MN SF2940

Adds "health data" as a new category of sensitive data under the Minnesota Consumer Data Privacy Act, including information about health conditions, treatments, medications, biometric data, genetic information, and geolocation data indicating healthcare-seeking behavior

Requires separate consumer consent for processing sensitive data and for sharing sensitive data with third parties, with consent requests that must disclose specific data categories, purposes, recipient categories, and withdrawal procedures

Prohibits selling consumer sensitive data without a valid written authorization that includes specific disclosure requirements, expires after one year, and cannot be combined with other documents or conditioned on goods/services

Bans geofencing around healthcare facilities when used to identify, track, or collect health data from consumers, or to send health-related notifications or advertisements

Removes the small business exemption from the Consumer Data Privacy Act, effective July 31, 2025, with postsecondary institutions given until July 31, 2029 to comply