Minnesota Consumer Data Privacy Act (S.F. No. 4247)

• Establishes comprehensive consumer privacy rights including access, correction, deletion, data portability, and opt-out rights for targeted advertising, personal data sales, and profiling activities.

• Applies to businesses conducting operations in Minnesota that process personal data of 100,000+ consumers annually or derive 50%+ of revenue from selling personal data of 25,000+ consumers.

• Requires controllers to provide privacy notices, implement data security measures, conduct data protection assessments for high-risk processing activities, and establish consumer appeal processes for denied requests.

• Imposes strict regulations on facial recognition services including consent requirements, accuracy testing across demographics, meaningful human review for consequential decisions, and restrictions on law enforcement disclosure.

• Creates enforcement authority for the Minnesota Attorney General with civil penalties up to $7,500 per violation and eliminates private right of action; effective July 31, 2021 (July 31, 2024 for postsecondary institutions and nonprofits).