1.1 	A bill for an act
1.2 	relating to consumer data privacy; creating the Minnesota Age-Appropriate Design 
1.3 	Code Act; placing obligations on certain businesses regarding children's consumer 
1.4 	information; providing for enforcement by the attorney general;proposing coding 
1.5 	for new law in Minnesota Statutes, chapter 13; proposing coding for new law as 
1.6 	Minnesota Statutes, chapter 325O.
1.7 	BE IT ENACTED BY THE LEGISLATURE OF THE STATE OF MINNESOTA:

1.8 	Section 1. [13.6505] ATTORNEY GENERAL DATA CODED ELSEWHERE.
1.9 		Subdivision 1.Scope. The sections referred to in this section are codified outside this 
1.10 	chapter. Those sections classify attorney general data as other than public, place restrictions 
1.11 	on access to government data, or involve data sharing.
1.12 		Subd. 2.Data protection impact assessments. A data protection impact assessment 
1.13 	collected or maintained by the attorney general under section 325O.04, is classified under 
1.14 	subdivision 3 of that section.

1.15 	Sec. 2. [325O.01] CITATION; CONSTRUCTION.
1.16 		Subdivision 1.Citation. This chapter may be cited as the "Minnesota Age-Appropriate 
1.17 	Design Code Act."
1.18 		Subd. 2.Construction. (a) A business that develops and provides online services, 
1.19 	products, or features that children are reasonably likely to access must consider the best 
1.20 	interests of children when designing, developing, and providing that online service, product, 
1.21 	or feature.
2.1 	(b) If a conflict arises between commercial interests of a business and the best interests 
2.2 	of children likely to access an online product, service, or feature, the business must prioritize 
2.3 	the privacy, safety, and well-being of children over its commercial interests.

2.4 	Sec. 3. [325O.02] DEFINITIONS.
2.5 	(a) For purposes of this chapter, the following terms have the meanings given.
2.6 	(b) "Affiliate" means a legal entity that controls, is controlled by, or is under common 
2.7 	control with, that other legal entity. For these purposes, "control" or "controlled" means: 
2.8 	ownership of, or the power to vote, more than 50 percent of the outstanding shares of any 
2.9 	class of voting security of a company; control in any manner over the election of a majority 
2.10 	of the directors or of individuals exercising similar functions; or the power to exercise a 
2.11 	controlling influence over the management of a company.
2.12 	(c) "Age-appropriate" means a recognition of the distinct needs and diversities of children 
2.13 	at different age ranges. In order to help support the design of online services, products, and 
2.14 	features, a business should take into account the unique needs and diversities of different 
2.15 	age ranges, including the following developmental stages: zero to five years of age or 
2.16 	"preliterate and early literacy"; six to nine years of age or "core primary school years"; ten 
2.17 	to 12 years of age or "transition years"; 13 to 15 years of age or "early teens"; and 16 to 17 
2.18 	years of age or "approaching adulthood."
2.19 	(d) "Best interests of children" means the use, by a business, of the personal data of a 
2.20 	child or the design of an online service, product, or feature in a way that:
2.21 	(1) will not benefit the business to the detriment of the child; and
2.22 	(2) will not result in:
2.23 	(i) reasonably foreseeable and material physical or financial harm to the child;
2.24 	(ii) reasonably foreseeable and severe psychological or emotional harm to the child;
2.25 	(iii) a highly offensive intrusion on the reasonable privacy expectations of the child; or
2.26 	(iv) discrimination against the child based upon race, color, religion, national origin, 
2.27 	disability, sex, or sexual orientation.
2.28 	(e) "Business" means:
2.29 	(1) a sole proprietorship, partnership, limited liability company, corporation, association, 
2.30 	or other legal entity that is organized or operated for the profit or financial benefit of its 
2.31 	shareholders or other owners; and
3.1 	(2) an affiliate of a business that shares common branding with the business. For purposes 
3.2 	of this clause, "common branding" means a shared name, servicemark, or trademark that 
3.3 	the average consumer would understand that two or more entities are commonly owned.
3.4 	For purposes of this chapter, for a joint venture or partnership composed of businesses in 
3.5 	which each business has at least a 40 percent interest, the joint venture or partnership and 
3.6 	each business that composes the joint venture or partnership shall separately be considered 
3.7 	a single business, except that personal data in the possession of each business and disclosed 
3.8 	to the joint venture or partnership must not be shared with the other business.
