1.1 	A bill for an act
1.2 	relating to consumer protection; modifying the Minnesota Consumer Data Privacy 
1.3 	Act to make consumer health data a form of sensitive data; adding additional 
1.4 	protections for sensitive data;amending Minnesota Statutes 2024, sections 
1.5 	325M.11; 325M.12; 325M.16, subdivision 2; 325M.17; 325M.18; 325M.20; 
1.6 	proposing coding for new law in Minnesota Statutes, chapter 325M.
1.7 	BE IT ENACTED BY THE LEGISLATURE OF THE STATE OF MINNESOTA:

1.8 	Section 1. Minnesota Statutes 2024, section 325M.11, is amended to read:
1.9 	325M.11 DEFINITIONS.
1.10 	(a) For purposes of sections 325M.10 to 325M.21, the following terms have the meanings 
1.11 	given.
1.12 	(b) "Affiliate" means a legal entity that controls, is controlled by, or is under common 
1.13 	control with another legal entity. For purposes of this paragraph, "control" or "controlled" 
1.14 	means: ownership of or the power to vote more than 50 percent of the outstanding shares 
1.15 	of any class of voting security of a company; control in any manner over the election of a 
1.16 	majority of the directors or of individuals exercising similar functions; or the power to 
1.17 	exercise a controlling influence over the management of a company.
1.18 	(c) "Authenticate" means to use reasonable means to determine that a request to exercise 
1.19 	any of the rights under section 325M.14, subdivision 1, paragraphs (b) to (h), is being made 
1.20 	by or rightfully on behalf of the consumer who is entitled to exercise the rights with respect 
1.21 	to the personal data at issue.
1.22 	(d) "Biometric data" means data generated by automatic measurements of an individual's 
1.23 	biological characteristics, including a fingerprint, a voiceprint, eye retinas, irises, or other 
2.1 	unique biological patterns or characteristics that are used to identify a specific individual. 
2.2 	Biometric data does not include:
2.3 	(1) a digital or physical photograph;
2.4 	(2) an audio or video recording; or
2.5 	(3) any data generated from a digital or physical photograph, or an audio or video 
2.6 	recording, unless the data is generated to identify a specific individual.
2.7 	(e) "Child" has the meaning given in United States Code, title 15, section 6501.
2.8 	(f) "Consent" means any freely given, specific, informed, and unambiguous indication 
2.9 	of the consumer's wishes by which the consumer signifies agreement to the processing of 
2.10 	personal data relating to the consumer. Acceptance of a general or broad terms of use or 
2.11 	similar document that contains descriptions of personal data processing along with other, 
2.12 	unrelated information does not constitute consent. Hovering over, muting, pausing, or closing 
2.13 	a given piece of content does not constitute consent. A consent is not valid when the 
2.14 	consumer's indication has been obtained by a dark pattern. A consumer may revoke consent 
2.15 	previously given, consistent with sections 325M.10 to 325M.21.
2.16 	(g) "Consumer" means a natural person who is a Minnesota resident acting only in an 
2.17 	individual or household context. Consumer does not include a natural person acting in a 
2.18 	commercial or employment context.
2.19 	(h) "Controller" means the natural or legal person who, alone or jointly with others, 
2.20 	determines the purposes and means of the processing of personal data.
2.21 	(i) "Decisions that produce legal or similarly significant effects concerning the consumer" 
2.22 	means decisions made by the controller that result in the provision or denial by the controller 
2.23 	of financial or lending services, housing, insurance, education enrollment or opportunity, 
2.24 	criminal justice, employment opportunities, health care services, or access to essential goods 
2.25 	or services.
2.26 	(j) "Dark pattern" means a user interface designed or manipulated with the substantial 
2.27 	effect of subverting or impairing user autonomy, decision making, or choice.
2.28 	(k) "Deidentified data" means data that cannot reasonably be used to infer information 
2.29 	about or otherwise be linked to an identified or identifiable natural person or a device linked 
2.30 	to an identified or identifiable natural person, provided that the controller that possesses the 
2.31 	data:
3.1 	(1) takes reasonable measures to ensure that the data cannot be associated with a natural 
3.2 	person;
3.3 	(2) publicly commits to process the data only in a deidentified fashion and not attempt 
3.4 	to reidentify the data; and
3.5 	(3) contractually obligates any recipients of the information to comply with all provisions 
3.6 	of this paragraph.
3.7 	(l) "Delete" means to remove or destroy information so that it is not maintained in human- 
3.8 	or machine-readable form and cannot be retrieved or utilized in the ordinary course of 
3.9 	business.
