visible support conversation and an undisclosed advertising feed should be evaluated separately. Labeling both as “chat technology” obscures that difference.

Fischer v. Hooper, 143 N.H. 585 (1999), concerned recorded family telephone conversations. The court reversed and remanded for a new trial because the jury received an incorrect instruction about willfulness under RSA 570-A:2, I. It interpreted that requirement as intentional or reckless disregard for the lawfulness of the conduct, recognizing a genuine good-faith belief in legality. It also accepted that consent can be express or implied from conduct and circumstances.

That mental-state requirement belongs in the analysis of a claim. It is also a reason to document how a business reviewed a technology, what counsel advised and how the approved configuration was verified. An unsupported belief that a popular tool must be lawful offers a much weaker account than evidence of an informed implementation.

In Karch v. BayBank FSB (2002), the allegations involved a cordless telephone conversation intercepted by third parties and then used by the employer against an employee. The court allowed the relevant wiretap claims to proceed and reversed their dismissal against the bank. Its treatment of later use is a reminder to review downstream conduct, not only the initial acquisition. It was not a website case or a final liability determination.

Why the Massachusetts website decision does not settle the New Hampshire question

In Vita v. New England Baptist Hospital (October 24, 2024), the Massachusetts Supreme Judicial Court found ambiguity in applying its wiretap statute to the website browsing alleged there. Applying the rule of lenity, it reversed the orders denying dismissal. The allegations did not concern interception of private patient records or messages to providers, and the court recognized that other legal theories could raise different questions.

The neighboring states’ decisions illustrate why the statute’s words matter. New Hampshire defines telecommunications expressly in terms of information transfer through carrier facilities. A business should have counsel assess the applicable law rather than reuse an argument developed for a different state. A successful defense to one statute is not a technical certification for the underlying tracking configuration.

How New Hampshire compares with the other laws in this series

All-party consent is a useful initial label, but it does not explain protected communications, participant status, exceptions or the remedy. The following comparison identifies the practical question each statute raises. It does not substitute one state’s rules for another’s.

Law	Relevant distinction	Business implication
New Hampshire RSA 570-A	All-party consent framework, express telecommunications definition and broad contents definition.	Assess the communication, recording function and consent for the specific flow.
California CIPA § 631	Distinct prohibitions concerning wiretapping, learning communications in transit without consent and assistance with prohibited conduct.	Analyze the asserted provision and participant or third-party role; a generic CIPA label is insufficient.
Pennsylvania WESCA	The relevant exception permits interception with all parties’ prior consent.	Verify consent timing as well as the technology’s actual acquisition of communications.
Florida § 934.03	All parties’ prior consent is an express exception, alongside other specified exceptions.	Review covered communications and applicable exceptions before authorizing recording.
Ohio § 2933.52	Generally permits participant or one-party-authorized interception, subject to prohibited-purpose limitations.	Participant status and purpose can change the result; do not transfer this rule to New Hampshire.
Illinois 720 ILCS 5/14-2	Surreptitious conduct, privacy and participant status matter under the relevant provisions.	Examine secrecy and the communication’s private character, not just the presence of recording software.
Washington RCW 9.73.030	Protects private communications and conversations, with all-participant consent and specified announcement rules.	Review privacy and notice mechanics under Washington’s own requirements.

The Pennsylvania firearm confidentiality and California Song-Beverly articles address another layer: restrictions tied to particular transaction information. A data flow may need review under an interception law and a separate collection or disclosure restriction. A favorable answer to the first question does not decide the second.

New Hampshire’s consumer privacy law does not displace wiretap claims

RSA Chapter 507-H, effective January 1, 2025, is a separate consumer privacy framework. It has applicability thresholds and exclusions, including exclusions for institutions of higher education and specified healthcare entities. It gives the attorney general exclusive enforcement authority and does not create a private action for its violations.

Those limits do not erase independently valid claims under RSA 570-A. An organization excluded from Chapter 507-H still needs to examine recording and interception. Likewise, meeting an applicable advertising opt-out obligation does not establish consent to an interception that occurred before the visitor could make a choice. Chapter 507-H itself addresses compliance with other privacy laws and recognizes greater protection through opt-in where conflicting rules preclude compliance with both.

For a privacy team, the work should be organized around the particular processing operation. Identify the applicable rights regime, then independently assess whether recording or disclosure requires consent or another authorization. A single preference interface can support several obligations, but the rules behind it must preserve those distinctions.

Which businesses and technologies deserve the closest review?

Healthcare providers have the clearest examples in the cases above. Hospitals should examine public specialist searches as well as authenticated portals. Medical practices, telehealth services and wellness businesses should review appointment forms, support conversations and any identifiers that accompany health-related events. A general cookie choice should not be treated as a substitute for a legally required health-information authorization.

