{ "jurisdiction_id": "US-NM", "jurisdiction": "United States – New Mexico", "url": "https://dataprotection.gi/jurisdictions/united-states-new-mexico/", "generator": "render_jid v13-gdpri-1.0.0", "date_modified": "2026-08-06", "schema_version": "gdpri-v2", "counts": { "categories": 10, "claims": 60, "sub_modules": 57, "source_register": 17 }, "categories": [ { "code": "regulator_and_framework", "name": "Regulator & Framework", "traffic_light": "red", "sub_modules": [ "act_and_instruments", "material_scope", "regulator_and_authority", "regulator_registration_and_filing", "territorial_scope" ], "url": "https://dataprotection.gi/jurisdictions/united-states-new-mexico/#regulator-and-framework-regulator-framework", "traffic_light_rationale": "No comprehensive material/territorial scope, no general controller obligations, no registration regime; only breach-notification and general consumer-protection baselines exist.", "claims": [ { "statement": "New Mexico has not enacted a comprehensive consumer data-privacy statute equivalent to GDPR, CCPA/CPRA, or other US state omnibus privacy laws as of the 2025 legislative session.", "regulatory_stage": null, "is_binding": false, "confidence": "Confirmed", "source_publisher": "IAPP", "source_url": "https://iapp.org/resources/article/us-state-privacy-legislation-tracker", "source_tier": null, "observed_at": "2026-08-06" }, { "statement": "New Mexico's Data Breach Notification Act, enacted as Chapter 57 of the Laws of New Mexico 2017 and signed into law in April 2017, requires notification of data breaches.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Confirmed", "source_publisher": "DataGuidance", "source_url": "https://www.dataguidance.com/notes/new-mexico-data-breach-0", "source_tier": null, "observed_at": "2026-08-06" }, { "statement": "FTC Act Section 5 unfair/deceptive-practices authority applies nationally, including to entities operating in New Mexico, as a general federal privacy-enforcement baseline.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Confirmed", "source_publisher": "Federal Trade Commission", "source_url": "https://www.ftc.gov/news-events/topics/protecting-consumer-privacy-security/privacy-security-enforcement", "source_tier": null, "observed_at": "2026-08-06" }, { "statement": "The New Mexico Attorney General's Consumer & Environmental Protection Division holds general state authority to investigate and enforce consumer-protection and data-related matters, including breach-notification compliance.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Probable", "source_publisher": "NAAG", "source_url": "https://www.naag.org/attorney-general-journal/consumer-chief-of-the-month-brian-mcmath-new-mexico-attorney-generals-office/", "source_tier": null, "observed_at": "2026-08-06" }, { "statement": "The definition of personal identifying information under New Mexico's Data Breach Notification Act includes biometric data.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Confirmed", "source_publisher": "IAPP", "source_url": "https://iapp.org/news/a/new-mexico-governor-inks-data-breach-notification-law/", "source_tier": null, "observed_at": "2026-08-06" }, { "statement": "New Mexico's breach-notification obligations extend to any person or entity that owns, licenses, or maintains computerized data containing personal identifying information of New Mexico residents, irrespective of the entity's state of domicile.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Probable", "source_publisher": "DataGuidance", "source_url": "https://www.dataguidance.com/notes/new-mexico-data-breach-0", "source_tier": null, "observed_at": "2026-08-06" }, { "statement": "New Mexico imposes no general controller registration or pre-processing filing regime with the Attorney General absent a qualifying data breach.", "regulatory_stage": null, "is_binding": false, "confidence": "Confirmed", "source_publisher": "IAPP", "source_url": "https://iapp.org/resources/article/us-state-privacy-legislation-tracker", "source_tier": null, "observed_at": "2026-08-06" } ] }, { "code": "lawful_processing_and_special_data", "name": "Lawful Processing & Special Data", "traffic_light": "red", "sub_modules": [ "consent_thresholds", "lawful_bases", "pseudonymisation_and_anonymisation", "special_categories" ], "url": "https://dataprotection.gi/jurisdictions/united-states-new-mexico/#lawful-processing-and-special-data-lawful-processing-special-data", "traffic_light_rationale": "No general lawful-basis or consent framework; only a narrow genetic-data statute exists.", "claims": [ { "statement": "New