3.9 	(f) "Child" means a consumer who is under 18 years of age.
3.10 	(g) "Collect" means buying, renting, gathering, obtaining, receiving, or accessing any 
3.11 	personal data pertaining to a consumer by any means. This includes receiving data from the 
3.12 	consumer, either actively or passively, or by observing the consumer's behavior.
3.13 	(h) "Consumer" means a natural person who is a Minnesota resident, however identified, 
3.14 	including by any unique identifier.
3.15 	(i) "Dark pattern" means a user interface designed or manipulated with the purpose of 
3.16 	subverting or impairing user autonomy, decision making, or choice.
3.17 	(j) "Data protection impact assessment" means a systematic survey to assess compliance 
3.18 	with the duty to act in the best interests of children and shall include a plan to ensure that 
3.19 	all online products, services, or features provided by the business are designed and offered 
3.20 	in a manner consistent with the best interests of children reasonably likely to access the 
3.21 	online service, product, or feature. Such a plan shall include a description of steps the 
3.22 	business has taken and will take to comply with the duty to act in the best interests of 
3.23 	children.
3.24 	(k) "Default" means a preselected option adopted by the business for the online service, 
3.25 	product, or feature.
3.26 	(l) "Deidentified" means data that cannot reasonably be used to infer information about, 
3.27 	or otherwise be linked to, an identified or identifiable natural person, or a device linked to 
3.28 	such person, provided that the business that possesses the data:
3.29 	(1) takes reasonable measures to ensure that the data cannot be associated with a natural 
3.30 	person;
3.31 	(2) publicly commits to maintain and use the data only in a deidentified fashion and not 
3.32 	attempt to reidentify the data; and
4.1 	(3) contractually obligates any recipients of the data to comply with all provisions of 
4.2 	this paragraph.
4.3 	(m) "Derived data" means assumptions, correlations, inferences, predictions, or 
4.4 	conclusions based on data about a child or a child's device.
4.5 	(n) "Online service, product, or feature" does not mean any of the following:
4.6 	(1) telecommunications service, as defined in United States Code, title 47, section 153;
4.7 	(2) a broadband service as defined by section 116J.39, subdivision 1; or
4.8 	(3) the delivery, sale, or use of a physical product.
4.9 	(o) "Personal data" means any information, including derived data, that is linked or 
4.10 	reasonably linkable, alone or in combination with other information, to an identified or 
4.11 	identifiable natural person. Personal data does not include deidentified data or publicly 
4.12 	available information. For purposes of this paragraph, "publicly available information" 
4.13 	means information that (1) is lawfully made available from federal, state, or local government 
4.14 	records or widely distributed media, and (2) a controller has a reasonable basis to believe 
4.15 	a consumer has lawfully made available to the general public.
4.16 	(p) "Precise geolocation" means any data that is derived from a device and that is used 
4.17 	or intended to be used to locate a consumer within a geographic area that is equal to or less 
4.18 	than the area of a circle with a radius of 1,850 feet, except as prescribed by regulations.
4.19 	(q) "Process" or "processing" means to conduct or direct any operation or set of operations 
4.20 	that are performed on personal data or on sets of personal data, whether or not by automated 
4.21 	means, such as the collection, use, storage, disclosure, analysis, deletion, modification, or 
4.22 	otherwise handling of personal data.
4.23 	(r) "Product experimentation results" means the data that a business collects to understand 
4.24 	the experimental impact of its products.
4.25 	(s) "Profiling" means any form of automated processing of personal data to evaluate, 
4.26 	analyze, or predict personal aspects concerning an identified or identifiable natural person's 
4.27 	economic situation, health, personal preferences, interests, reliability, behavior, location, 
4.28 	or movements.