3.10 	(m) "Genetic information" has the meaning given in section 13.386, subdivision 1.
3.11 	(n) "Geofence" means technology that uses global positioning coordinates, cell tower 
3.12 	connectivity, cellular data, radio frequency identification, Wi-Fi data, or any other form of 
3.13 	spatial or location detection to establish a virtual boundary around the perimeter of a specific 
3.14 	physical location or to locate a consumer within the virtual boundary.
3.15 	(o) "Health care services or supplies" means any service, surgery, procedure, treatment, 
3.16 	or product, including medication or medical devices, that a person may use to assess, 
3.17 	measure, improve, or learn about a person's past, present, or future mental or physical health.
3.18 	(p) "Health data" means personal data that a controller uses to identify a consumer's 
3.19 	past, present, or future mental or physical health status. For purposes of this definition, 
3.20 	mental or physical health status includes but is not limited to:
3.21 	(1) individual health conditions, treatments, diseases, or diagnoses;
3.22 	(2) social, psychological, behavioral, and medical interventions;
3.23 	(3) health-related surgeries or procedures;
3.24 	(4) use or purchase of medication;
3.25 	(5) bodily functions, vital signs, symptoms, or measurements of the information described 
3.26 	in this paragraph;
3.27 	(6) diagnoses or diagnostic testing, treatment, or medication;
3.28 	(7) biometric data;
3.29 	(8) genetic information; and
3.30 	(9) specific geolocation data that a controller uses to indicate a consumer's seeking or 
3.31 	obtaining past, present, or future health care services or supplies.
4.1 	(n) (q) "Identified or identifiable natural person" means a person who can be readily 
4.2 	identified, directly or indirectly.
4.3 	(o) (r) "Known child" means a person under circumstances where a controller has actual 
4.4 	knowledge of, or willfully disregards, that the person is under 13 years of age.
4.5 	(p) (s) "Personal data" means any information that is linked or reasonably linkable to 
4.6 	an identified or identifiable natural person. Personal data does not include deidentified data 
4.7 	or publicly available information. For purposes of this paragraph, "publicly available 
4.8 	information" means information that (1) is lawfully made available from federal, state, or 
4.9 	local government records or widely distributed media, or (2) a controller has a reasonable 
4.10 	basis to believe has lawfully been made available to the general public.
4.11 	(q) (t) "Process" or "processing" means any operation or set of operations that are 
4.12 	performed on personal data or on sets of personal data, whether or not by automated means, 
4.13 	including but not limited to the collection, use, storage, disclosure, analysis, deletion, or 
4.14 	modification of personal data.
4.15 	(r) (u) "Processor" means a natural or legal person who processes personal data on behalf 
4.16 	of a controller.
4.17 	(s) (v) "Profiling" means any form of automated processing of personal data to evaluate, 
4.18 	analyze, or predict personal aspects related to an identified or identifiable natural person's 
4.19 	economic situation, health, personal preferences, interests, reliability, behavior, location, 
4.20 	or movements.
4.21 	(t) (w) "Pseudonymous data" means personal data that cannot be attributed to a specific 
4.22 	natural person without the use of additional information, provided that the additional 
4.23 	information is kept separately and is subject to appropriate technical and organizational 
4.24 	measures to ensure that the personal data are not attributed to an identified or identifiable 
4.25 	natural person.
4.26 	(u) (x) "Sale," "sell," or "sold" means the exchange of personal data for monetary or 
4.27 	other valuable consideration by the controller to a third party. Sale does not include sharing 
4.28 	as defined in this section. Sale does not include the following:
4.29 	(1) the disclosure of personal data to a processor who processes the personal data on 
4.30 	behalf of the controller;
4.31 	(2) the disclosure of personal data to a third party for purposes of providing a product 
4.32 	or service requested by the consumer;
4.33 	(3) the disclosure or transfer of personal data to an affiliate of the controller;
5.1 	(4) the disclosure of information that the consumer intentionally made available to the 
5.2 	general public via a channel of mass media and did not restrict to a specific audience;
5.3 	(5) the disclosure or transfer of personal data to a third party as an asset that is part of a 
5.4 	completed or proposed merger, acquisition, bankruptcy, or other transaction in which the 
5.5 	third party assumes control of all or part of the controller's assets; or
5.6 	(6) the exchange of personal data between the producer of a good or service and 
5.7 	authorized agents of the producer who sell and service the goods and services, to enable 
5.8 	the cooperative provisioning of goods and services by both the producer and the producer's 
5.9 	agents.
