1.1 	CONFERENCE COMMITTEE REPORT ON H. F. No. 1370
1.2 	A bill for an act
1.3 	relating to public safety; establishing a cause of action for nonconsensual 
1.4 	dissemination of deep fake sexual images; establishing the crime of using deep 
1.5 	fake technology to influence an election; establishing a crime for nonconsensual 
1.6 	dissemination of deep fake sexual images;proposing coding for new law in 
1.7 	Minnesota Statutes, chapters 604; 609; 617.
1.8 	May 11, 2023
1.9 	The Honorable Melissa Hortman
1.10 	Speaker of the House of Representatives
1.11 	The Honorable Bobby Joe Champion
1.12 	President of the Senate
1.13 	We, the undersigned conferees for H. F. No. 1370 report that we have agreed upon the 
1.14 	items in dispute and recommend as follows:
1.15 	That the Senate recede from its amendments and that H. F. No. 1370 be further amended 
1.16 	as follows:
1.17 	Delete everything after the enacting clause and insert:

1.18 	ARTICLE 1
1.19 	DEEP FAKE TECHNOLOGY

1.20 	Section 1. [604.32] CAUSE OF ACTION FOR NONCONSENSUAL 
1.21 	DISSEMINATION OF A DEEP FAKE DEPICTING INTIMATE PARTS OR SEXUAL 
1.22 	ACTS.
1.23 		Subdivision 1.Definitions. (a) As used in this section, the following terms have the 
1.24 	meanings given.
1.25 	(b) "Deep fake" means any video recording, motion-picture film, sound recording, 
1.26 	electronic image, or photograph, or any technological representation of speech or conduct 
1.27 	substantially derivative thereof:
2.1 	(1) that is so realistic that a reasonable person would believe it depicts speech or conduct 
2.2 	of an individual; and
2.3 	(2) the production of which was substantially dependent upon technical means, rather 
2.4 	than the ability of another individual to physically or verbally impersonate such individual.
2.5 	(c) "Depicted individual" means an individual in a deep fake who appears to be engaging 
2.6 	in speech or conduct in which the individual did not engage.
2.7 	(d) "Intimate parts" means the genitals, pubic area, partially or fully exposed nipple, or 
2.8 	anus of an individual.
2.9 	(e) "Personal information" means any identifier that permits communication or in-person 
2.10 	contact with an individual, including:
2.11 	(1) an individual's first and last name, first initial and last name, first name and last 
2.12 	initial, or nickname;
2.13 	(2) an individual's home, school, or work address;
2.14 	(3) an individual's telephone number, email address, or social media account information; 
2.15 	or
2.16 	(4) an individual's geolocation data.
2.17 	(f) "Sexual act" means either sexual contact or sexual penetration.
2.18 	(g) "Sexual contact" means the intentional touching of intimate parts or intentional 
2.19 	touching with seminal fluid or sperm onto another individual's body.
2.20 	(h) "Sexual penetration" means any of the following acts:
2.21 	(1) sexual intercourse, cunnilingus, fellatio, or anal intercourse; or
2.22 	(2) any intrusion, however slight, into the genital or anal openings of an individual by 
2.23 	another's body part or an object used by another for this purpose.
2.24 		Subd. 2.Nonconsensual dissemination of a deep fake. (a) A cause of action against a 
2.25 	person for the nonconsensual dissemination of a deep fake exists when:
2.26 	(1) a person disseminated a deep fake with knowledge that the depicted individual did 
2.27 	not consent to its public dissemination;
2.28 	(2) the deep fake realistically depicts any of the following:
2.29 	(i) the intimate parts of another individual presented as the intimate parts of the depicted 
2.30 	individual;
3.1 	(ii) artificially generated intimate parts presented as the intimate parts of the depicted 
3.2 	individual; or
3.3 	(iii) the depicted individual engaging in a sexual act; and
3.4 	(3) the depicted individual is identifiable:
3.5 	(i) from the deep fake itself, by the depicted individual or by another individual; or
3.6 	(ii) from the personal information displayed in connection with the deep fake.
3.7 	(b) The fact that the depicted individual consented to the creation of the deep fake or to 
3.8 	the voluntary private transmission of the deep fake is not a defense to liability for a person 
3.9 	who has disseminated the deep fake with knowledge that the depicted individual did not 
3.10 	consent to its public dissemination.
3.11 		Subd. 3.Damages. The court may award the following damages to a prevailing plaintiff 
3.12 	from a person found liable under subdivision 2:
3.13 	(1) general and special damages, including all finance losses due to the dissemination 
3.14 	of the deep fake and damages for mental anguish;
3.15 	(2) an amount equal to any profit made from the dissemination of the deep fake by the 
3.16 	person who intentionally disclosed the deep fake;
3.17 	(3) a civil penalty awarded to the plaintiff of an amount up to $100,000; and
3.18 	(4) court costs, fees, and reasonable attorney fees.
3.19 		Subd. 4.Injunction; temporary relief. (a) A court may issue a temporary or permanent 
3.20 	injunction or restraining order to prevent further harm to the plaintiff.
3.21 	(b) The court may issue a civil fine for the violation of a court order in an amount up to 
3.22 	$1,000 per day for failure to comply with an order granted under this section.
3.23 		Subd. 5.Confidentiality. The court shall allow confidential filings to protect the privacy 
3.24 	of the plaintiff in cases filed under this section.
3.25 		Subd. 6.Liability; exceptions. (a) No person shall be found liable under this section 
3.26 	when:
3.27 	(1) the dissemination is made for the purpose of a criminal investigation or prosecution 
3.28 	that is otherwise lawful;
3.29 	(2) the dissemination is for the purpose of, or in connection with, the reporting of unlawful 
3.30 	conduct;
4.1 	(3) the dissemination is made in the course of seeking or receiving medical or mental 
4.2 	health treatment, and the image is protected from further dissemination;
4.3 	(4) the deep fake was obtained in a commercial setting for the purpose of the legal sale 
4.4 	of goods or services, including the creation of artistic products for sale or display, and the 
4.5 	depicted individual knew that a deep fake would be created and disseminated in a commercial 
4.6 	setting;
4.7 	(5) the deep fake relates to a matter of public interest; dissemination serves a lawful 
4.8 	public purpose; the person disseminating the deep fake as a matter of public interest clearly 
4.9 	identifies that the video recording, motion-picture film, sound recording, electronic image, 
4.10 	photograph, or other item is a deep fake; and the person acts in good faith to prevent further 
4.11 	dissemination of the deep fake;
4.12 	(6) the dissemination is for legitimate scientific research or educational purposes, the 
4.13 	deep fake is clearly identified as such, and the person acts in good faith to minimize the risk 
4.14 	that the deep fake will be further disseminated; or
4.15 	(7) the dissemination is made for legal proceedings and is consistent with common 
4.16 	practice in civil proceedings necessary for the proper functioning of the criminal justice 
4.17 	system, or protected by court order which prohibits any further dissemination.
4.18 	(b) This section does not alter or amend the liabilities and protections granted by United 
4.19 	States Code, title 47, section 230, and shall be construed in a manner consistent with federal 
4.20 	law.
4.21 	(c) A cause of action arising under this section does not prevent the use of any other 
4.22 	cause of action or remedy available under the law.
4.23 		Subd. 7.Jurisdiction. A court has jurisdiction over a cause of action filed pursuant to 
4.24 	this section if the plaintiff or defendant resides in this state.
4.25 		Subd. 8.Venue. A cause of action arising under this section may be filed in either:
4.26 	(1) the county of residence of the defendant or plaintiff or in the jurisdiction of the 
4.27 	plaintiff's designated address if the plaintiff participates in the address confidentiality program 
4.28 	established by chapter 5B; or
4.29 	(2) the county where any deep fake is produced, reproduced, or stored in violation of 
4.30 	this section.
4.31 		Subd. 9.Discovery of dissemination. In a civil action brought under subdivision 2, the 
4.32 	statute of limitations is tolled until the plaintiff discovers the deep fake has been disseminated.

