1.1 	A bill for an act
1.2 	relating to consumer data privacy; creating the Minnesota Age-Appropriate Design 
1.3 	Code Act; placing obligations on certain businesses regarding children's consumer 
1.4 	information; providing for enforcement by the attorney general;proposing coding 
1.5 	for new law in Minnesota Statutes, chapter 13; proposing coding for new law as 
1.6 	Minnesota Statutes, chapter 325O.
1.7 	BE IT ENACTED BY THE LEGISLATURE OF THE STATE OF MINNESOTA:

1.8 	Section 1. [13.6505] ATTORNEY GENERAL DATA CODED ELSEWHERE.
1.9 		Subdivision 1.Scope. The sections referred to in this section are codified outside this 
1.10 	chapter. Those sections classify attorney general data as other than public, place restrictions 
1.11 	on access to government data, or involve data sharing.
1.12 		Subd. 2.Data protection impact assessments. A data protection impact assessment 
1.13 	collected or maintained by the attorney general under section 325O.04, is classified under 
1.14 	subdivision 4 of that section.

1.15 	Sec. 2. [325O.01] CITATION; CONSTRUCTION.
1.16 		Subdivision 1.Citation. This chapter may be cited as the "Minnesota Age-Appropriate 
1.17 	Design Code Act."
1.18 		Subd. 2.Construction. (a) A business that develops and provides online services, 
1.19 	products, or features that children are likely to access must consider the best interests of 
1.20 	children when designing, developing, and providing that online service, product, or feature.
2.1 	(b) If a conflict arises between commercial interests of a business and the best interests 
2.2 	of children likely to access an online product, service, or feature, the business must prioritize 
2.3 	the privacy, safety, and well-being of children over its commercial interests.

2.4 	Sec. 3. [325O.02] DEFINITIONS.
2.5 	(a) For purposes of this chapter, the following terms have the meanings given.
2.6 	(b) "Affiliate" means a legal entity that controls, is controlled by, or is under common 
2.7 	control with, that other legal entity. For these purposes, "control" or "controlled" means: 
2.8 	ownership of, or the power to vote, more than 50 percent of the outstanding shares of any 
2.9 	class of voting security of a company; control in any manner over the election of a majority 
2.10 	of the directors or of individuals exercising similar functions; or the power to exercise a 
2.11 	controlling influence over the management of a company.
2.12 	(c) "Business" means:
2.13 	(1) a sole proprietorship, partnership, limited liability company, corporation, association, 
2.14 	or other legal entity that is organized or operated for the profit or financial benefit of its 
2.15 	shareholders or other owners; and
2.16 	(2) an affiliate of a business that shares common branding with the business. For purposes 
2.17 	of this clause, "common branding" means a shared name, servicemark, or trademark that 
2.18 	the average consumer would understand that two or more entities are commonly owned.
2.19 	For purposes of this chapter, for a joint venture or partnership composed of businesses in 
2.20 	which each business has at least a 40 percent interest, the joint venture or partnership and 
2.21 	each business that composes the joint venture or partnership shall separately be considered 
2.22 	a single business, except that personal data in the possession of each business and disclosed 
2.23 	to the joint venture or partnership must not be shared with the other business.
2.24 	(d) "Child" means a consumer who is under 18 years of age.
2.25 	(e) "Collect" means buying, renting, gathering, obtaining, receiving, or accessing any 
2.26 	personal data pertaining to a consumer by any means. This includes receiving data from the 
2.27 	consumer, either actively or passively, or by observing the consumer's behavior.
2.28 	(f) "Consumer" means a natural person who is a Minnesota resident, however identified, 
2.29 	including by any unique identifier.
2.30 	(g) "Dark pattern" means a user interface designed or manipulated with the substantial 
2.31 	effect of subverting or impairing user autonomy, decision making, or choice.
3.1 	(h) "Data protection impact assessment" means a systematic survey to assess and mitigate 
3.2 	risks to children who are reasonably likely to access the online service, product, or feature 
3.3 	that arise from the data management practices of the business.
3.4 	(i) "Default" means a preselected option adopted by the business for the online service, 
3.5 	product, or feature.
