MN SF2915

Establishes comprehensive consumer data privacy rights including access, correction, deletion, portability, and opt-out from targeted advertising and data sales for Minnesota residents.

Applies to businesses collecting data on 100,000+ consumers or deriving 25%+ of revenue from personal data sales; excludes government entities, health care providers, financial institutions, and certain other regulated sectors.

Requires controllers to provide privacy notices, obtain consent for sensitive data processing, implement data security measures, conduct privacy assessments, and prohibit discrimination based on privacy rights exercise.

Grants consumers rights to appeal denied requests and opt out through universal mechanisms; imposes 45-day response deadlines for data requests with possible 45-day extensions.

Effective July 31, 2025 (July 31, 2029 for postsecondary institutions and nonprofits); enforced by Attorney General with civil penalties up to $7,500 per violation; no private right of action.