5.1 	EFFECTIVE DATE. This section is effective August 1, 2023, and applies to 
5.2 	dissemination of a deep fake that takes place on or after that date.

5.3 	Sec. 2. [609.771] USE OF DEEP FAKE TECHNOLOGY TO INFLUENCE AN 
5.4 	ELECTION.
5.5 		Subdivision 1.Definitions. (a) As used in this section, the following terms have the 
5.6 	meanings given.
5.7 	(b) "Candidate" means an individual who seeks nomination or election to a federal, 
5.8 	statewide, legislative, judicial, or local office including special districts, school districts, 
5.9 	towns, home rule charter and statutory cities, and counties.
5.10 	(c) "Deep fake" means any video recording, motion-picture film, sound recording, 
5.11 	electronic image, or photograph, or any technological representation of speech or conduct 
5.12 	substantially derivative thereof:
5.13 	(1) that is so realistic that a reasonable person would believe it depicts speech or conduct 
5.14 	of an individual who did not in fact engage in such speech or conduct; and
5.15 	(2) the production of which was substantially dependent upon technical means, rather 
5.16 	than the ability of another individual to physically or verbally impersonate such individual.
5.17 	(d) "Depicted individual" means an individual in a deep fake who appears to be engaging 
5.18 	in speech or conduct in which the individual did not engage.
5.19 		Subd. 2.Use of deep fake to influence an election; violation. A person who disseminates 
5.20 	a deep fake or enters into a contract or other agreement to disseminate a deep fake is guilty 
5.21 	of a crime and may be sentenced as provided in subdivision 3 if the person knows or 
5.22 	reasonably should know that the item being disseminated is a deep fake and dissemination:
5.23 	(1) takes place within 90 days before an election;
5.24 	(2) is made without the consent of the depicted individual; and
5.25 	(3) is made with the intent to injure a candidate or influence the result of an election.
5.26 		Subd. 3.Use of deep fake to influence an election; penalty. A person convicted of 
5.27 	violating subdivision 2 may be sentenced as follows:
5.28 	(1) if the person commits the violation within five years of one or more prior convictions 
5.29 	under this section, to imprisonment for not more than five years or to payment of a fine of 
5.30 	not more than $10,000, or both;
6.1 	(2) if the person commits the violation with the intent to cause violence or bodily harm, 
6.2 	to imprisonment for not more than one year or to payment of a fine of not more than $3,000, 
6.3 	or both; or
6.4 	(3) in other cases, to imprisonment for not more than 90 days or to payment of a fine of 
6.5 	not more than $1,000, or both.
6.6 		Subd. 4.Injunctive relief. A cause of action for injunctive relief may be maintained 
6.7 	against any person who is reasonably believed to be about to violate or who is in the course 
6.8 	of violating this section by:
6.9 	(1) the attorney general;
6.10 	(2) a county attorney or city attorney;
6.11 	(3) the depicted individual; or
6.12 	(4) a candidate for nomination or election to a public office who is injured or likely to 
6.13 	be injured by dissemination.

