1.1 	A bill for an act
1.2 	relating to consumer data privacy; creating the Minnesota Age-Appropriate Design 
1.3 	Code Act; placing obligations on certain businesses regarding children's consumer 
1.4 	information; providing for enforcement by the attorney general;proposing coding 
1.5 	for new law in Minnesota Statutes, chapter 13; proposing coding for new law as 
1.6 	Minnesota Statutes, chapter 325O.
1.7 	BE IT ENACTED BY THE LEGISLATURE OF THE STATE OF MINNESOTA:

1.8 	Section 1. [13.6505] ATTORNEY GENERAL DATA CODED ELSEWHERE.
1.9 		Subdivision 1.Scope. The sections referred to in this section are codified outside this 
1.10 	chapter. Those sections classify attorney general data as other than public, place restrictions 
1.11 	on access to government data, or involve data sharing.
1.12 		Subd. 2.Data protection impact assessments. A data protection impact assessment 
1.13 	collected or maintained by the attorney general under section 325O.04, is classified under 
1.14 	subdivision 4 of that section.

1.15 	Sec. 2. [325O.01] CITATION; CONSTRUCTION.
1.16 		Subdivision 1.Citation. This chapter may be cited as the "Minnesota Age-Appropriate 
1.17 	Design Code Act."
1.18 		Subd. 2.Construction. (a) A business that develops and provides online services, 
1.19 	products, or features that children are likely to access must consider the best interests of 
1.20 	children when designing, developing, and providing that online service, product, or feature.
2.1 	(b) If a conflict arises between commercial interests of a business and the best interests 
2.2 	of children likely to access an online product, service, or feature, the business must prioritize 
2.3 	the privacy, safety, and well-being of children over its commercial interests.

2.4 	Sec. 3. [325O.02] DEFINITIONS.
2.5 	(a) For purposes of this chapter, the following terms have the meanings given.
2.6 	(b) "Aggregate consumer information" means information that relates to a group or 
2.7 	category of consumers, from which individual consumer identities have been removed, that 
2.8 	is not linked or reasonably linkable to any consumer or household, including via a device. 
2.9 	Aggregate consumer information does not mean one or more individual consumer records 
2.10 	that have been deidentified.
2.11 	(c) "Business" means:
2.12 	(1) a sole proprietorship, partnership, limited liability company, corporation, association, 
2.13 	or other legal entity that is organized or operated for the profit or financial benefit of its 
2.14 	shareholders or other owners that:
2.15 	(i) collects consumers' personal information or on behalf of which that information is 
2.16 	collected;
2.17 	(ii) alone, or jointly with others, determines the purposes and means of the processing 
2.18 	of consumers' personal information;
2.19 	(iii) does business in Minnesota; and
2.20 	(iv) satisfies one or more of the following thresholds:
2.21 	(A) has annual gross revenues in excess of $25,000,000, as adjusted every odd-numbered 
2.22 	year to reflect the Consumer Price Index;
2.23 	(B) alone or in combination, annually buys, receives for the business's commercial 
2.24 	purposes, sells, or shares for commercial purposes, alone or in combination, the personal 
2.25 	information of 50,000 or more consumers, households, or devices; or
2.26 	(C) derives 50 percent or more of its annual revenues from selling consumers' personal 
2.27 	information; and
2.28 	(2) any entity that controls or is controlled by a business as defined in clause (1) and 
2.29 	that shares common branding with the business. For purposes of this clause, "control" or 
2.30 	"controlled" means ownership of, or the power to vote, more than 50 percent of the 
2.31 	outstanding shares of any class of voting security of a business; control in any manner over 
3.1 	the election of a majority of the directors, or of individuals exercising similar functions; or 
3.2 	the power to exercise a controlling influence over the management of a company. For 
3.3 	purposes of this clause, "common branding" means a shared name, servicemark, or trademark 
3.4 	that the average consumer would understand that two or more entities are commonly owned.
