MN HF2700

Adds "health data" as a new category of sensitive data under the Minnesota Consumer Data Privacy Act, encompassing medical conditions, treatments, diagnoses, medication use, biometric data, genetic information, and geolocation data indicating health care visits

Requires controllers to obtain separate consumer consent for processing sensitive data and for sharing sensitive data with third parties, with consent requests disclosing specific categories, purposes, recipients, and withdrawal procedures

Prohibits geofencing around health care facilities when used to identify or track consumers seeking care, collect health data, or send health-related notifications or advertisements

Requires controllers to conduct data privacy and protection assessments for processing, sharing, or sale of sensitive data, with assessments available to the attorney general during investigations

Effective July 31, 2026, with postsecondary institutions regulated by the Office of Higher Education given until July 31, 2030 to comply