HF2309 - Minnesota Consumer Data Privacy Act

• Creates comprehensive consumer data privacy law applicable to businesses collecting or processing personal data of 100,000+ Minnesota residents or deriving over 25% of revenue from selling personal data of 25,000+ residents.

• Grants consumers rights to access, correct, delete, and port their personal data; opt out of targeted advertising, data sales, and automated profiling; and receive information about data collection and third-party disclosures.

• Requires controllers to provide clear privacy notices, limit data collection to necessary purposes, obtain consent before processing sensitive data (including children's data), and implement reasonable data security practices.

• Establishes civil enforcement by Minnesota Attorney General with warning letter requirement before action, up to $7,500 penalty per violation, and attorney fee recovery; prohibits private lawsuits and waiver of consumer rights.

• Effective July 31, 2025, with delayed compliance until July 31, 2029 for postsecondary institutions and nonprofit corporations; excludes government entities, healthcare providers, financial institutions, and data covered by federal laws.