3.5 	For purposes of this chapter, for a joint venture or partnership composed of businesses in 
3.6 	which each business has at least a 40 percent interest, the joint venture or partnership and 
3.7 	each business that composes the joint venture or partnership shall separately be considered 
3.8 	a single business, except that personal information in the possession of each business and 
3.9 	disclosed to the joint venture or partnership must not be shared with the other business.
3.10 	(d) "Child" means a consumer who is under 18 years of age.
3.11 	(e) "Collect" means buying, renting, gathering, obtaining, receiving, or accessing any 
3.12 	personal information pertaining to a consumer by any means. This includes receiving 
3.13 	information from the consumer, either actively or passively, or by observing the consumer's 
3.14 	behavior.
3.15 	(f) "Consumer" means a natural person who is a Minnesota resident, however identified, 
3.16 	including by any unique identifier.
3.17 	(g) "Dark pattern" means a user interface designed or manipulated with the substantial 
3.18 	effect of subverting or impairing user autonomy, decision making, or choice.
3.19 	(h) "Data protection impact assessment" means a systematic survey to assess and mitigate 
3.20 	risks to children who are reasonably likely to access the online service, product, or feature 
3.21 	that arise from the data management practices of the business.
3.22 	(i) "Default" means a preselected option adopted by the business for the online service, 
3.23 	product, or feature.
3.24 	(j) "Deidentified" means information that cannot reasonably be used to infer information 
3.25 	about, or otherwise be linked to, a particular consumer provided that the business that 
3.26 	possesses the information:
3.27 	(1) takes reasonable measures to ensure that the information cannot be associated with 
3.28 	a consumer or household;
3.29 	(2) publicly commits to maintain and use the information in deidentified form and not 
3.30 	to attempt to reidentify the information, except that the business may attempt to reidentify 
3.31 	the information solely for the purpose of determining whether its deidentification processes 
3.32 	satisfy the requirements of this paragraph; and
4.1 	(3) contractually obligates any recipients of the information to maintain the data in 
4.2 	deidentified form in accordance with this definition.
4.3 	(k) "Likely to be accessed by children" means an online service, product, or feature that 
4.4 	it is reasonable to expect would be accessed by children based on any of the following 
4.5 	indicators:
4.6 	(1) the online service, product, or feature is directed to children, as defined by the 
4.7 	Children's Online Privacy Protection Act, United States Code, title 15, section 6501 et seq.;
4.8 	(2) the online service, product, or feature is determined, based on competent and reliable 
4.9 	evidence regarding audience composition, to be routinely accessed by a significant number 
4.10 	of children;
4.11 	(3) the online service, product, or feature contains advertisements marketed to children;
4.12 	(4) the online service, product, or feature is substantially similar or the same as an online 
4.13 	service, product, or feature subject to clause (2);
4.14 	(5) the online service, product, or feature has design elements that are known to be of 
4.15 	interest to children, including but not limited to games, cartoons, music, and celebrities who 
4.16 	appeal to children; or
4.17 	(6) a significant amount of the audience of the online service, product, or feature is 
4.18 	determined, based on internal company research, to be children.
4.19 	(l) "Online service, product, or feature" does not mean any of the following:
4.20 	(1) telecommunications service, as defined in United States Code, title 47, section 153; 
4.21 	or
4.22 	(2) the delivery or use of a physical product.