Mexico has no statute enumerating lawful bases for processing personal data analogous to GDPR Article 6.", "regulatory_stage": null, "is_binding": false, "confidence": "Confirmed", "source_publisher": "IAPP", "source_url": "https://iapp.org/resources/article/us-state-privacy-legislation-tracker", "source_tier": null, "observed_at": "2026-08-06" }, { "statement": "New Mexico has no general statutory consent standard governing commercial personal-data processing outside of sector-specific statutes such as the Genetic Information Privacy Act.", "regulatory_stage": null, "is_binding": false, "confidence": "Confirmed", "source_publisher": "IAPP", "source_url": "https://iapp.org/resources/article/us-state-privacy-legislation-tracker", "source_tier": null, "observed_at": "2026-08-06" }, { "statement": "New Mexico's Genetic Information Privacy Act (NMSA 1978, Chapter 24, Article 21) establishes consent-based rules for the collection, use, and disclosure of genetic information by covered entities, including direct-to-consumer genetic testing companies.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Probable", "source_publisher": "DataGuidance", "source_url": "https://www.dataguidance.com/legal-research/chapter-24-article-21-new-mexico-statutes", "source_tier": null, "observed_at": "2026-08-06" }, { "statement": "New Mexico has not enacted a statutory definition or safe-harbour treatment for pseudonymised or anonymised data.", "regulatory_stage": null, "is_binding": false, "confidence": "Uncertain", "source_publisher": "IAPP", "source_url": "https://iapp.org/resources/article/us-state-privacy-legislation-tracker", "source_tier": null, "observed_at": "2026-08-06" } ] }, { "code": "data_subject_rights", "name": "Data Subject Rights", "traffic_light": "red", "sub_modules": [ "access_right", "data_portability", "deadlines_and_response_windows", "rectification_and_erasure", "restriction_and_objection" ], "url": "https://dataprotection.gi/jurisdictions/united-states-new-mexico/#data-subject-rights-data-subject-rights", "traffic_light_rationale": "Absence of any comprehensive state-level DSR framework; gap is structural, not a temporary lag.", "claims": [ { "statement": "New Mexico law does not grant consumers a general right to access personal data held by private-sector controllers.", "regulatory_stage": null, "is_binding": false, "confidence": "Confirmed", "source_publisher": "IAPP", "source_url": "https://iapp.org/resources/article/us-state-privacy-legislation-tracker", "source_tier": null, "observed_at": "2026-08-06" }, { "statement": "New Mexico law does not grant consumers a general right to rectify or delete personal data held by private-sector controllers.", "regulatory_stage": null, "is_binding": false, "confidence": "Confirmed", "source_publisher": "IAPP", "source_url": "https://iapp.org/resources/article/us-state-privacy-legislation-tracker", "source_tier": null, "observed_at": "2026-08-06" }, { "statement": "New Mexico law does not grant consumers a general right to restrict processing or object to profiling.", "regulatory_stage": null, "is_binding": false, "confidence": "Confirmed", "source_publisher": "IAPP", "source_url": "https://iapp.org/resources/article/us-state-privacy-legislation-tracker", "source_tier": null, "observed_at": "2026-08-06" }, { "statement": "New Mexico law does not grant consumers a statutory data-portability right.", "regulatory_stage": null, "is_binding": false, "confidence": "Confirmed", "source_publisher": "IAPP", "source_url": "https://iapp.org/resources/article/us-state-privacy-legislation-tracker", "source_tier": null, "observed_at": "2026-08-06" }, { "statement": "New Mexico law prescribes no statutory response-window deadlines for consumer data-subject requests, as no underlying comprehensive DSR framework exists.", "regulatory_stage": null, "is_binding": false, "confidence": "Confirmed", "source_publisher": "IAPP", "source_url": "https://iapp.org/resources/article/us-state-privacy-legislation-tracker", "source_tier": null, "observed_at": "2026-08-06" } ] }, { "code": "controller_processor_duties", "name": "Controller/Processor Duties", "traffic_light": "red", "sub_modules": [ "accountability_and_dpia", "breach_notification", "dpo_requirements", "joint_controller_arrangements", "retention_and_disposal", "ropa_requirements", "security_measures" ], "url": "https://dataprotection.gi/jurisdictions/united-states-new-mexico/#controller-processor-duties-controller-processor-duties", "traffic_light_rationale": "Only breach-notification duties confirmed in force; broader accountability/DPIA/DPO/ROPA