4.29 	(t) "Reasonably likely to be accessed by children" means an online service, product, or 
4.30 	feature that it is reasonable to expect would be accessed by children based on any of the 
4.31 	following indicators:
5.1 	(1) the online service, product, or feature is directed to children, as defined by the 
5.2 	Children's Online Privacy Protection Act, United States Code, title 15, section 6501 et seq., 
5.3 	and the Federal Trade Commission rules implementing that act;
5.4 	(2) the online service, product, or feature is determined, based on competent and reliable 
5.5 	evidence regarding audience composition, to be routinely accessed by a significant number 
5.6 	of children;
5.7 	(3) the online service, product, or feature contains advertisements marketed to children;
5.8 	(4) the online service, product, or feature is substantially similar or the same as an online 
5.9 	service, product, or feature subject to clause (2);
5.10 	(5) a significant amount of the audience of the online service, product, or feature is 
5.11 	determined, based on internal company research, to be children; or
5.12 	(6) that the business knew or should have known that a significant number of users are 
5.13 	children, provided that, in making this assessment, the business shall not collect or process 
5.14 	any personal data that is not reasonably necessary to provide an online service, product, or 
5.15 	feature with which a child is actively and knowingly engaged.
5.16 	(u) "Sale," "sell," or "sold" means the exchange of personal data for monetary or other 
5.17 	valuable consideration by a business to a third party. Sale does not include the following:
5.18 	(1) the disclosure of personal data to a third party who processes the personal data on 
5.19 	behalf of the business;
5.20 	(2) the disclosure of personal data to a third party with whom the consumer has a direct 
5.21 	relationship for purposes of providing a product or service requested by the consumer;
5.22 	(3) the disclosure or transfer of personal data to an affiliate of the business;
5.23 	(4) the disclosure of data that the consumer intentionally made available to the general 
5.24 	public via a channel of mass media and did not restrict to a specific audience; or
5.25 	(5) the disclosure or transfer of personal data to a third party as an asset that is part of a 
5.26 	completed or proposed merger, acquisition, bankruptcy, or other transaction in which the 
5.27 	third party assumes control of all or part of the business's assets.
5.28 	(v) "Share" means sharing, renting, releasing, disclosing, disseminating, making available, 
5.29 	transferring, or otherwise communicating orally, in writing, or by electronic or other means 
5.30 	a consumer's personal data by the business to a third party for cross-context behavioral 
5.31 	advertising, whether or not for monetary or other valuable consideration, including 
6.1 	transactions between a business and a third party for cross-context behavioral advertising 
6.2 	for the benefit of a business in which no money is exchanged.
6.3 	(w) "Third party" means a natural or legal person, public authority, agency, or body 
6.4 	other than the consumer or the business.

6.5 	Sec. 4. [325O.025] INFORMATION FIDUCIARY.
6.6 	Notwithstanding section 325O.03, any business that operates in the state of Minnesota 
6.7 	and processes children's data in any capacity must do so in a manner consistent with the 
6.8 	best interests of children.

6.9 	Sec. 5. [325O.03] SCOPE; EXCLUSIONS.
6.10 	(a) A business is subject to this chapter if it:
6.11 	(1) collects consumers' personal data or has consumers' personal data collected on its 
6.12 	behalf by a third party;
6.13 	(2) alone or jointly with others, determines the purposes and means of the processing 
6.14 	of consumers' personal data;
6.15 	(3) does business in Minnesota; and
6.16 	(4) satisfies one or more of the following thresholds:
6.17 	(i) has annual gross revenues in excess of $25,000,000, as adjusted every odd-numbered 
6.18 	year to reflect the Consumer Price Index;
6.19 	(ii) alone or in combination, annually buys, receives for the business's commercial 
6.20 	purposes, sells, or shares for commercial purposes, alone or in combination, the personal 
6.21 	data of 50,000 or more consumers, households, or devices; or
6.22 	(iii) derives 50 percent or more of its annual revenues from selling consumers' personal 
6.23 	data.
6.24 	(b) This chapter does not apply to:
6.25 	(1) protected health information that is collected by a covered entity or business associate 
6.26 	governed by the privacy, security, and breach notification rules issued by the United States 
6.27 	Department of Health and Human Services, Code of Federal Regulations, title 45, parts 160 
6.28 	and 164, established pursuant to the Health Insurance Portability and Accountability Act 
6.29 	of 1996, Public Law 104-191, and the Health Information Technology for Economic and 
6.30 	Clinical Health Act, Public Law 111-5;
7.1 	(2) a covered entity governed by the privacy, security, and breach notification rules 
7.2 	issued by the United States Department of Health and Human Services, Code of Federal 
7.3 	Regulations, title 45, parts 160 and 164, established pursuant to the Health Insurance 
7.4 	Portability and Accountability Act of 1996, Public Law 104-191, to the extent the provider 
7.5 	or covered entity maintains patient information in the same manner as medical information 
7.6 	or protected health information as described in clause (1);
7.7 	(3) information collected as part of a clinical trial subject to the federal policy for the 
7.8 	protection of human subjects, also known as the common rule, pursuant to good clinical 
7.9 	practice guidelines issued by the International Council for Harmonisation or pursuant to 
7.10 	human subject protection requirements of the United States Food and Drug Administration; 
7.11 	or
7.12 	(4) a business whose principal business is the origination of journalism, and has a 
7.13 	significant portion of its workforce consisting of professional journalists.