4.23 	(m) "Personal information" means information that identifies, relates to, describes, is 
4.24 	reasonably capable of being associated with, or could reasonably be linked, directly or 
4.25 	indirectly, with a particular consumer or household. Personal information includes but is 
4.26 	not limited to the following if it identifies, relates to, describes, is reasonably capable of 
4.27 	being associated with, or could be reasonably linked, directly or indirectly, with a particular 
4.28 	consumer or household:
4.29 	(1) identifiers such as a real name, alias, postal address, unique personal identifier, online 
4.30 	identifier, Internet Protocol address, email address, account name, Social Security number, 
4.31 	driver's license number, passport number, or other similar identifiers;
4.32 	(2) characteristics of protected classifications under state or federal law;
5.1 	(3) commercial information, including records of personal property; products or services 
5.2 	purchased, obtained, or considered; or other purchasing or consuming histories or tendencies;
5.3 	(4) biometric information;
5.4 	(5) Internet or other electronic network activity information, including but not limited 
5.5 	to browsing history, search history, and information regarding a consumer's interaction with 
5.6 	an Internet website application, or advertisement;
5.7 	(6) geolocation data;
5.8 	(7) audio, electronic, visual, thermal, olfactory, or similar information;
5.9 	(8) professional or employment-related information;
5.10 	(9) education information, defined as information that is not publicly available personally 
5.11 	identifiable information as defined in the Family Educational Rights and Privacy Act, United 
5.12 	States Code, title 20, section 1232g, and Code of Federal Regulations, title 34, part 99;
5.13 	(10) inferences drawn from any of the information identified in this paragraph to create 
5.14 	a profile about a consumer reflecting the consumer's preferences, characteristics, 
5.15 	psychological trends, predispositions, behavior, attitudes, intelligence, abilities, and aptitudes; 
5.16 	and
5.17 	(11) sensitive personal information.
5.18 	Personal information does not include publicly available information or lawfully obtained, 
5.19 	truthful information that is a matter of public concern. Personal information does not include 
5.20 	consumer information that is deidentified or aggregate consumer information.
5.21 	(n) "Precise geolocation" means any data that is derived from a device and that is used 
5.22 	or intended to be used to locate a consumer within a geographic area that is equal to or less 
5.23 	than the area of a circle with a radius of 1,850 feet, except as prescribed by regulations.
5.24 	(o) "Profiling" means any form of automated processing of personal information that 
5.25 	uses personal information to evaluate certain aspects relating to a natural person, including 
5.26 	analyzing or predicting aspects concerning a natural person's performance at work, economic 
5.27 	situation, health, personal preferences, interests, reliability, behavior, location, or movements.
5.28 	(p) "Publicly available" means information that is lawfully made available from federal, 
5.29 	state, or local government records or information that a business has a reasonable basis to 
5.30 	believe is lawfully made available to the general public by the consumer or from widely 
5.31 	distributed media. Publicly available does not mean biometric information collected by a 
5.32 	business about a consumer without the consumer's knowledge.
6.1 	(q) "Sell" means selling, renting, releasing, disclosing, disseminating, making available, 
6.2 	transferring, or otherwise communicating orally, in writing, or by electronic or other means 
6.3 	a consumer's personal information by the business to a third party for monetary or other 
6.4 	valuable consideration.
6.5 	(r) "Sensitive personal information" means:
6.6 	(1) personal information that reveals:
6.7 	(i) a consumer's Social Security, driver's license, state identification card, or passport 
6.8 	number;
6.9 	(ii) a consumer's account log-in, financial account, debit card, or credit card number in 
6.10 	combination with any required security or access code, password, or credentials allowing 
6.11 	access to an account;
6.12 	(iii) a consumer's precise geolocation;
6.13 	(iv) a consumer's racial or ethnic origin, religious or philosophical beliefs, or union 
6.14 	membership;
6.15 	(v) the contents of a consumer's mail, email, and text messages unless the business is 
6.16 	the intended recipient of the communication; or
6.17 	(vi) a consumer's genetic data;
6.18 	(2) the processing of biometric information for the purpose of uniquely identifying a 
6.19 	consumer;
6.20 	(3) personal information collected and analyzed concerning a consumer's health; or
6.21 	(4) personal information collected and analyzed concerning a consumer's sex life or 
6.22 	sexual orientation.
6.23 	Sensitive personal information that is publicly available is not sensitive personal information 
6.24 	or personal information.
