Law / New Mexico

New Mexico

age

New Mexico has not enacted an age verification or age gating law covering adult content, social media, app stores, or design codes as of mid-2026. Two Digital Age Verification Act bills in the 2025 regular session, HB 44 (website age verification) and HB 313 (device and app store age verification), both died in committee without a floor vote in either chamber.

The state's Attorney General has instead relied on New Mexico's general Unfair Practices Act to pursue child safety claims against Meta, winning a $375 million jury verdict in March 2026 and seeking court-ordered age verification in a public nuisance phase tried in May 2026, but that litigation does not rest on an age-verification statute.

privacy

New Mexico has no comprehensive consumer personal-data-protection statute; recent comprehensive bills (HB 307, HB 410, and SB 420 in the 2025 session, and SB 53, the CHISPA Act, in the 2026 session) have not been enacted. New Mexico's privacy law is instead two separate sectoral statutes.

The Data Breach Notification Act, NMSA 1978 Secs. 57-12C-1 to 57-12C-12, requires notice to affected residents within 45 days of discovery and, above a 1,000-resident threshold, to the Attorney General, exempts state government entirely, and creates no private right of action; its personal identifying information definition includes biometric data, but that definition is purpose-bound to authenticating access to a location, device, system, or account rather than to identification generally, so whether it reaches an identifier derived from a public recording for identification purposes cannot be determined from the statute's own text.

The Genetic Information Privacy Act, NMSA 1978 Secs. 24-21-1 to 24-21-7, requires informed written consent before a person obtains, analyzes, retains, transmits, or uses an individual's genetic information, subject to nine statutory exceptions, and expressly arms an injured individual with a private civil action for damages, distinct from and broader than the Attorney General's or a district attorney's own enforcement authority.

New Mexico's official statute compilation portal, nmonesource.com, returns only navigation chrome through a JavaScript application with no statute text, so both instruments in this document are sourced to their official enrolled bill text on the New Mexico Legislature's own site rather than the compiled code.

7 instruments named 2 researched in detail As of 2026-08-28

Instruments

Each one links to its LexLint note, which carries what it requires and what it flags on.

Breach notification

Data Breach Notification Act

cite NMSA 1978 Secs. 57-12C-1 to 57-12C-12 stage IMMINENT commencement not set source official New Mexico enrolled bill text

A person that owns or licenses computerized data including a New Mexico resident's personal identifying information must notify each affected resident of a security breach in the most expedient time possible and no later than 45 calendar days after discovery, and a breach affecting more than 1,000 New Mexico residents also triggers notice to the Attorney General's office and major consumer reporting agencies.

Personal identifying information includes biometric data, defined as a record generated by automatic measurement of fingerprints, a voiceprint, iris or retina patterns, facial characteristics, or hand geometry used to authenticate access to a physical location, device, system, or account, alongside a Social Security number, a driver's license number, and financial account information, and excludes information lawfully obtained from publicly available sources or government records.

The Act exempts the State of New Mexico and its political subdivisions entirely. The Attorney General has sole authority to bring an action for a violation, may obtain an injunction and damages for actual costs or losses, and may seek a civil penalty of the greater of $25,000 or $10 per failed notification up to $150,000; the Act creates no private right of action.

Enacted by Laws 2017, chapter 36 (House Bill 15); the enrolled bill text does not itself print an explicit commencement sentence, and secondary reporting gives June 16, 2017 without independent primary confirmation, so no effective_date is recorded here.

What it asks of an app →

Sensitive categories

Genetic Information Privacy Act

cite NMSA 1978 Secs. 24-21-1 to 24-21-7 stage IMMINENT commencement not set source official New Mexico enrolled bill text

No person may obtain genetic information or samples for genetic analysis from an individual, or perform genetic analysis or collect, retain, transmit, or use genetic information, without first obtaining the individual's or their authorized representative's informed, written consent, subject to nine numbered exceptions covering law enforcement, newborn screening, de-identified use, medical repositories, and research.

Person is not limited to government or insurers; a separate section prohibits genetic discrimination specifically by insurers. Enacted in 1998 (House Bill 331) and amended in 2015 (House Bill 369, which replaced person with individual in the penalties subsection); the enrolled bill text for neither version prints an explicit commencement sentence, so no effective_date is recorded here.

What it asks of an app →

This summary covers the instruments LexLint has researched to a stage. Instruments named in the corpus but not yet researched are counted above and are not listed here. Every entry carries its own primary source on its note page. This is a research index, not legal advice.