7.14 	Sec. 6. [325O.04] BUSINESS OBLIGATIONS.
7.15 		Subdivision 1.Requirements for businesses. (a) A business subject to this chapter 
7.16 	must:
7.17 	(1) complete a data protection impact assessment for any new online service, product, 
7.18 	or feature that is reasonably likely to be to accessed by children, and maintain documentation 
7.19 	of the data protection impact assessment as long as the online service, product, or feature 
7.20 	is reasonably likely to be accessed by children;
7.21 	(2) review and modify all data protection impact assessments as necessary to account 
7.22 	for material changes to processing pertaining to the online service, product, or feature;
7.23 	(3) within five business days of a written request by the attorney general, provide to the 
7.24 	attorney general a list of all data protection impact assessments the business has completed;
7.25 	(4) within seven business days of a written request by the attorney general or by a date 
7.26 	otherwise specified by the attorney general, provide the attorney general with a copy of any 
7.27 	data protection impact assessment;
7.28 	(5) configure all default privacy settings provided to children by the online service, 
7.29 	product, or feature to settings that offer a high level of privacy, unless the business can 
7.30 	demonstrate a compelling reason that a different setting is in the best interests of children;
8.1 	(6) provide any privacy information, terms of service, policies, and community standards 
8.2 	concisely, prominently, and using clear language suited to the age of children reasonably 
8.3 	likely to access that online service, product, or feature; and
8.4 	(7) provide prominent, accessible, and responsive tools to help children, or if applicable 
8.5 	their parents or guardians, exercise their privacy rights and report concerns.
8.6 	(b) A data protection impact assessment required by this section must identify the purpose 
8.7 	of the online service, product, or feature; explain how it uses children's personal data; and 
8.8 	determine whether the online service, product, or feature that is reasonably likely to accessed 
8.9 	by children is designed and offered in an age-appropriate manner consistent with the best 
8.10 	interests of children. A data protection impact assessment must assess each of the following 
8.11 	factors:
8.12 	(1) whether algorithms used by the service, product, or feature would result in reasonably 
8.13 	foreseeable and material physical or financial harm to the child; reasonably foreseeable and 
8.14 	extreme psychological or emotional harm to the child; a highly offensive intrusion on the 
8.15 	reasonable privacy expectations of the child; or discrimination against the child based upon 
8.16 	race, color, religion, national origin, disability, sex, or sexual orientation;
8.17 	(2) whether the design of the online service, product, or feature could lead to children 
8.18 	experiencing or being targeted by contacts on the online service, product, or feature that 
8.19 	would result in reasonably foreseeable and material physical or financial harm to the child; 
8.20 	reasonably foreseeable and extreme psychological or emotional harm to the child; a highly 
8.21 	offensive intrusion on the reasonable privacy expectations of the child; or discrimination 
8.22 	against the child based upon race, color, religion, national origin, disability, sex, or sexual 
8.23 	orientation;
8.24 	(3) whether the design of the online service, product, or feature could permit children 
8.25 	to witness, participate in, or be subject to conduct on the online service, product, or feature 
8.26 	that would result in reasonably foreseeable and material physical or financial harm to the 
8.27 	child; reasonably foreseeable and extreme psychological or emotional harm to the child; a 
8.28 	highly offensive intrusion on the reasonable privacy expectations of the child; or 
8.29 	discrimination against the child based upon race, color, religion, national origin, disability, 
8.30 	sex, or sexual orientation;
8.31 	(4) whether the design of the online service, product, or feature is reasonably expected 
8.32 	to allow children to be party to or exploited by a contact on the online service, product, or 
8.33 	feature that would result in reasonably foreseeable and material physical or financial harm 
8.34 	to the child; reasonably foreseeable and extreme psychological or emotional harm to the 
9.1 	child; a highly offensive intrusion on the reasonable privacy expectations of the child; or 
9.2 	discrimination against the child based upon race, color, religion, national origin, disability, 
9.3 	sex, or sexual orientation;
9.4 	(5) whether targeted advertising systems used by the online service, product, or feature 
9.5 	would result in reasonably foreseeable and material physical or financial harm to the child; 
9.6 	reasonably foreseeable and extreme psychological or emotional harm to the child; a highly 
9.7 	offensive intrusion on the reasonable privacy expectations of the child; or discrimination 
9.8 	against the child based upon race, color, religion, national origin, disability, sex, or sexual 
9.9 	orientation;