6.25 	(s) "Share" means sharing, renting, releasing, disclosing, disseminating, making available, 
6.26 	transferring, or otherwise communicating orally, in writing, or by electronic or other means 
6.27 	a consumer's personal information by the business to a third party for cross-context behavioral 
6.28 	advertising, whether or not for monetary or other valuable consideration, including 
6.29 	transactions between a business and a third party for cross-context behavioral advertising 
6.30 	for the benefit of a business in which no money is exchanged.
6.31 	(t) "Third party" means a person who is not any of the following:
7.1 	(1) the business with whom the consumer intentionally interacts and that collects personal 
7.2 	information from the consumer as part of the consumer's current interaction with the business 
7.3 	under this title;
7.4 	(2) a service provider to the business; or
7.5 	(3) a contractor with the business.

7.6 	Sec. 4. [325O.03] SCOPE; EXCLUSIONS.
7.7 	This chapter does not apply to:
7.8 	(1) protected health information that is collected by a covered entity or business associate 
7.9 	governed by the privacy, security, and breach notification rules issued by the United States 
7.10 	Department of Health and Human Services, Code of Federal Regulations, title 45, parts 160 
7.11 	and 164, established pursuant to the Health Insurance Portability and Accountability Act 
7.12 	of 1996, Public Law 104-191, and the Health Information Technology for Economic and 
7.13 	Clinical Health Act, Public Law 111-5;
7.14 	(2) a covered entity governed by the privacy, security, and breach notification rules 
7.15 	issued by the United States Department of Health and Human Services, Code of Federal 
7.16 	Regulations, title 45, parts 160 and 164, established pursuant to the Health Insurance 
7.17 	Portability and Accountability Act of 1996, Public Law 104-191, to the extent the provider 
7.18 	or covered entity maintains patient information in the same manner as medical information 
7.19 	or protected health information as described in clause (1); or
7.20 	(3) information collected as part of a clinical trial subject to the federal policy for the 
7.21 	protection of human subjects, also known as the common rule, pursuant to good clinical 
7.22 	practice guidelines issued by the International Council for Harmonisation or pursuant to 
7.23 	human subject protection requirements of the United States Food and Drug Administration.

7.24 	Sec. 5. [325O.04] BUSINESS OBLIGATIONS.
7.25 		Subdivision 1.Requirements for businesses. A business that provides an online service, 
7.26 	product, or feature likely to be accessed by children must:
7.27 	(1) before any new online services, products, or features are offered to the public, 
7.28 	complete a data protection impact assessment for any online service, product, or feature 
7.29 	likely to be accessed by children and maintain documentation of this assessment as long as 
7.30 	the online service, product, or feature is likely to be accessed by children;
7.31 	(2) biennially review all data protection impact assessments;
8.1 	(3) document any risk of material detriment to children that arises from the data 
8.2 	management practices of the business identified in the data protection impact assessment 
8.3 	required by clause (1) and create a timed plan to mitigate or eliminate the risk before the 
8.4 	online service, product, or feature is accessed by children;
8.5 	(4) within three business days of a written request by the attorney general, provide to 
8.6 	the attorney general a list of all data protection impact assessments the business has 
8.7 	completed;
8.8 	(5) within five business days of a written request by the attorney general, provide the 
8.9 	attorney general with a copy of any data protection impact assessment;
8.10 	(6) estimate the age of child users with a reasonable level of certainty appropriate to the 
8.11 	risks that arise from the data management practices of the business or apply the privacy and 
8.12 	data protections afforded to children to all consumers;
8.13 	(7) configure all default privacy settings provided to children by the online service, 
8.14 	product, or feature to settings that offer a high level of privacy, unless the business can 
8.15 	demonstrate a compelling reason that a different setting is in the best interests of children;
8.16 	(8) provide any privacy information, terms of service, policies, and community standards 
8.17 	concisely, prominently, and using clear language suited to the age of children likely to 
8.18 	access that online service, product, or feature;
8.19 	(9) if the online service, product, or feature allows a child's parent, guardian, or any 
8.20 	other consumer to monitor the child's online activity or track the child's location, provide 
8.21 	an obvious signal to the child when the child is being monitored or tracked;
8.22 	(10) enforce published terms, policies, and community standards established by the 
8.23 	business, including but not limited to privacy policies and those concerning children; and
8.24 	(11) provide prominent, accessible, and responsive tools to help children, or if applicable 
8.25 	their parents or guardians, exercise their privacy rights and report concerns.
