1.1 	A bill for an act
1.2 	relating to privacy; regulating installation and use of supercookies; providing 
1.3 	remedies; proposing coding for new law in Minnesota Statutes, chapter 325M.
1.4 	BE IT ENACTED BY THE LEGISLATURE OF THE STATE OF MINNESOTA:

1.5 	Section 1. [325M.10] SUPERCOOKIES; INSTALLATION WITHOUT 
1.6 	CONSENT PROHIBITED.
1.7 		Subdivision 1.Definitions. (a) The definitions in this subdivision apply to this 
1.8 	section.
1.9 	(b) "Supercookie" means an electronic data file, computer code, or other similar 
1.10 	program or software that may be used to track an internet user's Web site access, activities, 
1.11 	or history, and that cannot reasonably be deleted, blocked, or otherwise removed from a 
1.12 	wireless device by an average user without significant technical experience or expertise.
1.13 	(c) "Informed, affirmative consent" means that the user has opted-in to installation of 
1.14 	a supercookie after being provided a written disclosure by the wireless telecommunications 
1.15 	service provider describing the following:
1.16 	(1) the types of data that will be collected by the supercookie;
1.17 	(2) the way the data will be stored and used by the wireless telecommunications 
1.18 	service provider;
1.19 	(3) if data from the supercookie will be provided or accessible to any third-party 
1.20 	individuals or entities pursuant to an agreement with the wireless telecommunications 
1.21 	service provider, the names and contact information for those third parties; 
1.22 	(4) the wireless telecommunications service provider's procedures if it is determined 
1.23 	that data from a supercookie was accessed or collected by an unauthorized person; and
2.1 	(5) the procedure for requesting that the wireless telecommunications service 
2.2 	provider delete, block, or remove the supercookie from the user's device, if the user has 
2.3 	provided informed, affirmative consent but later chooses to opt-out of its installation.
2.4 	The disclosure must be formatted to be easily read and understood by an average user, and 
2.5 	must require the user to affirm, by signature or initials, that the disclosure has been provided. 
2.6 	Inclusion of the disclosure in the wireless telecommunications service provider's ordinary 
2.7 	terms and conditions of service is not sufficient to meet the requirements of this section.
2.8 	(d) "Wireless telecommunications service provider" means a provider of wireless 
2.9 	telecommunications services to users residing in this state.
2.10 		Subd. 2.Installation of supercookie; use of data. (a) A wireless 
2.11 	telecommunications service provider may not install, or require a user to install, a 
2.12 	supercookie on any device used to access the provider's services unless the user has 
2.13 	provided informed, affirmative consent to the installation.
2.14 	(b) A wireless telecommunications service provider may not permit a third party to 
2.15 	access any data collected by a supercookie except by written agreement with the service 
2.16 	provider. The terms and conditions of an agreement entered under this section must be 
2.17 	provided, upon request, to any user whose supercookie data is made accessible to the third 
2.18 	party pursuant to the agreement.
2.19 	(c) A wireless telecommunications service provider must delete, block, or otherwise 
2.20 	remove a supercookie from a user's device, or provide instructions to the user for doing so, 
2.21 	upon request. Upon receipt of a request to delete, block, or remove a supercookie from a 
2.22 	user's device, the wireless telecommunications service provider must immediately destroy 
2.23 	any data it maintains related to that user's Internet activities collected by the supercookie.
2.24 		Subd. 3.Remedies. A user aggrieved by violation of this section is entitled to 
2.25 	appropriate equitable relief, and an award of $500, or actual damages, whichever is 
2.26 	greater, plus costs, disbursements, and reasonable attorney fees. The attorney general 
2.27 	may also bring an action to enforce compliance with this section, consistent with the 
2.28 	enforcement powers provided in section 8.31.

2.29 	EFFECTIVE DATE; APPLICABILITY. This section is effective July 1, 2015, 
2.30 	and applies to supercookies installed on or after that date, provided that a wireless 
2.31 	telecommunications service provider which has installed and currently maintains a 
2.32 	supercookie on a user's device as of the effective date of this section must provide the 
2.33 	disclosures and ability to opt-out no later than August 1, 2015. Notwithstanding Laws 
2.34 	2002, chapter 395, article 1, section 11, this section does not expire.