9.10 	(6) whether the online service, product, or feature uses system design features to increase, 
9.11 	sustain, or extend use of the online service, product, or feature by children, including the 
9.12 	automatic playing of media, rewards for time spent, and notifications, that would result in 
9.13 	reasonably foreseeable and material physical or financial harm to the child; reasonably 
9.14 	foreseeable and extreme psychological or emotional harm to the child; a highly offensive 
9.15 	intrusion on the reasonable privacy expectations of the child; or discrimination against the 
9.16 	child based upon race, color, religion, national origin, disability, sex, or sexual orientation;
9.17 	(7) whether, how, and for what purpose the online service, product, or feature collects 
9.18 	or processes personal data of children, and whether those practices would result in reasonably 
9.19 	foreseeable and material physical or financial harm to the child; reasonably foreseeable and 
9.20 	extreme psychological or emotional harm to the child; a highly offensive intrusion on the 
9.21 	reasonable privacy expectations of the child; or discrimination against the child based upon 
9.22 	race, color, religion, national origin, disability, sex, or sexual orientation; and
9.23 	(8) whether and how product experimentation results for the online product, service, or 
9.24 	feature reveal data management or design practices that would result in reasonably 
9.25 	foreseeable and material physical or financial harm to the child; reasonably foreseeable and 
9.26 	extreme psychological or emotional harm to the child; a highly offensive intrusion on the 
9.27 	reasonable privacy expectations of the child; or discrimination against the child based upon 
9.28 	race, color, religion, national origin, disability, sex, or sexual orientation.
9.29 	(c) A data protection impact assessment conducted by a business for the purpose of 
9.30 	compliance with any other law complies with this section if the data protection impact 
9.31 	assessment meets the requirement of this chapter.
9.32 	(d) A single data protection impact assessment may contain multiple similar processing 
9.33 	operations that present similar risk only if each relevant online service, product, or feature 
9.34 	is addressed.
10.1 	(e) For purposes of estimating a child's age, a business must only process the minimal 
10.2 	amount of personal data reasonably necessary to provide the online service, product, or 
10.3 	feature with which the child is actively and knowingly engaged.
10.4 		Subd. 2.Prohibition on businesses. A business that provides an online service, product, 
10.5 	or feature reasonably likely to be accessed by children must not:
10.6 	(1) process the personal data of any child in a way that is inconsistent with the best 
10.7 	interests of children reasonably likely to access the online service, product, or feature;
10.8 	(2) profile a child by default unless both of the following criteria are met:
10.9 	(i) the business can demonstrate it has appropriate safeguards in place to ensure that 
10.10 	profiling is consistent with the best interests of children reasonably likely to access the 
10.11 	online service, product, or feature; and
10.12 	(ii) either of the following is true:
10.13 	(A) profiling is necessary to provide the online service, product, or feature requested 
10.14 	and only with respect to the aspects of the online service, product, or feature with which a 
10.15 	child is actively and knowingly engaged; or
10.16 	(B) the business can demonstrate a compelling reason that profiling is in the best interests 
10.17 	of children;
10.18 	(3) process any personal data that is not reasonably necessary to provide an online service, 
10.19 	product, or feature with which a child is actively and knowingly engaged;
10.20 	(4) if the end user is a child, process personal data for any reason other than a reason 
10.21 	for which that personal data was collected;
10.22 	(5) process any precise geolocation information of children by default, unless the 
10.23 	collection of that precise geolocation information is strictly necessary for the business to 
10.24 	provide the service, product, or feature requested and then only for the limited time that the 
10.25 	collection of precise geolocation information is necessary to provide the service, product, 
10.26 	or feature;
10.27 	(6) process any precise geolocation information of a child without providing an obvious 
10.28 	sign to the child for the duration of that collection that precise geolocation information is 
10.29 	being collected;
10.30 	(7) use dark patterns to cause children to provide personal data beyond what is reasonably 
10.31 	expected to provide that online service, product, or feature to forgo privacy protections, or 
11.1 	to take any action that the business knows, or has reason to know, is not in the best interests 
11.2 	of children reasonably likely to access the online service, product, or feature; or
11.3 	(8) allow a child's parent, guardian, or any other consumer to monitor the child's online 
11.4 	activity or track the child's location, without providing an obvious signal to the child when 
11.5 	the child is being monitored or tracked.