8.26 		Subd. 2.Data protection impact assessments; requirements. (a) A data protection 
8.27 	impact assessment required by this section must:
8.28 	(1) identify the purpose of the online service, product, or feature; how it uses children's 
8.29 	personal information; and the risks of material detriment to children that arise from the data 
8.30 	management practices of the business; and
8.31 	(2) address, to the extent applicable:
9.1 	(i) whether the design of the online product, service, or feature could harm children, 
9.2 	including by exposing children to harmful, or potentially harmful, content on the online 
9.3 	product, service, or feature;
9.4 	(ii) whether the design of the online product, service, or feature could lead to children 
9.5 	experiencing or being targeted by harmful, or potentially harmful, contacts on the online 
9.6 	product, service, or feature;
9.7 	(iii) whether the design of the online product, service, or feature could permit children 
9.8 	to witness, participate in, or be subject to harmful, or potentially harmful, conduct on the 
9.9 	online product, service, or feature;
9.10 	(iv) whether the design of the online product, service, or feature could allow children 
9.11 	to be party to or exploited by a harmful, or potentially harmful, contact on the online product, 
9.12 	service, or feature;
9.13 	(v) whether algorithms used by the online product, service, or feature could harm children;
9.14 	(vi) whether targeted advertising systems used by the online product, service, or feature 
9.15 	could harm children;
9.16 	(vii) whether and how the online product, service, or feature uses system design features 
9.17 	to increase, sustain, or extend use of the online product, service, or feature by children, 
9.18 	including the automatic playing of media, rewards for time spent, and notifications; and
9.19 	(viii) whether, how, and for what purpose the online product, service, or feature collects 
9.20 	or processes sensitive personal information of children.
9.21 	(b) A data protection impact assessment conducted by a business for the purpose of 
9.22 	compliance with any other law complies with this section if the data protection impact 
9.23 	assessment meets the requirements of this chapter.
9.24 	(c) A single data protection impact assessment may contain multiple similar processing 
9.25 	operations that present similar risks only if each relevant online service, product, or feature 
9.26 	is addressed.
9.27 		Subd. 3.Prohibitions on businesses. A business that provides an online service, product, 
9.28 	or feature likely to be accessed by children must not:
9.29 	(1) use the personal information of any child in a way that the business knows, or has 
9.30 	reason to know, is materially detrimental to the physical health, mental health, or well-being 
9.31 	of a child;
9.32 	(2) profile a child by default unless both of the following criteria are met:
10.1 	(i) the business can demonstrate it has appropriate safeguards in place to protect children; 
10.2 	and
10.3 	(ii) either of the following is true:
10.4 	(A) profiling is necessary to provide the online service, product, or feature requested 
10.5 	and only with respect to the aspects of the online service, product, or feature with which a 
10.6 	child is actively and knowingly engaged; or
10.7 	(B) the business can demonstrate a compelling reason that profiling is in the best interests 
10.8 	of children;
10.9 	(3) collect, sell, share, or retain any personal information that is not necessary to provide 
10.10 	an online service, product, or feature with which a child is actively and knowingly engaged, 
10.11 	or as described below, unless the business can demonstrate a compelling reason that the 
10.12 	collecting, selling, sharing, or retaining of the personal information is in the best interests 
10.13 	of children likely to access the online service, product, or feature;
10.14 	(4) if the end user is a child, use personal information for any reason other than a reason 
10.15 	for which that personal information was collected, unless the business can demonstrate a 
10.16 	compelling reason that use of the personal information is in the best interests of children;
10.17 	(5) collect, sell, or share any precise geolocation information of children by default, 
10.18 	unless the collection of that precise geolocation information is strictly necessary for the 
10.19 	business to provide the service, product, or feature requested and then only for the limited 
10.20 	time that the collection of precise geolocation information is necessary to provide the service, 
10.21 	product, or feature;
10.22 	(6) collect any precise geolocation information of a child without providing an obvious 
10.23 	sign to the child for the duration of that collection that precise geolocation information is 
10.24 	being collected;
10.25 	(7) use dark patterns to lead or encourage children to provide personal information 
10.26 	beyond what is reasonably expected to provide that online service, product, or feature to 
10.27 	forego privacy protections, or to take any action that the business knows, or has reason to 
10.28 	know, is materially detrimental to the child's physical health, mental health, or well-being; 
10.29 	or
10.30 	(8) use any personal information collected to estimate age or age range for any purpose 
10.31 	other than to fulfill the requirements of subdivision 1, clause (6), or retain that personal 
10.32 	information longer than necessary to estimate age. Age assurance must be proportionate to 
10.33 	the risks and data practice of an online service, product, or feature.