6.14 	EFFECTIVE DATE. This section is effective August 1, 2023, and applies to crimes 
6.15 	committed on or after that date.

6.16 	Sec. 3. [617.262] NONCONSENSUAL DISSEMINATION OF A DEEP FAKE 
6.17 	DEPICTING INTIMATE PARTS OR SEXUAL ACTS.
6.18 		Subdivision 1.Definitions. (a) For purposes of this section, the following terms have 
6.19 	the meanings given.
6.20 	(b) "Deep fake" means any video recording, motion-picture film, sound recording, 
6.21 	electronic image, or photograph, or any technological representation of speech or conduct 
6.22 	substantially derivative thereof:
6.23 	(1) that is so realistic that a reasonable person would believe it depicts speech or conduct 
6.24 	of an individual; and
6.25 	(2) the production of which was substantially dependent upon technical means, rather 
6.26 	than the ability of another individual to physically or verbally impersonate such individual.
6.27 	(c) "Depicted individual" means an individual in a deep fake who appears to be engaging 
6.28 	in speech or conduct in which the individual did not engage.
6.29 	(d) "Dissemination" means distribution to one or more persons, other than the individual 
6.30 	depicted in the deep fake, or publication by any publicly available medium.
7.1 	(e) "Harass" means an act that would cause a substantial adverse effect on the safety, 
7.2 	security, or privacy of a reasonable person.
7.3 	(f) "Intimate parts" means the genitals, pubic area, anus, or partially or fully exposed 
7.4 	nipple of an individual.
7.5 	(g) "Personal information" means any identifier that permits communication or in-person 
7.6 	contact with an individual, including:
7.7 	(1) an individual's first and last name, first initial and last name, first name and last 
7.8 	initial, or nickname;
7.9 	(2) an individual's home, school, or work address;
7.10 	(3) an individual's telephone number, email address, or social media account information; 
7.11 	or
7.12 	(4) an individual's geolocation data.
7.13 	(h) "Sexual act" means either sexual contact or sexual penetration.
7.14 	(i) "Sexual contact" means the intentional touching of intimate parts or intentional 
7.15 	touching with seminal fluid or sperm onto another individual's body.
7.16 	(j) "Sexual penetration" means any of the following acts:
7.17 	(1) sexual intercourse, cunnilingus, fellatio, or anal intercourse; or
7.18 	(2) any intrusion, however slight, into the genital or anal openings of an individual by 
7.19 	another's body part or an object used by another for this purpose.
7.20 	(k) "Social media" means any electronic medium, including an interactive computer 
7.21 	service, telephone network, or data network, that allows users to create, share, and view 
7.22 	user-generated content.
7.23 		Subd. 2.Crime. It is a crime to intentionally disseminate a deep fake when:
7.24 	(1) the actor knows or reasonably should know that the depicted individual did not 
7.25 	consent to the dissemination;
7.26 	(2) the deep fake realistically depicts any of the following:
7.27 	(i) the intimate parts of another individual presented as the intimate parts of the depicted 
7.28 	individual;
7.29 	(ii) artificially generated intimate parts presented as the intimate parts of the depicted 
7.30 	individual; or
8.1 	(iii) the depicted individual engaging in a sexual act; and
8.2 	(3) the depicted individual is identifiable:
8.3 	(i) from the deep fake itself, by the depicted individual or by another individual; or
8.4 	(ii) from the personal information displayed in connection with the deep fake.
8.5 		Subd. 3.Penalties. (a) Except as provided in paragraph (b), whoever violates subdivision 
8.6 	2 is guilty of a gross misdemeanor.
8.7 	(b) Whoever violates subdivision 2 may be sentenced to imprisonment for not more than 
8.8 	three years or to payment of a fine of $5,000, or both, if one of the following factors is 
8.9 	present:
8.10 	(1) the depicted individual suffers financial loss due to the dissemination of the deep 
8.11 	fake;
8.12 	(2) the actor disseminates the deep fake with intent to profit from the dissemination;
8.13 	(3) the actor maintains an Internet website, online service, online application, or mobile 
8.14 	application for the purpose of disseminating the deep fake;
8.15 	(4) the actor posts the deep fake on a website;
8.16 	(5) the actor disseminates the deep fake with intent to harass the depicted individual;
8.17 	(6) the actor obtained the deep fake by committing a violation of section 609.52, 609.746, 
8.18 	609.89, or 609.891; or
8.19 	(7) the actor has previously been convicted under this chapter.
8.20 		Subd. 3a.No defense. It is not a defense to a prosecution under this section that the 
8.21 	depicted individual consented to the creation or possession of the deep fake, or the private 
8.22 	transmission of the deep fake to an individual other than those to whom the deep fake was 
8.23 	disseminated.
8.24 		Subd. 4.Venue. Notwithstanding anything to the contrary in section 627.01, an offense 
8.25 	committed under this section may be prosecuted in:
8.26 	(1) the county where the offense occurred;
8.27 	(2) the county of residence of the actor or victim or in the jurisdiction of the victim's 
8.28 	designated address if the victim participates in the address confidentiality program established 
8.29 	by chapter 5B; or
9.1 	(3) only if venue cannot be located in the counties specified under clause (1) or (2), the 
9.2 	county where any deep fake is produced, reproduced, found, stored, received, or possessed 
9.3 	in violation of this section.
9.4 		Subd. 5.Exemptions. Subdivision 2 does not apply when:
9.5 	(1) the dissemination is made for the purpose of a criminal investigation or prosecution 
9.6 	that is otherwise lawful;
9.7 	(2) the dissemination is for the purpose of, or in connection with, the reporting of unlawful 
9.8 	conduct;
9.9 	(3) the dissemination is made in the course of seeking or receiving medical or mental 
9.10 	health treatment, and the image is protected from further dissemination;
9.11 	(4) the deep fake was obtained in a commercial setting for the purpose of the legal sale 
9.12 	of goods or services, including the creation of artistic products for sale or display, and the 
9.13 	depicted individual knew, or should have known, that a deep fake would be created and 
9.14 	disseminated;
9.15 	(5) the deep fake relates to a matter of public interest and dissemination serves a lawful 
9.16 	public purpose;
9.17 	(6) the dissemination is for legitimate scientific research or educational purposes; or
9.18 	(7) the dissemination is made for legal proceedings and is consistent with common 
9.19 	practice in civil proceedings necessary for the proper functioning of the criminal justice 
9.20 	system, or protected by court order which prohibits any further dissemination.
9.21 		Subd. 6.Immunity. Nothing in this section shall be construed to impose liability upon 
9.22 	the following entities solely as a result of content or information provided by another person:
9.23 	(1) an interactive computer service as defined in United States Code, title 47, section 
9.24 	230, paragraph (f), clause (2);
9.25 	(2) a provider of public mobile services or private radio services; or
9.26 	(3) a telecommunications network or broadband provider.