3.6 	(j) "Deidentified" means data that cannot reasonably be used to infer information about, 
3.7 	or otherwise be linked to, an identified or identifiable natural person, or a device linked to 
3.8 	such person, provided that the business that possesses the data:
3.9 	(1) takes reasonable measures to ensure that the data cannot be associated with a natural 
3.10 	person;
3.11 	(2) publicly commits to maintain and use the data only in a deidentified fashion and not 
3.12 	attempt to reidentify the data; and
3.13 	(3) contractually obligates any recipients of the data to comply with all provisions of 
3.14 	this paragraph.
3.15 	(k) "Likely to be accessed by children" means an online service, product, or feature that 
3.16 	it is reasonable to expect would be accessed by children based on any of the following 
3.17 	indicators:
3.18 	(1) the online service, product, or feature is directed to children, as defined by the 
3.19 	Children's Online Privacy Protection Act, United States Code, title 15, section 6501 et seq.;
3.20 	(2) the online service, product, or feature is determined, based on competent and reliable 
3.21 	evidence regarding audience composition, to be routinely accessed by a significant number 
3.22 	of children;
3.23 	(3) the online service, product, or feature contains advertisements marketed to children;
3.24 	(4) the online service, product, or feature is substantially similar or the same as an online 
3.25 	service, product, or feature subject to clause (2);
3.26 	(5) the online service, product, or feature has design elements that are known to be of 
3.27 	interest to children, including but not limited to games, cartoons, music, and celebrities who 
3.28 	appeal to children; or
3.29 	(6) a significant amount of the audience of the online service, product, or feature is 
3.30 	determined, based on internal company research, to be children.
3.31 	(l) "Online service, product, or feature" does not mean any of the following:
4.1 	(1) telecommunications service, as defined in United States Code, title 47, section 153;
4.2 	(2) a broadband service as defined by section 116J.39, subdivision 1; or
4.3 	(3) the delivery or use of a physical product.
4.4 	(m) "Personal data" means any information that is linked or reasonably linkable to an 
4.5 	identified or identifiable natural person. Personal data does not include deidentified data or 
4.6 	publicly available information. For purposes of this paragraph, "publicly available 
4.7 	information" means information that (1) is lawfully made available from federal, state, or 
4.8 	local government records or widely distributed media, and (2) a controller has a reasonable 
4.9 	basis to believe a consumer has lawfully made available to the general public.
4.10 	(n) "Precise geolocation" means any data that is derived from a device and that is used 
4.11 	or intended to be used to locate a consumer within a geographic area that is equal to or less 
4.12 	than the area of a circle with a radius of 1,850 feet, except as prescribed by regulations.
4.13 	(o) "Process" or "processing" means any operation or set of operations that are performed 
4.14 	on personal data or on sets of personal data, whether or not by automated means, such as 
4.15 	the collection, use, storage, disclosure, analysis, deletion, or modification of personal data.
4.16 	(p) "Profiling" means any form of automated processing of personal data to evaluate, 
4.17 	analyze, or predict personal aspects concerning an identified or identifiable natural person's 
4.18 	economic situation, health, personal preferences, interests, reliability, behavior, location, 
4.19 	or movements.
4.20 	(q) "Sale," "sell," or "sold" means the exchange of personal data for monetary or other 
4.21 	valuable consideration by a business to a third party. Sale does not include the following:
4.22 	(1) the disclosure of personal data to a third party who processes the personal data on 
4.23 	behalf of the business;
4.24 	(2) the disclosure of personal data to a third party with whom the consumer has a direct 
4.25 	relationship for purposes of providing a product or service requested by the consumer;
4.26 	(3) the disclosure or transfer of personal data to an affiliate of the business;
4.27 	(4) the disclosure of data that the consumer intentionally made available to the general 
4.28 	public via a channel of mass media and did not restrict to a specific audience; or
4.29 	(5) the disclosure or transfer of personal data to a third party as an asset that is part of a 
4.30 	completed or proposed merger, acquisition, bankruptcy, or other transaction in which the 
4.31 	third party assumes control of all or part of the business's assets.