apparatus absent.", "claims": [ { "statement": "New Mexico has not enacted an accountability principle or DPIA-trigger requirement applicable to private-sector controllers generally.", "regulatory_stage": null, "is_binding": false, "confidence": "Confirmed", "source_publisher": "IAPP", "source_url": "https://iapp.org/resources/article/us-state-privacy-legislation-tracker", "source_tier": null, "observed_at": "2026-08-06" }, { "statement": "New Mexico has not enacted a data-protection-officer appointment requirement for private-sector controllers.", "regulatory_stage": null, "is_binding": false, "confidence": "Confirmed", "source_publisher": "IAPP", "source_url": "https://iapp.org/resources/article/us-state-privacy-legislation-tracker", "source_tier": null, "observed_at": "2026-08-06" }, { "statement": "New Mexico has not enacted a records-of-processing-activities requirement for private-sector controllers.", "regulatory_stage": null, "is_binding": false, "confidence": "Confirmed", "source_publisher": "IAPP", "source_url": "https://iapp.org/resources/article/us-state-privacy-legislation-tracker", "source_tier": null, "observed_at": "2026-08-06" }, { "statement": "New Mexico has not enacted a statutory joint-controller liability-allocation framework.", "regulatory_stage": null, "is_binding": false, "confidence": "Confirmed", "source_publisher": "IAPP", "source_url": "https://iapp.org/resources/article/us-state-privacy-legislation-tracker", "source_tier": null, "observed_at": "2026-08-06" }, { "statement": "New Mexico's Data Breach Notification Act may impose an affirmative duty on entities to maintain reasonable security procedures for personal identifying information, consistent with the common structure of comparable state breach statutes, but the specific statutory provision was not independently confirmed in available secondary sources.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Uncertain", "source_publisher": "DataGuidance", "source_url": "https://www.dataguidance.com/notes/new-mexico-data-breach-0", "source_tier": null, "observed_at": "2026-08-06" }, { "statement": "New Mexico's Data Breach Notification Act defines a data breach as the unauthorised acquisition of unencrypted computerised data, or of encrypted computerised data together with the confidential process or key needed to decrypt it, that compromises the security, confidentiality, or integrity of personal identifying information, triggering a notification duty.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Confirmed", "source_publisher": "DataGuidance", "source_url": "https://www.dataguidance.com/notes/new-mexico-data-breach-0", "source_tier": null, "observed_at": "2026-08-06" }, { "statement": "New Mexico has not enacted a general statutory data-retention-limit or secure-disposal duty applicable to private-sector controllers.", "regulatory_stage": null, "is_binding": false, "confidence": "Confirmed", "source_publisher": "IAPP", "source_url": "https://iapp.org/resources/article/us-state-privacy-legislation-tracker", "source_tier": null, "observed_at": "2026-08-06" } ] }, { "code": "cross_border_and_adequacy", "name": "Cross-Border & Adequacy", "traffic_light": "red", "sub_modules": [ "adequacy_granted", "adequacy_received", "data_localisation", "sccs_and_bcrs", "transfer_impact_assessment", "transfer_mechanisms" ], "url": "https://dataprotection.gi/jurisdictions/united-states-new-mexico/#cross-border-and-adequacy-cross-border-adequacy", "traffic_light_rationale": "No cross-border transfer apparatus exists at the state level; concept is largely inapplicable to a US state absent an omnibus statute.", "claims": [ { "statement": "New Mexico has not enacted any statutory cross-border data-transfer mechanism (equivalent to adequacy, SCCs, BCRs, or derogations).", "regulatory_stage": null, "is_binding": false, "confidence": "Confirmed", "source_publisher": "IAPP", "source_url": "https://iapp.org/resources/article/us-state-privacy-legislation-tracker", "source_tier": null, "observed_at": "2026-08-06" }, { "statement": "The concept of an adequacy decision received from another regime is not applicable to New Mexico as a sub-federal US jurisdiction lacking an omnibus statute.", "regulatory_stage": null, "is_binding": false, "confidence": "Confirmed", "source_publisher": "IAPP", "source_url": "https://iapp.org/resources/article/us-state-privacy-legislation-tracker", "source_tier": null, "observed_at": "2026-08-06" }, { "statement": "New Mexico has no legal authority or mechanism to grant adequacy decisions to other