9.27 	EFFECTIVE DATE. This section is effective August 1, 2023, and applies to crimes 
9.28 	committed on or after that date.

10.1 	ARTICLE 2
10.2 	AGE-APPROPRIATE DESIGN CODE

10.3 	Section 1. [13.6505] ATTORNEY GENERAL DATA CODED ELSEWHERE.
10.4 		Subdivision 1.Scope. The sections referred to in this section are codified outside this 
10.5 	chapter. Those sections classify attorney general data as other than public, place restrictions 
10.6 	on access to government data, or involve data sharing.
10.7 		Subd. 2.Data protection impact assessments. A data protection impact assessment 
10.8 	collected or maintained by the attorney general under section 325O.04 is classified under 
10.9 	section 325O.04, subdivision 4.

10.10 	Sec. 2. [325O.01] CITATION; CONSTRUCTION.
10.11 		Subdivision 1.Citation. This chapter may be cited as the "Minnesota Age-Appropriate 
10.12 	Design Code Act."
10.13 		Subd. 2.Construction. (a) A business that develops and provides online services, 
10.14 	products, or features that children are likely to access must consider the best interests of 
10.15 	children when designing, developing, and providing that online service, product, or feature.
10.16 	(b) If a conflict arises between commercial interests of a business and the best interests 
10.17 	of children likely to access an online product, service, or feature, the business must prioritize 
10.18 	the privacy, safety, and well-being of children over the business's commercial interests.