5.10 	(v) (y) Sensitive data is a form of personal data. "Sensitive data" means:
5.11 	(1) personal data revealing racial or ethnic origin, religious beliefs, mental or physical 
5.12 	health condition or diagnosis, sexual orientation, or citizenship or immigration status;
5.13 	(2) the processing of biometric data or genetic information for the purpose of uniquely 
5.14 	identifying an individual;
5.15 	(3) the personal data of a known child; or
5.16 	(4) specific geolocation data;
5.17 	(5) health data.; or
5.18 	(6) inferences made by a controller based on personal data, alone or in combination with 
5.19 	other data, which are used to indicate any of the sensitive data categories identified in clauses 
5.20 	(1) to (5).
5.21 	(z) "Share" or "sharing" means to release, disclose, disseminate, divulge, make available, 
5.22 	provide access to, license, or otherwise communicate orally, in writing, or by electronic or 
5.23 	other means, personal data to a third party. Share includes selling as defined in this section. 
5.24 	Sharing does not include:
5.25 	(1) the disclosure of personal data by a controller to a processor when the sharing is to 
5.26 	provide goods or services in a manner consistent with the purpose for which the data was 
5.27 	collected and that was disclosed to the consumer;
5.28 	(2) the disclosure of personal data to a third party with whom the consumer has a direct 
5.29 	relationship when:
5.30 	(i) the disclosure is for purposes of providing a product or service requested by the 
5.31 	consumer;
6.1 	(ii) the controller or processor maintains control and ownership of the data; and
6.2 	(iii) the third party uses the personal data only as directed by the controller or processor 
6.3 	and consistent with the purpose consented to by the consumer;
6.4 	(3) the disclosure or transfer of personal data to a third party as an asset that is part of a 
6.5 	merger, acquisition, bankruptcy, or other transaction in which the third party assumes control 
6.6 	of all or part of the controller's or processor's assets and complies with the requirements 
6.7 	and obligations in this chapter;
6.8 	(4) the disclosure or transfer of personal data to an affiliate of the controller;
6.9 	(5) the disclosure of information that the consumer intentionally made available to the 
6.10 	general public via a channel of mass media and did not restrict to a specific audience; or
6.11 	(6) the exchange of personal data between the producer of a good or service and 
6.12 	authorized agents of the producer who sell and service the goods and services, to enable 
6.13 	the cooperative provisioning of goods and services by both the producer and the producer's 
6.14 	agents.
6.15 	(w) (aa) "Specific geolocation data" means information derived from technology, 
6.16 	including but not limited to global positioning system level latitude and longitude coordinates 
6.17 	or other mechanisms, that directly identifies the geographic coordinates of a consumer or 
6.18 	a device linked to a consumer with an accuracy of more than three decimal degrees of 
6.19 	latitude and longitude or the equivalent in an alternative geographic coordinate system, or 
6.20 	a street address derived from the coordinates. Specific geolocation data does not include 
6.21 	the content of communications, the contents of databases containing street address 
6.22 	information which are accessible to the public as authorized by law, or any data generated 
6.23 	by or connected to advanced utility metering infrastructure systems or other equipment for 
6.24 	use by a public utility.
6.25 	(x) (bb) "Targeted advertising" means displaying advertisements to a consumer where 
6.26 	the advertisement is selected based on personal data obtained or inferred from the consumer's 
6.27 	activities over time and across nonaffiliated websites or online applications to predict the 
6.28 	consumer's preferences or interests. Targeted advertising does not include:
6.29 	(1) advertising based on activities within a controller's own websites or online 
6.30 	applications;
6.31 	(2) advertising based on the context of a consumer's current search query or visit to a 
6.32 	website or online application;
7.1 	(3) advertising to a consumer in response to the consumer's request for information or 
7.2 	feedback; or
7.3 	(4) processing personal data solely for measuring or reporting advertising performance, 
7.4 	reach, or frequency.
7.5 	(y) (cc) "Third party" means a natural or legal person, public authority, agency, or body 
7.6 	other than the consumer, controller, processor, or an affiliate of the processor or the controller.
7.7 	(z) (dd) "Trade secret" has the meaning given in section 325C.01, subdivision 5.

7.8 	Sec. 2. Minnesota Statutes 2024, section 325M.12, is amended to read:
7.9 	325M.12 SCOPE; EXCLUSIONS.