jurisdictions.", "regulatory_stage": null, "is_binding": false, "confidence": "Confirmed", "source_publisher": "IAPP", "source_url": "https://iapp.org/resources/article/us-state-privacy-legislation-tracker", "source_tier": null, "observed_at": "2026-08-06" }, { "statement": "New Mexico has not enacted an SCC or BCR authorisation regime.", "regulatory_stage": null, "is_binding": false, "confidence": "Confirmed", "source_publisher": "IAPP", "source_url": "https://iapp.org/resources/article/us-state-privacy-legislation-tracker", "source_tier": null, "observed_at": "2026-08-06" }, { "statement": "New Mexico has not enacted a transfer-impact-assessment requirement.", "regulatory_stage": null, "is_binding": false, "confidence": "Confirmed", "source_publisher": "IAPP", "source_url": "https://iapp.org/resources/article/us-state-privacy-legislation-tracker", "source_tier": null, "observed_at": "2026-08-06" }, { "statement": "New Mexico has not enacted a data-localisation mandate for personal data.", "regulatory_stage": null, "is_binding": false, "confidence": "Confirmed", "source_publisher": "IAPP", "source_url": "https://iapp.org/resources/article/us-state-privacy-legislation-tracker", "source_tier": null, "observed_at": "2026-08-06" } ] }, { "code": "sectoral_watch", "name": "Sectoral Watch", "traffic_light": "amber", "sub_modules": [ "credit_and_scoring", "education", "employment_data", "financial_sector_overlay", "health_sector_overlay", "insurance", "telecoms_and_eprivacy" ], "url": "https://dataprotection.gi/jurisdictions/united-states-new-mexico/#sectoral-watch-sectoral-watch", "traffic_light_rationale": "Federal sectoral overlays are well-established and in force; several NM-specific sectoral gaps remain unconfirmed absences rather than verified negatives.", "claims": [ { "statement": "Financial institutions operating in New Mexico are subject to GLBA's privacy and safeguards obligations as a federal sectoral overlay, in the absence of a state-specific equivalent.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Confirmed", "source_publisher": "NAAG", "source_url": "https://www.naag.org/issues/consumer-protection/consumer-protection-101/privacy/", "source_tier": null, "observed_at": "2026-08-06" }, { "statement": "Covered entities and business associates operating in New Mexico are subject to HIPAA's privacy and security rules as a federal sectoral overlay, in the absence of a state-specific health-privacy statute.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Confirmed", "source_publisher": "NAAG", "source_url": "https://www.naag.org/issues/consumer-protection/consumer-protection-101/privacy/", "source_tier": null, "observed_at": "2026-08-06" }, { "statement": "New Mexico has not enacted a telecoms or eprivacy/cookie-consent statute governing electronic communications privacy.", "regulatory_stage": null, "is_binding": false, "confidence": "Confirmed", "source_publisher": "IAPP", "source_url": "https://iapp.org/resources/article/us-state-privacy-legislation-tracker", "source_tier": null, "observed_at": "2026-08-06" }, { "statement": "New Mexico has not enacted an employment-specific data-privacy statute.", "regulatory_stage": null, "is_binding": false, "confidence": "Uncertain", "source_publisher": "IAPP", "source_url": "https://iapp.org/resources/article/us-state-privacy-legislation-tracker", "source_tier": null, "observed_at": "2026-08-06" }, { "statement": "New Mexico residents hold federal Fair Credit Reporting Act rights, including the right to know what is in their credit file, dispute inaccurate information, and require correction or deletion by consumer reporting agencies.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Confirmed", "source_publisher": "IAPP", "source_url": "https://iapp.org/resources/article/us-state-privacy-legislation-tracker", "source_tier": null, "observed_at": "2026-08-06" }, { "statement": "No New Mexico-specific comprehensive K-12 student-data-privacy statute was confirmed in available sources; federal FERPA supplies the operative baseline for education records held by federally funded institutions.