5.1 	(r) "Share" means sharing, renting, releasing, disclosing, disseminating, making available, 
5.2 	transferring, or otherwise communicating orally, in writing, or by electronic or other means 
5.3 	a consumer's personal data by the business to a third party for cross-context behavioral 
5.4 	advertising, whether or not for monetary or other valuable consideration, including 
5.5 	transactions between a business and a third party for cross-context behavioral advertising 
5.6 	for the benefit of a business in which no money is exchanged.
5.7 	(s) "Third party" means a natural or legal person, public authority, agency, or body other 
5.8 	than the consumer or the business.

5.9 	Sec. 4. [325O.03] SCOPE; EXCLUSIONS.
5.10 	(a) A business is subject to this chapter if it:
5.11 	(1) collects consumers' personal data or has consumers' personal data collected on its 
5.12 	behalf by a third party;
5.13 	(2) alone or jointly with others, determines the purposes and means of the processing 
5.14 	of consumers' personal data;
5.15 	(3) does business in Minnesota; and
5.16 	(4) satisfies one or more of the following thresholds:
5.17 	(i) has annual gross revenues in excess of $25,000,000, as adjusted every odd-numbered 
5.18 	year to reflect the Consumer Price Index;
5.19 	(ii) alone or in combination, annually buys, receives for the business's commercial 
5.20 	purposes, sells, or shares for commercial purposes, alone or in combination, the personal 
5.21 	data of 50,000 or more consumers, households, or devices; or
5.22 	(iii) derives 50 percent or more of its annual revenues from selling consumers' personal 
5.23 	data.
5.24 	(b) This chapter does not apply to:
5.25 	(1) protected health information that is collected by a covered entity or business associate 
5.26 	governed by the privacy, security, and breach notification rules issued by the United States 
5.27 	Department of Health and Human Services, Code of Federal Regulations, title 45, parts 160 
5.28 	and 164, established pursuant to the Health Insurance Portability and Accountability Act 
5.29 	of 1996, Public Law 104-191, and the Health Information Technology for Economic and 
5.30 	Clinical Health Act, Public Law 111-5;
6.1 	(2) a covered entity governed by the privacy, security, and breach notification rules 
6.2 	issued by the United States Department of Health and Human Services, Code of Federal 
6.3 	Regulations, title 45, parts 160 and 164, established pursuant to the Health Insurance 
6.4 	Portability and Accountability Act of 1996, Public Law 104-191, to the extent the provider 
6.5 	or covered entity maintains patient information in the same manner as medical information 
6.6 	or protected health information as described in clause (1); or
6.7 	(3) information collected as part of a clinical trial subject to the federal policy for the 
6.8 	protection of human subjects, also known as the common rule, pursuant to good clinical 
6.9 	practice guidelines issued by the International Council for Harmonisation or pursuant to 
6.10 	human subject protection requirements of the United States Food and Drug Administration.

6.11 	Sec. 5. [325O.04] BUSINESS OBLIGATIONS.
6.12 		Subdivision 1.Requirements for businesses. A business that provides an online service, 
6.13 	product, or feature likely to be accessed by children must:
6.14 	(1) before any new online services, products, or features are offered to the public, 
6.15 	complete a data protection impact assessment for any online service, product, or feature 
6.16 	likely to be accessed by children and maintain documentation of this assessment as long as 
6.17 	the online service, product, or feature is likely to be accessed by children;
6.18 	(2) biennially review all data protection impact assessments;
6.19 	(3) document any risk of material detriment to children that arises from the data 
6.20 	management practices of the business identified in the data protection impact assessment 
6.21 	required by clause (1) and create a timed plan to mitigate or eliminate the risk before the 
6.22 	online service, product, or feature is accessed by children;
6.23 	(4) within three business days of a written request by the attorney general, provide to 
6.24 	the attorney general a list of all data protection impact assessments the business has 
6.25 	completed;
6.26 	(5) within five business days of a written request by the attorney general, provide the 
6.27 	attorney general with a copy of any data protection impact assessment;
6.28 	(6) estimate the age of child users with a reasonable level of certainty appropriate to the 
6.29 	risks that arise from the data management practices of the business or apply the privacy and 
6.30 	data protections afforded to children to all consumers;
7.1 	(7) configure all default privacy settings provided to children by the online service, 
7.2 	product, or feature to settings that offer a high level of privacy, unless the business can 
7.3 	demonstrate a compelling reason that a different setting is in the best interests of children;
7.4 	(8) provide any privacy information, terms of service, policies, and community standards 
7.5 	concisely, prominently, and using clear language suited to the age of children likely to 
7.6 	access that online service, product, or feature;
7.7 	(9) if the online service, product, or feature allows a child's parent, guardian, or any 
7.8 	other consumer to monitor the child's online activity or track the child's location, provide 
7.9 	an obvious signal to the child when the child is being monitored or tracked;
7.10 	(10) enforce published terms, policies, and community standards established by the 
7.11 	business, including but not limited to privacy policies and those concerning children; and
7.12 	(11) provide prominent, accessible, and responsive tools to help children, or if applicable 
7.13 	their parents or guardians, exercise their privacy rights and report concerns.