Education providers should inspect student accounts and enrollment workflows. Financial services, insurance, legal services and ecommerce businesses should examine forms and conversations containing information customers would not expect to reach unrelated recipients. These are practical review priorities, not a claim that every company in those industries has violated New Hampshire law.

Call centers and employers also belong in the inventory. Telephone recording, conferencing bots and automated transcription can introduce a recording function before all participants understand it. Review when recording starts, how a new participant receives notice, whether the chosen consent method is sufficient and how an unrecorded alternative works where appropriate. Website consent software does not automatically control a telephone platform or meeting bot.

For website technologies, separate the function from the vendor label. Session replay may observe page content or form interactions depending on configuration. A chat tool may retain the conversation requested by the customer and also feed another analytics service. A conversion integration may transmit a page path that reveals what the visitor searched for. Each function calls for its own factual and legal assessment.

The timing and payload can matter more than the cookie name

Consider an illustrative healthcare journey. A visitor enters a specialist search, opens an appointment page and encounters a consent banner. If an optional script already sent the search and page address, a later refusal cannot undo that request. The review needs to establish the order of events, including what happens before the interface appears.

Now suppose the script sets no persistent cookie. That still does not establish the absence of a transmission. Information may travel in an event body, query parameter or network header. An account identifier, page path or entered search can become meaningful in combination, even when the payload does not contain a field named “medical information.”

Inspect browser requests across the relevant journeys and choices. Examine values, destinations and timestamps rather than counting detected cookies. A masked field in a replay product does not prove that another tag failed to read the same field. Masking should be tested against transmitted data, and optional capture on sensitive workflows may be best disabled.

Server-side integrations require separate attention. Moving an advertising event from the browser to a backend changes the architecture, but it does not by itself answer whether the underlying conduct is lawful. Determine where the information was originally acquired and what the later transfer represents. The interception question and the downstream disclosure question may differ.

Where Captain Compliance’s controls fit

Captain Compliance’s documented website privacy capabilities include scanning for tracking technologies, configured consent and blocking controls, consent evidence and continued monitoring. Those functions help a business identify optional technology and enforce an approved policy. A scan does not automatically determine every legal element or reveal every backend transmission.

The implementation detail is crucial. Captain Compliance’s guidance on gating nonessential scripts and beacons explains that cookie restrictions alone do not necessarily prevent outbound requests. Hardcoded scripts and code outside a controlled tag manager need appropriate execution controls. The system must be connected to the actual deployment path.

Start with a map of the website’s workflows and the tools operating on each. Distinguish public pages from accounts, forms and portals. Counsel should determine which processing is permissible and which requires consent; engineering then implements those decisions. On some pages, the appropriate rule may be to suppress an optional tool entirely.

Test acceptance, refusal, selected categories and later withdrawal. Include fresh visits and relevant account journeys. Preserve evidence that the configured rules controlled execution, and separately verify any backend event pipeline. A preference change should reach the technologies it is intended to control rather than merely updating the banner display.

Consent evidence should identify the choice and applicable notice version. Keep deployment versions and test results alongside it so the business can explain both what the visitor authorized and how the software behaved. An updated privacy notice helps communicate an approved practice; it does not retroactively authorize earlier collection.

Monitoring addresses the next change. A campaign, plugin or template update can introduce a new disclosure path after the initial review. Assign an owner to investigate relevant changes and verify the controls again. This makes privacy review part of operating the website rather than a one-time installation task.

Captain Compliance’s Compliance Shield provides a written litigation guarantee for qualifying customers and eligible claims under its terms. Businesses should confirm whether a particular New Hampshire claim is covered, along with the deployment requirements, limits and exclusions. Software and operational support reduce exposure and improve evidence; they do not prevent every lawsuit.

Responding to a claim requires a record of what actually happened

If a demand arrives, preserve the demand and relevant historical evidence while involving counsel. Capture the deployed tag configuration, notices, consent records and vendor settings. Document the current behavior before remediation obscures it, while promptly addressing any continuing problematic transmission under counsel’s guidance. Avoid creating unnecessary copies of sensitive customer information during the investigation.

The New Hampshire cases give businesses specific questions to answer: what communication was acquired, by which technology, when it was recorded and what consent or exception applied. A generic assurance that “we use standard analytics” does little to resolve those questions. A tested implementation and a usable evidence trail provide a more credible response.

Book a Captain Compliance demo to discuss the tracking technologies operating on your website, the controls your workflows need and how scanning, consent management and monitoring can support your privacy program.