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Uncertain", "source_publisher": "IAPP", "source_url": "https://iapp.org/resources/article/us-state-privacy-legislation-tracker", "source_tier": null, "observed_at": "2026-08-06" }, { "statement": "Whether New Mexico has adopted the NAIC Insurance Data Security Model Law could not be confirmed from available secondary sources.", "regulatory_stage": null, "is_binding": false, "confidence": "Uncertain", "source_publisher": "IAPP", "source_url": "https://iapp.org/resources/article/us-state-privacy-legislation-tracker", "source_tier": null, "observed_at": "2026-08-06" } ] }, { "code": "adtech_and_commercial_privacy", "name": "AdTech & Commercial Privacy", "traffic_light": "red", "sub_modules": [ "clean_rooms_and_dcr", "cookies_and_trackers", "cross_context_advertising", "dark_patterns", "direct_marketing", "opt_out_signals" ], "url": "https://dataprotection.gi/jurisdictions/united-states-new-mexico/#adtech-and-commercial-privacy-adtech-commercial-privacy", "traffic_light_rationale": "No adtech/commercial-privacy regime is currently in force; the sole relevant instrument (SB 192) is pending legislation.", "claims": [ { "statement": "New Mexico has not enacted a cookie or tracking-technology consent statute.", "regulatory_stage": null, "is_binding": false, "confidence": "Confirmed", "source_publisher": "IAPP", "source_url": "https://iapp.org/resources/article/us-state-privacy-legislation-tracker", "source_tier": null, "observed_at": "2026-08-06" }, { "statement": "New Mexico Senate Bill 192, introduced January 29, 2026 and referred to Senate committee, would require registered data brokers to disclose contact information, collection of minors', geolocation, and reproductive-healthcare data, and provide a webpage allowing consumers to exercise privacy rights without the use of dark patterns; the bill has not been enacted.", "regulatory_stage": null, "is_binding": false, "confidence": "Confirmed", "source_publisher": "DataGuidance", "source_url": "https://www.dataguidance.com/news/new-mexico-bill-data-brokers-introduced-senate", "source_tier": null, "observed_at": "2026-08-06" }, { "statement": "New Mexico has not enacted a statutory requirement to recognise universal opt-out signals such as Global Privacy Control.", "regulatory_stage": null, "is_binding": false, "confidence": "Confirmed", "source_publisher": "IAPP", "source_url": "https://iapp.org/resources/article/us-state-privacy-legislation-tracker", "source_tier": null, "observed_at": "2026-08-06" }, { "statement": "New Mexico has no statutory or regulatory framework addressing data clean rooms or data-collaboration-room practices.", "regulatory_stage": null, "is_binding": false, "confidence": "Uncertain", "source_publisher": "IAPP", "source_url": "https://iapp.org/resources/article/us-state-privacy-legislation-tracker", "source_tier": null, "observed_at": "2026-08-06" }, { "statement": "New Mexico has not enacted a CPRA-style statutory framework defining 'sale' or 'share' of personal information for cross-context behavioural advertising.", "regulatory_stage": null, "is_binding": false, "confidence": "Confirmed", "source_publisher": "IAPP", "source_url": "https://iapp.org/resources/article/us-state-privacy-legislation-tracker", "source_tier": null, "observed_at": "2026-08-06" }, { "statement": "New Mexico has no state-specific direct-marketing consent or suppression statute beyond the federal TCPA and CAN-SPAM baselines.", "regulatory_stage": null, "is_binding": false, "confidence": "Uncertain", "source_publisher": "IAPP", "source_url": "https://iapp.org/resources/article/us-state-privacy-legislation-tracker", "source_tier": null, "observed_at": "2026-08-06" } ] }, { "code": "algorithmic_biometric_and_surveillance_governance", "name": "Algorithmic, Biometric & Surveillance Governance", "traffic_light": "red", "sub_modules": [ "ai_risk_assessments", "automated_decision_making_transparency", "biometric_regime", "genetic_data", "profiling_restrictions", "state_surveillance_carveouts" ], "url": "https://dataprotection.gi/jurisdictions/united-states-new-mexico/#algorithmic-biometric-and-surveillance-governance-algorithmic-biometric-surveill", "traffic_light_rationale": "No ADM/profiling/AI-assessment statute in force; biometric and genetic coverage exists only incidentally via other sectoral statutes.", "claims": [ { "statement": "New Mexico has not enacted a profiling-restriction statute analogous to GDPR Article 22.", "regulatory_stage": null, "is_binding": false, "confidence": "Confirmed", "source_publisher": "IAPP", "source_url": "https://iapp.org/resources/article/us-state-privacy-legislation-tracker", "source_tier": null, "observed_at": "2026-08-06" }, { "statement": "New Mexico has not enacted an automated-decision-making transparency or explanation-right statute.", "regulatory_stage": null, "is_binding": false, "confidence": "Confirmed", "source_publisher": "IAPP", "source_url": "https://iapp.org/resources/article/us-state-privacy-legislation-tracker", "source_tier": null, "observed_at": "2026-08-06" }, { "statement": "The