7.14 		Subd. 2.Data protection impact assessments; requirements. (a) A data protection 
7.15 	impact assessment required by this section must:
7.16 	(1) identify the purpose of the online service, product, or feature; how it uses children's 
7.17 	personal data; and the risks of material detriment to children that arise from the data 
7.18 	management practices of the business; and
7.19 	(2) address, to the extent applicable:
7.20 	(i) whether the design of the online product, service, or feature could harm children, 
7.21 	including by exposing children to harmful, or potentially harmful, content on the online 
7.22 	product, service, or feature;
7.23 	(ii) whether the design of the online product, service, or feature could lead to children 
7.24 	experiencing or being targeted by harmful, or potentially harmful, contacts on the online 
7.25 	product, service, or feature;
7.26 	(iii) whether the design of the online product, service, or feature could permit children 
7.27 	to witness, participate in, or be subject to harmful, or potentially harmful, conduct on the 
7.28 	online product, service, or feature;
7.29 	(iv) whether the design of the online product, service, or feature could allow children 
7.30 	to be party to or exploited by a harmful, or potentially harmful, contact on the online product, 
7.31 	service, or feature;
7.32 	(v) whether algorithms used by the online product, service, or feature could harm children;
8.1 	(vi) whether targeted advertising systems used by the online product, service, or feature 
8.2 	could harm children;
8.3 	(vii) whether and how the online product, service, or feature uses system design features 
8.4 	to increase, sustain, or extend use of the online product, service, or feature by children, 
8.5 	including the automatic playing of media, rewards for time spent, and notifications; and
8.6 	(viii) whether, how, and for what purpose the online product, service, or feature collects 
8.7 	or processes personal data of children.
8.8 	(b) A data protection impact assessment conducted by a business for the purpose of 
8.9 	compliance with any other law complies with this section if the data protection impact 
8.10 	assessment meets the requirements of this chapter.
8.11 	(c) A single data protection impact assessment may contain multiple similar processing 
8.12 	operations that present similar risks only if each relevant online service, product, or feature 
8.13 	is addressed.