7.10 		Subdivision 1.Scope. (a) sections 325M.10 to 325M.21 apply to legal entities that 
7.11 	conduct business in Minnesota or produce products or services that are targeted to residents 
7.12 	of Minnesota, and that satisfy one or more of the following thresholds:
7.13 	(1) during a calendar year, controls or processes personal data of 100,000 consumers or 
7.14 	more, excluding personal data controlled or processed solely for the purpose of completing 
7.15 	a payment transaction; or
7.16 	(2) derives over 25 percent of gross revenue from the sale of personal data and processes 
7.17 	or controls personal data of 25,000 consumers or more.
7.18 	(b) A controller or processor acting as a technology provider under section 13.32 shall 
7.19 	comply with sections 13.32 and 325M.10 to 325M.21, except that when the provisions of 
7.20 	section 13.32 conflict with sections 325M.10 to 325M.21, section 13.32 prevails.
7.21 		Subd. 2.Exclusions. (a) Sections 325M.10 to 325M.21 do not apply to the following 
7.22 	entities, activities, or types of information:
7.23 	(1) a government entity, as defined by section 13.02, subdivision 7a;
7.24 	(2) a federally recognized Indian tribe;
7.25 	(3) information that meets the definition of:
7.26 	(i) protected health information, as defined by and for purposes of the Health Insurance 
7.27 	Portability and Accountability Act of 1996, Public Law 104-191, and related regulations, 
7.28 	if it is maintained by a covered entity or business associate subject to that law and its related 
7.29 	regulations;
7.30 	(ii) health records, as defined in section 144.291, subdivision 2, if it is maintained by a 
7.31 	provider or other entity subject to the Minnesota Health Records Act;
8.1 	(iii) patient identifying information for purposes of Code of Federal Regulations, title 
8.2 	42, part 2, established pursuant to United States Code, title 42, section 290dd-2;
8.3 	(iv) identifiable private information for purposes of the federal policy for the protection 
8.4 	of human subjects, Code of Federal Regulations, title 45, part 46; identifiable private 
8.5 	information that is otherwise information collected as part of human subjects research 
8.6 	pursuant to the good clinical practice guidelines issued by the International Council for 
8.7 	Harmonisation; the protection of human subjects under Code of Federal Regulations, title 
8.8 	21, parts 50 and 56; or personal data used or shared in research conducted in accordance 
8.9 	with one or more of the requirements set forth in this paragraph;
8.10 	(v) information and documents created for purposes of the federal Health Care Quality 
8.11 	Improvement Act of 1986, Public Law 99-660, and related regulations; or
8.12 	(vi) patient safety work product for purposes of Code of Federal Regulations, title 42, 
8.13 	part 3, established pursuant to United States Code, title 42, sections 299b-21 to 299b-26;
8.14 	(4) information that is derived from any of the health care-related information listed in 
8.15 	clause (3), but that has been deidentified in accordance with the requirements for 
8.16 	deidentification set forth in Code of Federal Regulations, title 45, part 164;
8.17 	(5) information originating from, and intermingled to be indistinguishable with, any of 
8.18 	the health care-related information listed in clause (3) that is maintained by:
8.19 	(i) a covered entity or business associate, as defined by the Health Insurance Portability 
8.20 	and Accountability Act of 1996, Public Law 104-191, and related regulations;
8.21 	(ii) a health care provider, as defined in section 144.291, subdivision 2; or
8.22 	(iii) a program or a qualified service organization, as defined by Code of Federal 
8.23 	Regulations, title 42, part 2, established pursuant to United States Code, title 42, section 
8.24 	290dd-2;
8.25 	(6) information that is:
8.26 	(i) maintained by an entity that meets the definition of health care provider under Code 
8.27 	of Federal Regulations, title 45, section 160.103, to the extent that the entity maintains the 
8.28 	information in the manner required of covered entities with respect to protected health 
8.29 	information for purposes of the Health Insurance Portability and Accountability Act of 
8.30 	1996, Public Law 104-191, and related regulations;
9.1 	(ii) included in a limited data set, as described under Code of Federal Regulations, title 
9.2 	45, part 164.514(e), to the extent that the information is used, disclosed, and maintained in 
9.3 	the manner specified by that part;
9.4 	(iii) maintained by, or maintained to comply with the rules or orders of, a self-regulatory 
9.5 	organization as defined by United States Code, title 15, section 78c(a)(26);
9.6 	(iv) originated from, or intermingled with, information described in clause (9) and that 
9.7 	a licensed residential mortgage originator, as defined under section 58.02, subdivision 19, 
9.8 	or residential mortgage servicer, as defined under section 58.02, subdivision 20, collects, 
9.9 	processes, uses, or maintains in the same manner as required under the laws and regulations 
9.10 	specified in clause (9); or
9.11 	(v) originated from, or intermingled with, information described in clause (9) and that 
9.12 	a nonbank financial institution, as defined by section 46A.01, subdivision 12, collects, 
9.13 	processes, uses, or maintains in the same manner as required under the laws and regulations 
9.14 	specified in clause (9);
