Purpose

This bill changes Minnesota's consumer data privacy rules to require more transparent and accessible privacy notices. It also adds a specific naming requirement for certain notices and strengthens how and where notices are shared with consumers, including options to opt out of certain data practices.

Main Provisions

• Transparency obligations for controllers

  • Require a clear and easily accessible privacy notice that includes:
  • The categories of personal data processed.
  • The purposes for processing that data.
  • The rights described in the privacy rights statute (how to exercise them, including appealing a controller’s decision).
  • The categories of personal data sold to or shared with third parties (if any).
  • The categories of third parties with whom data is sold or shared (if any).
  • The controller’s contact information and a way to reach them.
  • Retention policies for personal data.
  • The date the privacy notice was last updated.

• Opt-out requirements for certain data practices

  • If a controller sells data to third parties, processes data for targeted advertising, or uses profiling that produces legal effects or similarly significant effects, the notice must disclose this processing and provide a clear, conspicuous opt-out method outside the privacy notice (for example, a labeled link like “Your OptOut Rights” that allows an opt-out).

• Language, accessibility, and change notifications

  • Privacy notices must be available in every language the controller uses for the related product or service.
  • Notices must be accessible to people with disabilities.
  • When there are material changes to privacy notices or practices, affected consumers must be notified and given a reasonable opportunity to withdraw consent for any newly different data collection, processing, or transfer. Notification should use reasonable electronic methods considering technology and relationship context.

• General vs. Minnesota-specific notices

  • A separate Minnesota-specific privacy notice is not required if the controller’s general privacy notice already contains all required information.

• Posting and visibility of notices

  • Notices must be posted online via a conspicuous hyperlink labeled “privacy” on the controller’s homepage or app store page/download page.
  • If the controller maintains a mobile app, a link to the privacy notice should appear in the app’s settings.
  • If there is no website, the privacy notice must be made conspicuously available through a medium the controller regularly uses to interact with consumers (e.g., mail).

• Title requirement for certain notices

  • When the controller sells data to third parties, processes data for targeted advertising, or uses profiling in decisions that produce legal effects or similarly significant effects, the privacy notice must be clearly and conspicuously titled as a “surveillance notice.”

Significant Changes to Existing Law

• Adds a distinct requirement that certain privacy notices be titled “surveillance notice.”
• Expands required content to include explicit categories of data, purposes, retention, and third-party sharing, with multilingual and accessibility considerations.
• Establishes an opt-out mechanism that can operate outside the privacy notice for data selling, targeted advertising, and profiling tied to significant effects.
• Requires notification of material changes and a mechanism for consumers to withdraw consent to newly different data practices.
• Sets specific posting and accessibility rules (including hyperlinks labeled “privacy” and placement within apps and websites) to improve notice visibility.
• Clarifies that a single broad privacy notice can satisfy Minnesota requirements if it contains all the required elements.

Potential Impact

• Consumers may see more informative and accessible privacy notices that clearly explain how their data is used, shared, and for what purposes.
• Individuals will have a clearer opt-out path for certain data practices, including data selling, targeted advertising, and profiling with significant effects.
• Notices will need to be available in multiple languages and accessible to people with disabilities, and organizations must actively notify users about changes.
• Companies may need to adjust how they label and present privacy information (using “surveillance notice” in certain cases) and ensure notices are easily discoverable on websites and apps.

Relevant Terms privacy notice surveillance notice personal data categories processing sale shares third parties targeted advertising profiling legal effects significant effects opt out Your OptOut Rights Your Privacy Rights consent retention policies controller consumer multilingual disability accessibility material changes notice hyperlink privacy on homepage app store page mobile app settings menu Minnesota Statutes 325M.16 section 325M.14 right to appeal