New Mexico Department of Justice joined a multistate attorneys-general comment letter (dated March 23, 2026) raising concerns about AI-assisted data acquisition and analysis by data brokers and the absence of a complementary federal framework governing such practices.", "regulatory_stage": null, "is_binding": false, "confidence": "Confirmed", "source_publisher": "California Department of Justice (host)", "source_url": "https://oag.ca.gov/system/files/attachments/press-docs/2026-03-23-Domestic-Surveillance-Letter_ACTIVEPDF1.pdf", "source_tier": null, "observed_at": "2026-08-06" }, { "statement": "Biometric data is captured within the definition of personal identifying information under New Mexico's Data Breach Notification Act, but no dedicated biometric-privacy statute (e.g., a facial-recognition or fingerprint-specific consent regime) exists.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Confirmed", "source_publisher": "IAPP", "source_url": "https://iapp.org/news/a/new-mexico-governor-inks-data-breach-notification-law/", "source_tier": null, "observed_at": "2026-08-06" }, { "statement": "New Mexico's Genetic Information Privacy Act (NMSA 1978, Chapter 24, Article 21) is the state's only dedicated statutory governance of genetic data, relevant to direct-to-consumer genetic testing entities and downstream algorithmic use of genetic datasets.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Probable", "source_publisher": "DataGuidance", "source_url": "https://www.dataguidance.com/legal-research/chapter-24-article-21-new-mexico-statutes", "source_tier": null, "observed_at": "2026-08-06" }, { "statement": "No New Mexico-specific statutory carve-out for state surveillance or national-security exemptions from data-protection obligations was identified; the state's Attorney General has instead engaged in multistate advocacy against unchecked domestic-surveillance data practices.", "regulatory_stage": null, "is_binding": false, "confidence": "Uncertain", "source_publisher": "California Department of Justice (host)", "source_url": "https://oag.ca.gov/system/files/attachments/press-docs/2026-03-23-Domestic-Surveillance-Letter_ACTIVEPDF1.pdf", "source_tier": null, "observed_at": "2026-08-06" } ] }, { "code": "children_and_vulnerable_groups", "name": "Children & Vulnerable Groups", "traffic_light": "amber", "sub_modules": [ "age_verification", "dependent_adults", "education_settings", "minor_profiling_bans", "parental_consent" ], "url": "https://dataprotection.gi/jurisdictions/united-states-new-mexico/#children-and-vulnerable-groups-children-vulnerable-groups", "traffic_light_rationale": "Federal COPPA baseline is in force and NM AG enforcement activity is significant, but no NM-specific statutory age-verification, minor-profiling-ban, or dependent-adults framework exists; several child-safety bills remain unenacted.", "claims": [ { "statement": "A New Mexico bill for an Age Appropriate Design Code Act was introduced but has not been enacted into law.", "regulatory_stage": null, "is_binding": false, "confidence": "Confirmed", "source_publisher": "IAPP", "source_url": "https://iapp.org/resources/article/us-state-privacy-legislation-tracker", "source_tier": null, "observed_at": "2026-08-06" }, { "statement": "Federal COPPA parental-consent requirements apply to operators of online services directed to children accessed by New Mexico residents, in the absence of a state-specific analogue; the New Mexico Attorney General has previously enforced COPPA obligations jointly with the FTC, including a settlement with Google.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Confirmed", "source_publisher": "IAPP", "source_url": "https://iapp.org/news/b/google-new-mexico-ag-settle-coppa-allegations", "source_tier": null, "observed_at": "2026-08-06" }, { "statement": "New Mexico has not enacted a statutory ban on profiling minors for commercial purposes.", "regulatory_stage": null, "is_binding": false, "confidence": "Confirmed", "source_publisher": "IAPP", "source_url": "https://iapp.org/resources/article/us-state-privacy-legislation-tracker", "source_tier": null, "observed_at": "2026-08-06" }, { "statement": "No New Mexico-specific comprehensive education-settings data-privacy statute was confirmed; federal FERPA remains the operative baseline for student education records.