9.15 	(7) information used only for public health activities and purposes, as described under 
9.16 	Code of Federal Regulations, title 45, part 164.512;
9.17 	(8) an activity involving the collection, maintenance, disclosure, sale, communication, 
9.18 	or use of any personal data bearing on a consumer's credit worthiness, credit standing, credit 
9.19 	capacity, character, general reputation, personal characteristics, or mode of living by a 
9.20 	consumer reporting agency, as defined in United States Code, title 15, section 1681a(f), by 
9.21 	a furnisher of information, as set forth in United States Code, title 15, section 1681s-2, who 
9.22 	provides information for use in a consumer report, as defined in United States Code, title 
9.23 	15, section 1681a(d), and by a user of a consumer report, as set forth in United States Code, 
9.24 	title 15, section 1681b, except that information is only excluded under this paragraph to the 
9.25 	extent that the activity involving the collection, maintenance, disclosure, sale, communication, 
9.26 	or use of the information by the agency, furnisher, or user is subject to regulation under the 
9.27 	federal Fair Credit Reporting Act, United States Code, title 15, sections 1681 to 1681x, and 
9.28 	the information is not collected, maintained, used, communicated, disclosed, or sold except 
9.29 	as authorized by the Fair Credit Reporting Act;
9.30 	(9) personal data collected, processed, sold, or disclosed pursuant to the federal 
9.31 	Gramm-Leach-Bliley Act, Public Law 106-102, and implementing regulations, if the 
9.32 	collection, processing, sale, or disclosure is in compliance with that law;
10.1 	(10) personal data collected, processed, sold, or disclosed pursuant to the federal Driver's 
10.2 	Privacy Protection Act of 1994, United States Code, title 18, sections 2721 to 2725, if the 
10.3 	collection, processing, sale, or disclosure is in compliance with that law;
10.4 	(11) personal data regulated by the federal Family Educational Rights and Privacy Act, 
10.5 	United States Code, title 20, section 1232g, and implementing regulations;
10.6 	(12) personal data collected, processed, sold, or disclosed pursuant to the federal Farm 
10.7 	Credit Act of 1971, as amended, United States Code, title 12, sections 2001 to 2279cc, and 
10.8 	implementing regulations, Code of Federal Regulations, title 12, part 600, if the collection, 
10.9 	processing, sale, or disclosure is in compliance with that law;
10.10 	(13) data collected or maintained:
10.11 	(i) in the course of an individual acting as a job applicant to or an employee, owner, 
10.12 	director, officer, medical staff member, or contractor of a business if the data is collected 
10.13 	and used solely within the context of the role;
10.14 	(ii) as the emergency contact information of an individual under item (i) if used solely 
10.15 	for emergency contact purposes; or
10.16 	(iii) that is necessary for the business to retain to administer benefits for another individual 
10.17 	relating to the individual under item (i) if used solely for the purposes of administering those 
10.18 	benefits;
10.19 	(14) personal data collected, processed, sold, or disclosed pursuant to the Minnesota 
10.20 	Insurance Fair Information Reporting Act in sections 72A.49 to 72A.505;
10.21 	(15) data collected, processed, sold, or disclosed as part of a payment-only credit, check, 
10.22 	or cash transaction where no data about consumers, as defined in section 325M.11, are 
10.23 	retained;
10.24 	(16) a state or federally chartered bank or credit union, or an affiliate or subsidiary that 
10.25 	is principally engaged in financial activities, as described in United States Code, title 12, 
10.26 	section 1843(k);
10.27 	(17) information that originates from, or is intermingled so as to be indistinguishable 
10.28 	from, information described in clause (8) and that a person licensed under chapter 56 collects, 
10.29 	processes, uses, or maintains in the same manner as is required under the laws and regulations 
10.30 	specified in clause (8);
10.31 	(18) an insurance company, as defined in section 60A.02, subdivision 4, an insurance 
10.32 	producer, as defined in section 60K.31, subdivision 6, a third-party administrator of 
11.1 	self-insurance, or an affiliate or subsidiary of any entity identified in this clause that is 
11.2 	principally engaged in financial activities, as described in United States Code, title 12, 
11.3 	section 1843(k), except that this clause does not apply to a person that, alone or in 
11.4 	combination with another person, establishes and maintains a self-insurance program that 
11.5 	does not otherwise engage in the business of entering into policies of insurance;
11.6 	(19) a small business, as defined by the United States Small Business Administration 
11.7 	under Code of Federal Regulations, title 13, part 121, except that a small business identified 
11.8 	in this clause is subject to section 325M.17;
11.9 	(20) a nonprofit organization that is established to detect and prevent fraudulent acts in 
11.10 	connection with insurance; and
11.11 	(21) an air carrier subject to the federal Airline Deregulation Act, Public Law 95-504, 
11.12 	only to the extent that an air carrier collects personal data related to prices, routes, or services 
11.13 	and only to the extent that the provisions of the Airline Deregulation Act preempt the 
11.14 	requirements of sections 325M.10 to 325M.21.