10.19 	Sec. 3. [325O.02] DEFINITIONS.
10.20 	(a) For purposes of this chapter, the following terms have the meanings given.
10.21 	(b) "Affiliate" means a legal entity that controls, is controlled by, or is under common 
10.22 	control with that other legal entity. For these purposes, "control" or "controlled" means: 
10.23 	ownership of or the power to vote more than 50 percent of the outstanding shares of any 
10.24 	class of voting security of a company; control in any manner over the election of a majority 
10.25 	of the directors or of individuals exercising similar functions; or the power to exercise a 
10.26 	controlling influence over the management of a company.
10.27 	(c) "Business" means:
10.28 	(1) a sole proprietorship, partnership, limited liability company, corporation, association, 
10.29 	or other legal entity that is organized or operated for the profit or financial benefit of its 
10.30 	shareholders or other owners; and
11.1 	(2) an affiliate of a business that shares common branding with the business. For purposes 
11.2 	of this clause, "common branding" means a shared name, servicemark, or trademark that 
11.3 	the average consumer would understand that two or more entities are commonly owned.
11.4 	For purposes of this chapter, for a joint venture or partnership composed of businesses in 
11.5 	which each business has at least a 40 percent interest, the joint venture or partnership and 
11.6 	each business that composes the joint venture or partnership shall separately be considered 
11.7 	a single business, except that personal data in the possession of each business and disclosed 
11.8 	to the joint venture or partnership must not be shared with the other business.
11.9 	(d) "Child" means a consumer who is under 18 years of age.
11.10 	(e) "Collect" means buying, renting, gathering, obtaining, receiving, or accessing any 
11.11 	personal data pertaining to a consumer by any means. This includes receiving data from the 
11.12 	consumer, either actively or passively, or by observing the consumer's behavior.
11.13 	(f) "Consumer" means a natural person who is a Minnesota resident, however identified, 
11.14 	including by any unique identifier.
11.15 	(g) "Dark pattern" means a user interface designed or manipulated with the substantial 
11.16 	effect of subverting or impairing user autonomy, decision making, or choice.
11.17 	(h) "Data protection impact assessment" means a systematic survey to assess and mitigate 
11.18 	risks to children who are reasonably likely to access the online service, product, or feature 
11.19 	that arise from the data management practices of the business.
11.20 	(i) "Default" means a preselected option adopted by the business for the online service, 
11.21 	product, or feature.
11.22 	(j) "Deidentified" means data that cannot reasonably be used to infer information about, 
11.23 	or otherwise be linked to, an identified or identifiable natural person, or a device linked to 
11.24 	such person, provided that the business that possesses the data:
11.25 	(1) takes reasonable measures to ensure that the data cannot be associated with a natural 
11.26 	person;
11.27 	(2) publicly commits to maintain and use the data only in a deidentified fashion and not 
11.28 	attempt to reidentify the data; and
11.29 	(3) contractually obligates any recipients of the data to comply with all provisions of 
11.30 	this paragraph.
12.1 	(k) "Likely to be accessed by children" means an online service, product, or feature that 
12.2 	it is reasonable to expect would be accessed by children based on any of the following 
12.3 	indicators:
12.4 	(1) the online service, product, or feature is directed to children, as defined by the 
12.5 	Children's Online Privacy Protection Act, United States Code, title 15, section 6501 et seq.;
12.6 	(2) the online service, product, or feature is determined, based on competent and reliable 
12.7 	evidence regarding audience composition, to be routinely accessed by a significant number 
12.8 	of children;
12.9 	(3) the online service, product, or feature contains advertisements marketed to children;
12.10 	(4) the online service, product, or feature is substantially similar or the same as an online 
12.11 	service, product, or feature subject to clause (2);
12.12 	(5) the online service, product, or feature has design elements that are known to be of 
12.13 	interest to children, including but not limited to games, cartoons, music, and celebrities who 
12.14 	appeal to children; or
12.15 	(6) a significant amount of the audience of the online service, product, or feature is 
12.16 	determined, based on internal company research, to be children.
12.17 	(l) "Online service, product, or feature" does not mean any of the following:
12.18 	(1) telecommunications service, as defined in United States Code, title 47, section 153;
12.19 	(2) broadband service, as defined in section 116J.39, subdivision 1; or
12.20 	(3) the sale, delivery, or use of a physical product.
12.21 	(m) "Personal data" means any information that is linked or reasonably linkable to an 
12.22 	identified or identifiable natural person. Personal data does not include deidentified data or 
12.23 	publicly available information. For purposes of this paragraph, "publicly available 
12.24 	information" means information that (1) is lawfully made available from federal, state, or 
12.25 	local government records or widely distributed media, and (2) a controller has a reasonable 
12.26 	basis to believe a consumer has lawfully made available to the general public.
12.27 	(n) "Precise geolocation" means any data that is derived from a device and that is used 
12.28 	or intended to be used to locate a consumer within a geographic area that is equal to or less 
12.29 	than the area of a circle with a radius of 1,850 feet, except as prescribed by regulations.
12.30 	(o) "Process" or "processing" means any operation or set of operations that are performed 
12.31 	on personal data or on sets of personal data, whether or not by automated means, such as 
12.32 	the collection, use, storage, disclosure, analysis, deletion, or modification of personal data.
13.1 	(p) "Profiling" means any form of automated processing of personal data to evaluate, 
13.2 	analyze, or predict personal aspects concerning an identified or identifiable natural person's 
13.3 	economic situation, health, personal preferences, interests, reliability, behavior, location, 
13.4 	or movements.
13.5 	(q) "Sale," "sell," or "sold" means the exchange of personal data for monetary or other 
13.6 	valuable consideration by a business to a third party. Sale does not include the following:
13.7 	(1) the disclosure of personal data to a third party who processes the personal data on 
13.8 	behalf of the business;
13.9 	(2) the disclosure of personal data to a third party with whom the consumer has a direct 
13.10 	relationship for purposes of providing a product or service requested by the consumer;
13.11 	(3) the disclosure or transfer of personal data to an affiliate of the business;
13.12 	(4) the disclosure of data that the consumer intentionally made available to the general 
13.13 	public via a channel of mass media and did not restrict to a specific audience; or
13.14 	(5) the disclosure or transfer of personal data to a third party as an asset that is part of a 
13.15 	completed or proposed merger, acquisition, bankruptcy, or other transaction in which the 
13.16 	third party assumes control of all or part of the business's assets.
13.17 	(r) "Share" means sharing, renting, releasing, disclosing, disseminating, making available, 
13.18 	transferring, or otherwise communicating orally, in writing, or by electronic or other means 
13.19 	a consumer's personal data by the business to a third party for cross-context behavioral 
13.20 	advertising, whether or not for monetary or other valuable consideration, including 
13.21 	transactions between a business and a third party for cross-context behavioral advertising 
13.22 	for the benefit of a business in which no money is exchanged.
13.23 	(s) "Third party" means a natural or legal person, public authority, agency, or body other 
13.24 	than the consumer or the business.

