The N.H. Attorney General’s Office announced Aug. 15 it will hire staff to enforce a law enacted this year that seeks to enhance online privacy protection for consumers.

There is a saying that “if you’re not paying for it, you become the product,” meaning that online companies offer free services so they can collect consumer information to sell to advertisers.

Under Senate Bill 255, the NH Data Privacy Act, consumers will gain a number of rights on Jan. 1 to protect their personal information. These rights include:

• To confirm whether or not a business is controlling or processing their personal data.

• To correct any inaccuracies in their personal data being processed by businesses.

• To demand the deletion of personal data obtained from or about them.

• To obtain a copy of their personal data being controlled or processed by the business.

• To opt out of the future processing of their personal data for purposes of targeted advertising, the sale of personal data, or profiling.

“Ensuring accountability, transparency and consumer choice regarding how companies handle and monetize the personal data of their customers is a priority of my office,” Attorney General John Formella said in a news release.

“For too long companies have earned unfathomable profits by harvesting the personal data of its users without providing a meaningful opportunity for consumers to make informed choices about how their data is or is not used.”

The Attorney General’s Office will hire three new employees to staff the new unit: an assistant attorney general, a paralegal and an investigator, said Brandon Garod, senior assistant attorney general, in an interview.

“For a very long time, consumer data has been collected and monetized by companies, and consumers didn’t really understand that it was happening, or why it was happening, or exactly what information was being kept about them,” Garod said. “Really, how it was being used was to sell advertising.”

For example, if someone is on Facebook and looks online at hiking boots, advertisements for hiking boots will probably later appear on their Facebook page.

Garod notes that companies can track a variety of consumer behavior, including “what they are looking at, who they are corresponding with, who their friends are, what they are liking, whether they are watching videos, whether they are looking at certain types of pages, whether they are skipping certain kinds of content.

“And all of this is being kept for the purpose of trying to predict what types of advertising would be most relevant to the consumer so the business can sell companies the right to sell targeted ads to users.”

Facebook and many other national companies now allow users to opt out of having their personal data processed this way, although some consumers aren’t familiar that this is an option for them.

One of the first tasks of the new attorney general’s unit will be to create “frequently asked questions” pages to explain the new law.

While many large social media companies already comply with the law, some businesses may not be complying, Garod said.

The new law allows the attorney general to seek civil penalties of up to $10,000 for each violation of the act. It can also seek criminal penalties if there is sufficient evidence that a business is purposely failing to comply with the requirements of the act. Criminal penalties can include a fine of up to $100,000 per violation.

— RICK GREEN/KEENE SENTINEL