11.15 	(b) Controllers that are in compliance with the Children's Online Privacy Protection Act, 
11.16 	United States Code, title 15, sections 6501 to 6506, and implementing regulations, shall be 
11.17 	deemed compliant with any obligation to obtain parental consent under sections 325M.10
11.18 	to 325M.21 section 325M.16, subdivision 2, paragraph (h).

11.19 	Sec. 3. Minnesota Statutes 2024, section 325M.16, subdivision 2, is amended to read:
11.20 		Subd. 2.Use of data. (a) A controller must limit the collection of personal data to what 
11.21 	is adequate, relevant, and reasonably necessary in relation to the purposes for which the 
11.22 	data are processed, which must be disclosed to the consumer.
11.23 	(b) Except as provided in sections 325M.10 to 325M.21, a controller may not process 
11.24 	personal data for purposes that are not reasonably necessary to, or compatible with, the 
11.25 	purposes for which the personal data are processed, as disclosed to the consumer, unless 
11.26 	the controller obtains the consumer's consent.
11.27 	(c) A controller shall establish, implement, and maintain reasonable administrative, 
11.28 	technical, and physical data security practices to protect the confidentiality, integrity, and 
11.29 	accessibility of personal data, including the maintenance of an inventory of the data that 
11.30 	must be managed to exercise these responsibilities. The data security practices shall be 
11.31 	appropriate to the volume and nature of the personal data at issue.
11.32 	(d) Except as otherwise provided in sections 325M.10 to 325M.21, a controller may not 
11.33 	process sensitive data concerning a consumer without obtaining the consumer's consent, 
12.1 	or, in the case of the processing of except with the consumer's consent to the processing for 
12.2 	a specified purpose.
12.3 	(e) A controller may not share a consumer's health data with any party other than the 
12.4 	consumer except with the consumer's consent to the specified sharing.
12.5 	(f) A controller may not sell a consumer's sensitive data with any party other than the 
12.6 	consumer except with the consumer's consent to the specified sale.
12.7 	(g) A consumer's consent to share health data under paragraph (e), or to sell sensitive 
12.8 	data under paragraph (f), must be separate and distinct from a consumer's consent to process 
12.9 	the consumer's sensitive data under paragraph (d). A consent under this subdivision must 
12.10 	be obtained prior to the processing, sharing, or sale, as applicable, of any sensitive data. 
12.11 	Any request for consent to the processing, sharing, or sale, as applicable, of any sensitive 
12.12 	data under this subdivision must clearly and conspicuously disclose:
12.13 	(1) the categories of sensitive data processed, shared, or sold, as applicable;
12.14 	(2) the purpose of the processing, sharing, or sale, as applicable, of the sensitive data, 
12.15 	including the specific ways in which it will be used;
12.16 	(3) the categories of entities with which the sensitive data is shared or sold; and
12.17 	(4) how the consumer can withdraw consent from future processing, sharing, or sale of 
12.18 	the consumer's sensitive data.
12.19 	(h) A controller may not process personal data concerning a known child, without 
12.20 	obtaining consent from the child's parent or lawful guardian, in accordance with the 
12.21 	requirement of the Children's Online Privacy Protection Act, United States Code, title 15, 
12.22 	sections 6501 to 6506, and its implementing regulations, rules, and exemptions.