11.1 		Subd. 4.Data practices. (a) A data protection impact assessment collected or maintained 
11.2 	by the attorney general under subdivision 1 is classified as nonpublic data or private data 
11.3 	on individuals under section 13.02, subdivisions 9 and 12.
11.4 	(b) To the extent any information contained in a data protection impact assessment 
11.5 	disclosed to the attorney general includes information subject to attorney-client privilege 
11.6 	or work product protection, disclosure pursuant to this section does not constitute a waiver 
11.7 	of that privilege or protection.

11.8 	Sec. 6. [325O.05] ATTORNEY GENERAL ENFORCEMENT.
11.9 	(a) A business that violates this chapter may be subject to an injunction and liable for a 
11.10 	civil penalty of not more than $2,500 per affected child for each negligent violation, or not 
11.11 	more than $7,500 per affected child for each intentional violation, which may be assessed 
11.12 	and recovered only in a civil action brought by the attorney general in accordance with 
11.13 	section 8.31. If the state prevails in an action to enforce this chapter, the state may, in addition 
11.14 	to penalties provided by this paragraph or other remedies provided by law, be allowed an 
11.15 	amount determined by the court to be the reasonable value of all or part of the state's litigation 
11.16 	expenses incurred.
11.17 	(b) Any penalties, fees, and expenses recovered in an action brought under this chapter 
11.18 	must be deposited in an account in the special revenue fund and are appropriated to the 
11.19 	attorney general to offset costs incurred by the attorney general in connection with 
11.20 	enforcement of this chapter.
11.21 	(c) If a business is in substantial compliance with the requirements of section 325O.04, 
11.22 	subdivision 1, clauses (1) to (5), the attorney general must, before initiating a civil action 
11.23 	under this section, provide written notice to the business identifying the specific provisions 
11.24 	of this chapter that the attorney general alleges have been or are being violated. If, within 
11.25 	90 days of the notice required by this paragraph, the business cures any noticed violation 
11.26 	and provides the attorney general a written statement that the alleged violations have been 
11.27 	cured, and sufficient measures have been taken to prevent future violations, the business is 
11.28 	not liable for a civil penalty for any violation cured pursuant to this section.
11.29 	(d) Nothing in this chapter provides a private right of action under this chapter, section 
11.30 	8.31, or any other law.

11.31 	Sec. 7. EFFECTIVE DATE.
 11.32 	(a) This act is effective July 1, 2024.
12.1 	(b) By July 1, 2025, a business must complete a data protection impact assessment for 
12.2 	any online service, product, or feature likely to be accessed by children offered to the public 
12.3 	before July 1, 2024, unless that online service, product, or feature is exempt under paragraph 
12.4 	(c).
12.5 	(c) This act does not apply to an online service, product, or feature that is not offered to 
12.6 	the public on or after July 1, 2024.