13.25 	Sec. 4. [325O.03] SCOPE; EXCLUSIONS.
13.26 	(a) A business is subject to this chapter if the business:
13.27 	(1) collects consumers' personal data or has consumers' personal data collected on the 
13.28 	business's behalf by a third party;
13.29 	(2) alone or jointly with others, determines the purposes and means of the processing 
13.30 	of consumers' personal data;
13.31 	(3) does business in Minnesota; and
14.1 	(4) satisfies one or more of the following thresholds:
14.2 	(i) has annual gross revenues in excess of $25,000,000, as adjusted every odd-numbered 
14.3 	year to reflect the Consumer Price Index;
14.4 	(ii) alone or in combination, annually buys, receives for the business's commercial 
14.5 	purposes, sells, or shares for commercial purposes, alone or in combination, the personal 
14.6 	data of 50,000 or more consumers, households, or devices; or
14.7 	(iii) derives 50 percent or more of its annual revenues from selling consumers' personal 
14.8 	data.
14.9 	(b) This chapter does not apply to:
14.10 	(1) protected health information that is collected by a covered entity or business associate 
14.11 	governed by the privacy, security, and breach notification rules issued by the United States 
14.12 	Department of Health and Human Services, Code of Federal Regulations, title 45, parts 160 
14.13 	and 164, established pursuant to the Health Insurance Portability and Accountability Act 
14.14 	of 1996, Public Law 104-191, and the Health Information Technology for Economic and 
14.15 	Clinical Health Act, Public Law 111-5;
14.16 	(2) a covered entity governed by the privacy, security, and breach notification rules 
14.17 	issued by the United States Department of Health and Human Services, Code of Federal 
14.18 	Regulations, title 45, parts 160 and 164, established pursuant to the Health Insurance 
14.19 	Portability and Accountability Act of 1996, Public Law 104-191, to the extent the provider 
14.20 	or covered entity maintains patient information in the same manner as medical information 
14.21 	or protected health information as described in clause (1);
14.22 	(3) information collected as part of a clinical trial subject to the federal policy for the 
14.23 	protection of human subjects, also known as the common rule, pursuant to good clinical 
14.24 	practice guidelines issued by the International Council for Harmonisation or pursuant to 
14.25 	human subject protection requirements of the United States Food and Drug Administration; 
14.26 	or
14.27 	(4) a business whose principal business is the origination of journalism, and which has 
14.28 	a significant portion of its workforce consisting of professional journalists.