12.23 	(e) (i) A controller shall provide an effective mechanism for a consumer, or, in the case 
12.24 	of the processing of personal data concerning a known child, the child's parent or lawful 
12.25 	guardian, to revoke previously given consent under this subdivision. The mechanism provided 
12.26 	shall be at least as easy as the mechanism by which the consent was previously given. Upon 
12.27 	revocation of consent, a controller shall cease to process the applicable data as soon as 
12.28 	practicable, but not later than 15 days after the receipt of the request.
12.29 	(f) (j) A controller may not process the personal data of a consumer for purposes of 
12.30 	targeted advertising, or sell the consumer's personal data, without the consumer's consent, 
12.31 	under circumstances where the controller knows that the consumer is between the ages of 
12.32 	13 and 16.
13.1 	(g) (k) A controller may not retain personal data that is no longer relevant and reasonably 
13.2 	necessary in relation to the purposes for which the data were collected and processed, unless 
13.3 	retention of the data is otherwise required by law or permitted under section 325M.19.

13.4 	Sec. 4. Minnesota Statutes 2024, section 325M.17, is amended to read:
13.5 	325M.17 REQUIREMENTS FOR SMALL BUSINESSES.
13.6 	(a) A small business, as defined by the United States Small Business Administration 
13.7 	under Code of Federal Regulations, title 13, part 121, that conducts business in Minnesota 
13.8 	or produces products or services that are targeted to residents of Minnesota, must not sell 
13.9 	a consumer's sensitive data or share a consumer's health data without the consumer's prior 
13.10 	consent.
13.11 	(b) Penalties and attorney general enforcement procedures under section 325M.20 apply 
13.12 	to a small business that violates this section.

13.13 	Sec. 5. [325M.178] GEOFENCE RESTRICTIONS.
13.14 	It is unlawful for any person to implement a geofence around an entity that provides 
13.15 	in-person health care services or supplies where the geofence is used to:
13.16 	(1) identify or track a consumer seeking health care services or supplies;
13.17 	(2) collect health data from a consumer; or
13.18 	(3) send notifications, messages, or advertisements to a consumer related to the 
13.19 	consumer's health data or health care services or supplies.

13.20 	Sec. 6. Minnesota Statutes 2024, section 325M.18, is amended to read:
13.21 	325M.18 DATA PRIVACY POLICIES; DATA PRIVACY AND PROTECTION 
13.22 	ASSESSMENTS.
13.23 	(a) A controller must document and maintain a description of the policies and procedures 
13.24 	the controller has adopted to comply with sections 325M.10 to 325M.21. The description 
13.25 	must include, where applicable:
13.26 	(1) the name and contact information for the controller's chief privacy officer or other 
13.27 	individual with primary responsibility for directing the policies and procedures implemented 
13.28 	to comply with the provisions of sections 325M.10 to 325M.21; and
13.29 	(2) a description of the controller's data privacy policies and procedures which reflect 
13.30 	the requirements in section 325M.16, and any policies and procedures designed to:
14.1 	(i) reflect the requirements of sections 325M.10 to 325M.21 in the design of the 
14.2 	controller's systems;
14.3 	(ii) identify and provide personal data to a consumer as required by sections 325M.10
14.4 	to 325M.21;
14.5 	(iii) establish, implement, and maintain reasonable administrative, technical, and physical 
14.6 	data security practices to protect the confidentiality, integrity, and accessibility of personal 
14.7 	data, including the maintenance of an inventory of the data that must be managed to exercise 
14.8 	the responsibilities under this item;
14.9 	(iv) limit the collection of personal data to what is adequate, relevant, and reasonably 
14.10 	necessary in relation to the purposes for which the data are processed;
14.11 	(v) prevent the retention of personal data that is no longer relevant and reasonably 
14.12 	necessary in relation to the purposes for which the data were collected and processed, unless 
14.13 	retention of the data is otherwise required by law or permitted under section 325M.19; and
14.14 	(vi) identify and remediate violations of sections 325M.10 to 325M.21.
14.15 	(b) A controller must conduct and document a data privacy and protection assessment 
14.16 	for each of the following processing activities involving personal data:
14.17 	(1) the processing of personal data for purposes of targeted advertising;
14.18 	(2) the sale of personal data;
14.19 	(3) the processing of sensitive data;
14.20 	(4) the sharing of health data;
14.21 	(4) (5) any processing activities involving personal data that present a heightened risk 
14.22 	of harm to consumers; and
14.23 	(5) (6) the processing of personal data for purposes of profiling, where the profiling 
14.24 	presents a reasonably foreseeable risk of:
14.25 	(i) unfair or deceptive treatment of, or disparate impact on, consumers;
14.26 	(ii) financial, physical, or reputational injury to consumers;
14.27 	(iii) a physical or other intrusion upon the solitude or seclusion, or the private affairs or 
14.28 	concerns, of consumers, where the intrusion would be offensive to a reasonable person; or
14.29 	(iv) other substantial injury to consumers.