8.14 		Subd. 3.Prohibitions on businesses. A business that provides an online service, product, 
8.15 	or feature likely to be accessed by children must not:
8.16 	(1) use the personal data of any child in a way that the business knows, or has reason to 
8.17 	know, is materially detrimental to the physical health, mental health, or well-being of a 
8.18 	child;
8.19 	(2) profile a child by default unless both of the following criteria are met:
8.20 	(i) the business can demonstrate it has appropriate safeguards in place to protect children; 
8.21 	and
8.22 	(ii) either of the following is true:
8.23 	(A) profiling is necessary to provide the online service, product, or feature requested 
8.24 	and only with respect to the aspects of the online service, product, or feature with which a 
8.25 	child is actively and knowingly engaged; or
8.26 	(B) the business can demonstrate a compelling reason that profiling is in the best interests 
8.27 	of children;
8.28 	(3) collect, sell, share, or retain any personal data that is not necessary to provide an 
8.29 	online service, product, or feature with which a child is actively and knowingly engaged, 
8.30 	or as described below, unless the business can demonstrate a compelling reason that the 
8.31 	collecting, selling, sharing, or retaining of the personal data is in the best interests of children 
8.32 	likely to access the online service, product, or feature;
9.1 	(4) if the end user is a child, use personal data for any reason other than a reason for 
9.2 	which that personal data was collected, unless the business can demonstrate a compelling 
9.3 	reason that use of the personal data is in the best interests of children;
9.4 	(5) collect, sell, or share any precise geolocation information of children by default, 
9.5 	unless the collection of that precise geolocation information is strictly necessary for the 
9.6 	business to provide the service, product, or feature requested and then only for the limited 
9.7 	time that the collection of precise geolocation information is necessary to provide the service, 
9.8 	product, or feature;
9.9 	(6) collect any precise geolocation information of a child without providing an obvious 
9.10 	sign to the child for the duration of that collection that precise geolocation information is 
9.11 	being collected;
9.12 	(7) use dark patterns to lead or encourage children to provide personal data beyond what 
9.13 	is reasonably expected to provide that online service, product, or feature to forego privacy 
9.14 	protections, or to take any action that the business knows, or has reason to know, is materially 
9.15 	detrimental to the child's physical health, mental health, or well-being; or
9.16 	(8) use any personal data collected to estimate age or age range for any purpose other 
9.17 	than to fulfill the requirements of subdivision 1, clause (6), or retain that personal data longer 
9.18 	than necessary to estimate age. Age assurance must be proportionate to the risks and data 
9.19 	practice of an online service, product, or feature.
9.20 		Subd. 4.Data practices. (a) A data protection impact assessment collected or maintained 
9.21 	by the attorney general under subdivision 1 is classified as nonpublic data or private data 
9.22 	on individuals under section 13.02, subdivisions 9 and 12.
9.23 	(b) To the extent any information contained in a data protection impact assessment 
9.24 	disclosed to the attorney general includes information subject to attorney-client privilege 
9.25 	or work product protection, disclosure pursuant to this section does not constitute a waiver 
9.26 	of that privilege or protection.

9.27 	Sec. 6. [325O.05] ATTORNEY GENERAL ENFORCEMENT.
9.28 	(a) A business that violates this chapter may be subject to an injunction and liable for a 
9.29 	civil penalty of not more than $2,500 per affected child for each negligent violation, or not 
9.30 	more than $7,500 per affected child for each intentional violation, which may be assessed 
9.31 	and recovered only in a civil action brought by the attorney general in accordance with 
9.32 	section 8.31. If the state prevails in an action to enforce this chapter, the state may, in addition 
9.33 	to penalties provided by this paragraph or other remedies provided by law, be allowed an 
10.1 	amount determined by the court to be the reasonable value of all or part of the state's litigation 
10.2 	expenses incurred.
10.3 	(b) Any penalties, fees, and expenses recovered in an action brought under this chapter 
10.4 	must be deposited in an account in the special revenue fund and are appropriated to the 
10.5 	attorney general to offset costs incurred by the attorney general in connection with 
10.6 	enforcement of this chapter.
10.7 	(c) If a business is in substantial compliance with the requirements of section 325O.04, 
10.8 	subdivision 1, clauses (1) to (5), the attorney general must, before initiating a civil action 
10.9 	under this section, provide written notice to the business identifying the specific provisions 
10.10 	of this chapter that the attorney general alleges have been or are being violated. If, within 
10.11 	90 days of the notice required by this paragraph, the business cures any noticed violation 
10.12 	and provides the attorney general a written statement that the alleged violations have been 
10.13 	cured, and sufficient measures have been taken to prevent future violations, the business is 
10.14 	not liable for a civil penalty for any violation cured pursuant to this section.
10.15 	(d) Nothing in this chapter provides a private right of action under this chapter, section 
10.16 	8.31, or any other law.

10.17 	Sec. 7. EFFECTIVE DATE.
 10.18 	(a) This act is effective July 1, 2024.
10.19 	(b) By July 1, 2025, a business must complete a data protection impact assessment for 
10.20 	any online service, product, or feature likely to be accessed by children offered to the public 
10.21 	before July 1, 2024, unless that online service, product, or feature is exempt under paragraph 
10.22 	(c).
10.23 	(c) This act does not apply to an online service, product, or feature that is not offered to 
10.24 	the public on or after July 1, 2024.