11.6 		Subd. 3.Data practices. (a) A data protection impact assessment collected or maintained 
11.7 	by the attorney general under subdivision 1 is classified as nonpublic data or private data 
11.8 	on individuals under section 13.02, subdivisions 9 and 12.
11.9 	(b) To the extent any information contained in a data protection impact assessment 
11.10 	disclosed to the attorney general includes information subject to attorney-client privilege 
11.11 	or work product protection, disclosure pursuant to this section does not constitute a waiver 
11.12 	of that privilege or protection.

11.13 	Sec. 7. [325O.05] ATTORNEY GENERAL ENFORCEMENT.
11.14 	(a) A business that violates this chapter may be subject to an injunction and liable for a 
11.15 	civil penalty of not more than $2,500 per affected child for each negligent violation, or not 
11.16 	more than $7,500 per affected child for each intentional violation, which may be assessed 
11.17 	and recovered only in a civil action brought by the attorney general in accordance with 
11.18 	section 8.31. If the state prevails in an action to enforce this chapter, the state may, in addition 
11.19 	to penalties provided by this paragraph or other remedies provided by law, be allowed an 
11.20 	amount determined by the court to be the reasonable value of all or part of the state's litigation 
11.21 	expenses incurred.
11.22 	(b) Any penalties, fees, and expenses recovered in an action brought under this chapter 
11.23 	must be deposited in an account in the special revenue fund and are appropriated to the 
11.24 	attorney general to offset costs incurred by the attorney general in connection with 
11.25 	enforcement of this chapter.
11.26 	(c) If a business is in substantial compliance with this chapter and has fulfilled the 
11.27 	requirements of section 325O.04, subdivision 1, paragraph (a), clause (1), the attorney 
11.28 	general must, before initiating a civil action under this section, provide written notice to the 
11.29 	business identifying the specific provisions of this chapter that the attorney general alleges 
11.30 	have been or are being violated. If, within 90 days of the notice required by this paragraph, 
11.31 	the business cures any noticed violation and provides the attorney general a written statement 
11.32 	that the alleged violations have been cured, and sufficient measures have been taken to 
12.1 	prevent future violations, the business is not liable for a civil penalty for any violation cured 
12.2 	pursuant to this section.
12.3 	(d) Nothing in this chapter provides a private right of action under this chapter, section 
12.4 	8.31, or any other law.

12.5 	Sec. 8. [325O.06] LIMITATIONS.
12.6 	Nothing in this chapter shall be interpreted or construed to:
12.7 	(1) impose liability in a manner that is inconsistent with United States Code, title 47, 
12.8 	section 230;
12.9 	(2) prevent or preclude any child from deliberately or independently searching for or 
12.10 	specifically requesting content;
12.11 	(3) require a business to implement age-gating or other technical protection methods to 
12.12 	prevent underage people from viewing a website or other content; or
12.13 	(4) infringe on the existing rights and freedoms of children.

12.14 	Sec. 9. EFFECTIVE DATE.
 12.15 	(a) This act is effective July 1, 2025.
12.16 	(b) "Legacy product" means any online service, product, or feature that is likely to be 
12.17 	accessed by children and that is offered to the public before July 1, 2025. By July 1, 2025, 
12.18 	a business must complete a data protection impact assessment for all legacy products, unless 
12.19 	the legacy product is exempt under paragraph (c). A business which is not in compliance 
12.20 	with this paragraph is not eligible for the 90-day opportunity, provided under Minnesota 
12.21 	Statutes, section 325O.05, paragraph (c), to cure a violation related to a legacy product.
12.22 	(c) This act does not apply to an online service, product, or feature that is not offered to 
12.23 	the public on or after July 1, 2025.