15.1 	(c) A data privacy and protection assessment must take into account the type of personal 
15.2 	data to be processed by the controller, including the extent to which the personal data are 
15.3 	sensitive data, and the context in which the personal data are to be processed.
15.4 	(d) A data privacy and protection assessment must identify and weigh the benefits that 
15.5 	may flow directly and indirectly from the processing to the controller, consumer, other 
15.6 	stakeholders, and the public against the potential risks to the rights of the consumer associated 
15.7 	with the processing, as mitigated by safeguards that can be employed by the controller to 
15.8 	reduce the potential risks. The use of deidentified data and the reasonable expectations of 
15.9 	consumers, as well as the context of the processing and the relationship between the controller 
15.10 	and the consumer whose personal data will be processed, must be factored into this 
15.11 	assessment by the controller.
15.12 	(e) A data privacy and protection assessment must include the description of policies 
15.13 	and procedures required by paragraph (a).
15.14 	(f) As part of a civil investigative demand, the attorney general may request, in writing, 
15.15 	that a controller disclose any data privacy and protection assessment that is relevant to an 
15.16 	investigation conducted by the attorney general. The controller must make a data privacy 
15.17 	and protection assessment available to the attorney general upon a request made under this 
15.18 	paragraph. The attorney general may evaluate the data privacy and protection assessments 
15.19 	for compliance with sections 325M.10 to 325M.21. Data privacy and protection assessments 
15.20 	are classified as nonpublic data, as defined by section 13.02, subdivision 9. The disclosure 
15.21 	of a data privacy and protection assessment pursuant to a request from the attorney general 
15.22 	under this paragraph does not constitute a waiver of the attorney-client privilege or work 
15.23 	product protection with respect to the assessment and any information contained in the 
15.24 	assessment.
15.25 	(g) Data privacy and protection assessments or risk assessments conducted by a controller 
15.26 	for the purpose of compliance with other laws or regulations may qualify under this section 
15.27 	if the assessments have a similar scope and effect.
15.28 	(h) A single data protection assessment may address multiple sets of comparable 
15.29 	processing operations that include similar activities.

15.30 	Sec. 7. Minnesota Statutes 2024, section 325M.20, is amended to read:
15.31 	325M.20 ATTORNEY GENERAL ENFORCEMENT.
15.32 	(a) In the event that a controller or processor violates sections 325M.10 to 325M.21, the 
15.33 	attorney general, prior to filing an enforcement action under paragraph (b), must provide 
16.1 	the controller or processor with a warning letter identifying the specific provisions of sections 
16.2 	325M.10 to 325M.21 the attorney general alleges have been or are being violated. If, after 
16.3 	30 days of issuance of the warning letter, the attorney general believes the controller or 
16.4 	processor has failed to cure any alleged violation, the attorney general may bring an 
16.5 	enforcement action under paragraph (b). This paragraph expires January 31, 2026.
16.6 	(b) The attorney general may bring a civil action against a controller or processor to 
16.7 	enforce a provision of sections 325M.10 to 325M.21 in accordance with section 8.31. If the 
16.8 	state prevails in an action to enforce sections 325M.10 to 325M.21, the state may, in addition 
16.9 	to penalties provided by paragraph (c) or other remedies provided by law, be allowed an 
16.10 	amount determined by the court to be the reasonable value of all or part of the state's litigation 
16.11 	expenses incurred.
16.12 	(c) Any controller or processor that violates sections 325M.10 to 325M.21 is subject to 
16.13 	an injunction and liable for a civil penalty of not more than $7,500 for each violation.
16.14 	(d) Nothing in sections 325M.10 to 325M.21 establishes a private right of action, 
16.15 	including under section 8.31, subdivision 3a, for a violation of sections 325M.10 to 325M.21
16.16 	or any other law.
16.17 	(e) A person that violates an applicable provision of sections 325M.10 to 325M.21, but 
16.18 	that is not a controller or processor, is subject to enforcement by the attorney general under 
16.19 	this section as if the person were a controller or processor.

16.20 	Sec. 8. EFFECTIVE DATE.
 16.21 	This act is effective January 1, 2027, except that postsecondary institutions regulated 
16.22 	by the Office of Higher Education are not required to comply with this act until July 31, 
16.23 	2029.