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Uncertain", "source_publisher": "IAPP", "source_url": "https://iapp.org/resources/article/us-state-privacy-legislation-tracker", "source_tier": null, "observed_at": "2026-08-06" }, { "statement": "No New Mexico-specific statutory data-protection provisions addressing dependent adults (elderly or mentally incapacitated individuals) were identified.", "regulatory_stage": null, "is_binding": false, "confidence": "Uncertain", "source_publisher": "IAPP", "source_url": "https://iapp.org/resources/article/us-state-privacy-legislation-tracker", "source_tier": null, "observed_at": "2026-08-06" } ] }, { "code": "enforcement_and_redress", "name": "Enforcement & Redress", "traffic_light": "amber", "sub_modules": [ "collective_redress_and_class_actions", "enforcement_activity_index", "private_right_of_action", "recent_developments_180d", "regulator_funding_and_capacity", "regulator_powers_and_penalties" ], "url": "https://dataprotection.gi/jurisdictions/united-states-new-mexico/#enforcement-and-redress-enforcement-redress", "traffic_light_rationale": "Active AG enforcement exists but the collective-redress/PRA landscape is unconfirmed, and no comprehensive statutory penalty regime beyond breach-notification and general UPA remedies exists.", "claims": [ { "statement": "The New Mexico Attorney General's Consumer & Environmental Protection Division has authority to investigate and pursue enforcement actions against businesses for unfair or deceptive practices, including those relating to consumer data-handling, under the state's general consumer-protection framework.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Probable", "source_publisher": "NAAG", "source_url": "https://www.naag.org/attorney-general-journal/consumer-chief-of-the-month-brian-mcmath-new-mexico-attorney-generals-office/", "source_tier": null, "observed_at": "2026-08-06" }, { "statement": "New Mexico Attorney General Raúl Torrez has filed lawsuits against major technology companies including Meta and Snap Inc. for enabling online abuse of children, as part of a child-protection enforcement priority.", "regulatory_stage": null, "is_binding": false, "confidence": "Confirmed", "source_publisher": "NAAG", "source_url": "https://www.naag.org/attorney-general/raul-torrez/", "source_tier": null, "observed_at": "2026-08-06" }, { "statement": "The New Mexico Attorney General previously joined the FTC in a settlement with Google concerning alleged COPPA violations.", "regulatory_stage": null, "is_binding": false, "confidence": "Confirmed", "source_publisher": "IAPP", "source_url": "https://iapp.org/news/b/google-new-mexico-ag-settle-coppa-allegations", "source_tier": null, "observed_at": "2026-08-06" }, { "statement": "As of a 2022 public account, the NM Consumer & Environmental Protection Division comprised roughly ten attorneys overseeing consumer, environmental, and whistleblower matters.", "regulatory_stage": null, "is_binding": false, "confidence": "Probable", "source_publisher": "NAAG", "source_url": "https://www.naag.org/attorney-general-journal/consumer-chief-of-the-month-brian-mcmath-new-mexico-attorney-generals-office/", "source_tier": null, "observed_at": "2026-08-06" }, { "statement": "Whether New Mexico's Data Breach Notification Act affords consumers a private right of action for non-compliance is unconfirmed from available secondary sources, though a subset of US state breach-notification statutes generally are noted to allow such actions.", "regulatory_stage": null, "is_binding": false, "confidence": "Uncertain", "source_publisher": "IAPP", "source_url": "https://iapp.org/resources/article/us-state-privacy-legislation-tracker", "source_tier": null, "observed_at": "2026-08-06" }, { "statement": "New Mexico Senate Bill 192, enacting a proposed Data Broker Privacy Act with registration, disclosure, and deletion-process requirements for data brokers, was introduced to the New Mexico State Senate on January 29, 2026 and referred to Senate committee; it has not been enacted.", "regulatory_stage": null, "is_binding": false, "confidence": "Confirmed", "source_publisher": "DataGuidance", "source_url": "https://www.dataguidance.com/news/new-mexico-bill-data-brokers-introduced-senate", "source_tier": null, "observed_at": "2026-08-06" }, { "statement": "The New Mexico Department of Justice joined a multistate attorneys-general comment letter dated March 23, 2026 addressing data-broker and AI-enabled domestic-surveillance data practices.", "regulatory_stage": null, "is_binding": false, "confidence": "Confirmed", "source_publisher": "California Department of Justice (host)", "source_url": "https://oag.ca.gov/system/files/attachments/press-docs/2026-03-23-Domestic-Surveillance-Letter_ACTIVEPDF1.pdf", "source_tier": null, "observed_at": "2026-08-06" } ] } ] }