14.29 	Sec. 5. [325O.04] BUSINESS OBLIGATIONS.
14.30 		Subdivision 1.Requirements for businesses. A business that provides an online service, 
14.31 	product, or feature likely to be accessed by children must:
15.1 	(1) before any new online services, products, or features are offered to the public, 
15.2 	complete a data protection impact assessment for any online service, product, or feature 
15.3 	likely to be accessed by children and maintain documentation of this assessment as long as 
15.4 	the online service, product, or feature is likely to be accessed by children;
15.5 	(2) biennially review all data protection impact assessments;
15.6 	(3) document any risk of material detriment to children that arises from the data 
15.7 	management practices of the business identified in the data protection impact assessment 
15.8 	required by clause (1) and create a timed plan to mitigate or eliminate the risk before the 
15.9 	online service, product, or feature is accessed by children;
15.10 	(4) within five business days of a written request by the attorney general, provide to the 
15.11 	attorney general a list of all data protection impact assessments the business has completed;
15.12 	(5) within seven business days of a written request by the attorney general, provide the 
15.13 	attorney general with a copy of any data protection impact assessment;
15.14 	(6) estimate the age of child users with a reasonable level of certainty appropriate to the 
15.15 	risks that arise from the data management practices of the business or apply the privacy and 
15.16 	data protections afforded to children to all consumers;
15.17 	(7) configure all default privacy settings provided to children by the online service, 
15.18 	product, or feature to settings that offer a high level of privacy, unless the business can 
15.19 	demonstrate a compelling reason that a different setting is in the best interests of children;
15.20 	(8) provide any privacy information, terms of service, policies, and community standards 
15.21 	concisely, prominently, and using clear language suited to the age of children likely to 
15.22 	access that online service, product, or feature;
15.23 	(9) if the online service, product, or feature allows a child's parent, guardian, or any 
15.24 	other consumer to monitor the child's online activity or track the child's location, provide 
15.25 	an obvious signal to the child when the child is being monitored or tracked;
15.26 	(10) enforce published terms, policies, and community standards established by the 
15.27 	business, including but not limited to privacy policies and those concerning children; and
15.28 	(11) provide prominent, accessible, and responsive tools to help children, or if applicable 
15.29 	their parents or guardians, exercise their privacy rights and report concerns.
15.30 		Subd. 2.Data protection impact assessments; requirements. (a) A data protection 
15.31 	impact assessment required by this section must:
16.1 	(1) identify the purpose of the online service, product, or feature; how it uses children's 
16.2 	personal data; and the risks of material detriment to children that arise from the data 
16.3 	management practices of the business; and
16.4 	(2) address, to the extent applicable:
16.5 	(i) whether algorithms used by the online product, service, or feature could harm children;
16.6 	(ii) whether the design of the online product, service, or feature could lead to children 
16.7 	experiencing or being targeted by harmful, or potentially harmful, contacts on the online 
16.8 	product, service, or feature;
16.9 	(iii) whether the design of the online product, service, or feature could permit children 
16.10 	to witness, participate in, or be subject to harmful, or potentially harmful, conduct on the 
16.11 	online product, service, or feature;
16.12 	(iv) whether the design of the online product, service, or feature could allow children 
16.13 	to be party to or exploited by a harmful, or potentially harmful, contact on the online product, 
16.14 	service, or feature;
16.15 	(v) whether targeted advertising systems used by the online product, service, or feature 
16.16 	could harm children;
16.17 	(vi) whether and how the online product, service, or feature uses system design features 
16.18 	to increase, sustain, or extend use of the online product, service, or feature by children, 
16.19 	including the automatic playing of media, rewards for time spent, and notifications; and
16.20 	(vii) whether, how, and for what purpose the online product, service, or feature collects 
16.21 	or processes personal data of children.
16.22 	(b) A data protection impact assessment conducted by a business for the purpose of 
16.23 	compliance with any other law complies with this section if the data protection impact 
16.24 	assessment meets the requirements of this chapter.
16.25 	(c) A single data protection impact assessment may contain multiple similar processing 
16.26 	operations that present similar risks only if each relevant online service, product, or feature 
16.27 	is addressed.
16.28 		Subd. 3.Prohibitions on businesses. A business that provides an online service, product, 
16.29 	or feature likely to be accessed by children must not:
16.30 	(1) use the personal data of any child in a way that the business knows, or has reason to 
16.31 	know, is materially detrimental to the physical health, mental health, or well-being of a 
16.32 	child;
17.1 	(2) profile a child by default unless both of the following criteria are met:
17.2 	(i) the business can demonstrate it has appropriate safeguards in place to protect children; 
17.3 	and
17.4 	(ii) either of the following is true:
17.5 	(A) profiling is necessary to provide the online service, product, or feature requested 
17.6 	and only with respect to the aspects of the online service, product, or feature with which a 
17.7 	child is actively and knowingly engaged; or
17.8 	(B) the business can demonstrate a compelling reason that profiling is in the best interests 
17.9 	of children;
17.10 	(3) collect, sell, share, or retain any personal data that is not necessary to provide an 
17.11 	online service, product, or feature with which a child is actively and knowingly engaged, 
17.12 	or as described below, unless the business can demonstrate a compelling reason that the 
17.13 	collecting, selling, sharing, or retaining of the personal data is in the best interests of children 
17.14 	likely to access the online service, product, or feature;
17.15 	(4) if the end user is a child, use personal data for any reason other than a reason for 
17.16 	which that personal data was collected, unless the business can demonstrate a compelling 
17.17 	reason that use of the personal data is in the best interests of children;
17.18 	(5) collect, sell, or share any precise geolocation information of children by default, 
17.19 	unless the collection of that precise geolocation information is strictly necessary for the 
17.20 	business to provide the service, product, or feature requested and then only for the limited 
17.21 	time that the collection of precise geolocation information is necessary to provide the service, 
17.22 	product, or feature;
17.23 	(6) collect any precise geolocation information of a child without providing an obvious 
17.24 	sign to the child for the duration of that collection that precise geolocation information is 
17.25 	being collected;
17.26 	(7) use dark patterns to lead or encourage children to provide personal data beyond what 
17.27 	is reasonably expected to provide that online service, product, or feature to forego privacy 
17.28 	protections, or to take any action that the business knows, or has reason to know, is materially 
17.29 	detrimental to the child's physical health, mental health, or well-being; or
17.30 	(8) use any personal data collected to estimate age or age range for any purpose other 
17.31 	than to fulfill the requirements of subdivision 1, clause (6), or retain that personal data longer 
17.32 	than necessary to estimate age. Age assurance must be proportionate to the risks and data 
17.33 	practice of an online service, product, or feature.
18.1 		Subd. 4.Data practices. (a) A data protection impact assessment collected or maintained 
18.2 	by the attorney general under subdivision 1 is classified as nonpublic data or private data 
18.3 	on individuals under section 13.02, subdivisions 9 and 12.
18.4 	(b) To the extent any information contained in a data protection impact assessment 
18.5 	disclosed to the attorney general includes information subject to attorney-client privilege 
18.6 	or work product protection, disclosure pursuant to this section does not constitute a waiver 
18.7 	of the privilege or protection.

