MN HF3936

Establishes the Minnesota Consumer Data Privacy Act applying to businesses controlling or processing personal data of 100,000+ Minnesota residents or deriving over 50% of revenue from selling personal data of 25,000+ residents.

Grants consumers rights to access, correct, delete, port, and opt out of processing their personal data for targeted advertising, sales, or profiling that produces legal effects.

Requires controllers and processors to implement data security practices, obtain consent before processing sensitive data or children's data, and conduct data protection assessments for high-risk processing activities.

Imposes special restrictions on facial recognition services including requirements for accuracy testing across demographic groups, consent before enrollment, meaningful human review for consequential decisions, and prohibition on enrollment in loyalty programs.

Establishes Attorney General enforcement with civil penalties up to $7,500 per violation and requires report by July 1, 2022; effective date July 31, 2021 (except July 31, 2024 for higher education institutions and nonprofits).