• by Wendy Davis  @wendyndavis, May 20, 2024

Minnesota lawmakers on Sunday passed a privacy bill that would give state residents the right to wield more control over their data, including by rejecting online behavioral advertising.

If signed by Governor Tim Walz, the Minnesota Consumer Data Privacy Act would require businesses to allow consumers to opt out of the collection and use of their personal information for “targeted advertising” -- meaning ads served based on data obtained or inferred from consumers' activity over time and across nonaffiliated websites or apps.

The bill's definition of personal information includes pseudonymous data that's “linked or reasonably linkable” to individuals -- such as device identifiers or cookies.

The proposed law wouldn't restrict companies from serving ads based on non-sensitive first-party data, or from serving contextual ads -- such as ads based on the content of a site or app where they appear.

The measure also wouldn't prevent businesses from collecting ad-related analytics data, such as information about performance, frequency and reach.

As with some other other privacy bills, the Minnesota statue would require companies to honor universal opt-out signals that consumers can transmit with mechanisms like the Global Privacy Control -- provided that the mechanism isn't activated by default. The Global Privacy Control, developed by privacy advocates, sends an opt-out command to every website that consumers visit.

The Minnesota measure would also require companies to obtain consent before collecting or using “sensitive” data, including location information as well as data that could reveal people's race, religion, health conditions, sexual orientation and citizenship.

The measure would allow the attorney general to bring enforcement actions against violators, but only after first sending warning letters and giving the businesses 30 days to correct any violations.

Unlike the recently passed Vermont privacy bill, the Minnesota measure does not authorize private lawsuits by consumers.

The Minnesota bill's data minimization provisions would prohibit companies from collecting more personal data than what's “adequate, relevant, and reasonably necessary in relation to the purposes for which the data are processed.”

That provision is seen as weaker than one in Vermont's bill that would ban companies from gathering more information than “reasonably necessary and proportionate” to provide specific products or services requested by consumers.

Advocacy group Consumer Reports was lukewarm about the bill. The organization stated Monday that it contains “important consumer protections,” such as requiring companies to honor universal opt-out mechanisms.

But the organization also said the bill has “potential loopholes,” including “insufficient enforcement mechanisms and data minimization provisions.”

If enacted, the bill would take effect July 2025.