18.8 	Sec. 6. [325O.05] ATTORNEY GENERAL ENFORCEMENT.
18.9 	(a) A business that violates this chapter may be subject to an injunction and liable for a 
18.10 	civil penalty of not more than $2,500 per affected child for each negligent violation, or not 
18.11 	more than $7,500 per affected child for each intentional violation, which may be assessed 
18.12 	and recovered only in a civil action brought by the attorney general in accordance with 
18.13 	section 8.31. If the state prevails in an action to enforce this chapter, the state may, in addition 
18.14 	to penalties provided by this paragraph or other remedies provided by law, be allowed an 
18.15 	amount determined by the court to be the reasonable value of all or part of the state's litigation 
18.16 	expenses incurred.
18.17 	(b) Any penalties, fees, and expenses recovered in an action brought under this chapter 
18.18 	must be deposited in an account in the special revenue fund and are appropriated to the 
18.19 	attorney general to offset costs incurred by the attorney general in connection with 
18.20 	enforcement of this chapter.
18.21 	(c) If a business is in substantial compliance with the requirements of section 325O.04, 
18.22 	subdivision 1, clauses (1) to (5), the attorney general must, before initiating a civil action 
18.23 	under this section, provide written notice to the business identifying the specific provisions 
18.24 	of this chapter that the attorney general alleges have been or are being violated. If, within 
18.25 	90 days of the notice required by this paragraph, the business cures any noticed violation 
18.26 	and provides the attorney general a written statement that the alleged violations have been 
18.27 	cured, and sufficient measures have been taken to prevent future violations, the business is 
18.28 	not liable for a civil penalty for any violation cured pursuant to this section.
18.29 	(d) Nothing in this chapter provides a private right of action under this chapter, section 
18.30 	8.31, or any other law.
18.31 	(e) Nothing in this chapter may be interpreted to impose liability in a manner that is 
18.32 	inconsistent with United States Code, title 47, section 230, or otherwise infringe on the 
18.33 	established rights and freedoms of children.

19.1 	Sec. 7. AGE-APPROPRIATE DESIGN; ATTORNEY GENERAL.
 19.2 	$142,000 in fiscal year 2024 and $142,000 in fiscal year 2025 are appropriated from the 
19.3 	general fund to the attorney general to enforce the Minnesota Age-Appropriate Design Code 
19.4 	Act.

19.5 	Sec. 8. EFFECTIVE DATE.
 19.6 	(a) Sections 1 to 6 are effective July 1, 2024.
19.7 	(b) By July 1, 2025, and as required by section 5, a business must complete a data 
19.8 	protection impact assessment for any online service, product, or feature likely to be accessed 
19.9 	by children offered to the public before July 1, 2024, unless that online service, product, or 
19.10 	feature is exempt under paragraph (c).
19.11 	(c) Sections 2 to 6 do not apply to an online service, product, or feature that is not offered 
19.12 	to the public on or after July 1, 2024.
19.13 	Delete the title and insert:
19.14 	A bill for an act
19.15 	relating to data privacy; addressing individual privacy rights regarding the 
19.16 	dissemination of fake content and images; providing for the Minnesota 
19.17 	Age-Appropriate Design Code Act; providing for penalties; appropriating money;
19.18 	proposing coding for new law in Minnesota Statutes, chapters 13; 604; 609; 617; 
19.19 	proposing coding for new law as Minnesota Statutes, chapter 325O.

20.1 | We request the adoption of this report and repassage of the bill.

20.2

House Conferees:
........

20.3 | ........ | | ........
20.4 | Zack Stephenson | | Kristin Bahner
20.5 | ........ | |
20.6 | Brian Pfarr | |

20.7

Senate Conferees:
........

20.8 | ........ | | ........
20.9 | Erin Maye Quade | | Matt Klein
20.10 | ........ | |
20.11 | Eric Lucero | |