Minnesota — Consumer Data Privacy Act (§§ 325M.10-.21, profiling rights), Social Media Transparency (§§ 325M.33/.335), Nudification Ban (§ 325E.91), Deepfake Election Law (§ 609.771) + MHRA: AI Compliance Requirements

This is the single most demanding automated-decision provision in any US state consumer privacy law and it has no analogue in the Virginia/Colorado/Connecticut model. Where a consumer's personal data "is profiled in furtherance of decisions that produce legal effects concerning a consumer or similarly significant effects concerning a consumer," Minn. Stat. § 325M.14, subd. 1(g) gives that consumer the right (i) "to question the result of the profiling"; (ii) "to be informed of the reason that the profiling resulted in the decision"; (iii) where feasible, to be informed "of what actions the consumer might have taken to secure a different decision and the actions that the consumer might take to secure a different decision in the future"; (iv) "to review the consumer's personal data used in the profiling"; and (v) where the decision is determined to have been based on inaccurate personal data, "to have the data corrected and the profiling decision reevaluated based upon the corrected data." Opt-out alone does not discharge this — a Minnesota consumer can force a controller to explain a model output and re-run the decision on corrected inputs. Operationally this requires per-decision logging of the inputs and the reason factors, a human-reachable channel to receive challenges, and a re-adjudication path. Note the trigger is PROFILING in furtherance of a significant decision, not "solely automated" decision-making — a human in the loop does not by itself take a system outside subd. 1(g). Separately, subd. 1(h) grants a right to obtain a list of the specific third parties to which the controller disclosed the consumer's personal data (a generic list of third parties is permitted only where the controller does not maintain the information consumer-specifically).

Section 325M.18(a) requires a controller to "document and maintain a description of the policies and procedures the controller has adopted to comply with sections 325M.10 to 325M.21," and that description must include, where applicable, "the name and contact information for the controller's chief privacy officer or other individual with primary responsibility for directing the policies and procedures" — a named-accountable-person requirement that most state privacy laws do not impose. It must also describe policies and procedures that reflect § 325M.16 and that are designed to build the Act's requirements into system design, provide personal data to consumers on request, maintain reasonable administrative, technical and physical security "including the maintenance of an inventory of the data that must be managed" (an express data-inventory mandate), limit collection to what is adequate, relevant and reasonably necessary, prevent retention of data no longer relevant and reasonably necessary, and identify and remediate violations. Section 325M.18(b) requires a documented data privacy and protection assessment for targeted advertising, sale of personal data, processing sensitive data, any processing presenting a heightened risk of harm, and profiling where it presents a reasonably foreseeable risk of unfair or deceptive treatment or disparate impact, financial/physical/reputational injury, offensive intrusion on solitude or private affairs, or other substantial injury. Paragraph (d) requires weighing the benefits of processing to controller, consumer, other stakeholders and the public against the risks to the consumer as mitigated by safeguards, factoring in use of deidentified data, reasonable consumer expectations, processing context and the controller-consumer relationship. Paragraph (e) requires the assessment to include the paragraph (a) policy description. Paragraph (f) lets the Attorney General demand any relevant assessment by civil investigative demand; assessments are nonpublic data under Minn. Stat. § 13.02, subd. 9, and disclosure does not waive attorney-client privilege or work product. Paragraphs (g)-(h) allow reuse of assessments done for other laws with similar scope and effect, and a single assessment covering multiple comparable processing operations.

Section 325M.20 vests enforcement exclusively in the Attorney General and provides that a violator is "liable for a civil penalty of not more than $7,500 for each violation." The Act expressly provides that nothing in §§ 325M.10 to 325M.21 establishes a private right of action. The compliance-relevant point for 2026 planning is the cure structure: before bringing an action the Attorney General was required to issue a warning letter identifying the alleged violations and allow 30 days to remedy them — but that warning-letter requirement EXPIRED ON JANUARY 31, 2026. That date has now passed. Minnesota is therefore a no-cure jurisdiction as of this entry's verification date: an MCDPA violation is directly actionable with no statutory right to a pre-suit fix, which materially raises the cost of discovering a gap late. Entities that deferred MCDPA build-out on the assumption a warning letter would arrive first no longer have that cushion.

Minn. Stat. § 325E.91, added by Laws 2026, ch. 72, § 1 (signed May 7, 2026; effective August 1, 2026), is the first state ban of its kind in the nation. It makes it unlawful for a person who owns or operates a website, application, software, program or other service to make available to users the ability to "nudify" an image or video of an identifiable individual, or to do so on a user's behalf, and it prohibits advertising such a service. Nudification is defined in terms of an image or video being altered or generated to depict an intimate part not depicted in the original unaltered image or video of an identifiable individual. An exception applies where the service requires the substantial application of technological or artistic skill by a human creator directing and controlling the output — a narrow carve-out for general-purpose creative tools, not a safe harbour for a filtered general model. The Attorney General may seek civil penalties up to $500,000 per violation, and the depicted individual has a private right of action for damages including mental anguish, punitive damages and attorney fees. LITIGATION POSTURE, stated honestly: xAI filed a First Amendment challenge in the US District Court for the District of Minnesota on July 28, 2026, arguing the statute is overbroad and imposes strict liability on platform operators regardless of terms-of-service prohibitions or technical controls. Judge Donovan W. Frank DENIED xAI's temporary restraining order on July 31, 2026, reasoning that xAI's delay in seeking emergency relief undermined the claim of urgency. The statute therefore took effect on schedule and is enforceable now; the merits of the constitutional challenge remain undecided and no injunction is in place.

Determine MCDPA applicability before building any of the other controls. Section 325M.12 applies the Act to legal entities that conduct business in Minnesota or produce products or services targeted to Minnesota residents AND satisfy one or more thresholds: (1) during a calendar year, control or process personal data of 100,000 consumers or more, "excluding personal data controlled or processed solely for the purpose of completing a payment transaction"; or (2) derive over 25 percent of gross revenue from the sale of personal data and process or control personal data of 25,000 consumers or more. The payment-transaction carve-out in threshold (1) is a real narrowing that retailers frequently miscount. Entity-level exclusions include government entities and federally recognized Indian tribes, banks/credit unions and other financial institutions, insurance companies and producers, health care providers as to protected health information, consumer reporting agencies acting under the FCRA, and small businesses as defined by the US Small Business Administration under 13 CFR part 121. Data-level exclusions include HIPAA protected health information, Driver's Privacy Protection Act data, FERPA records, Gramm-Leach-Bliley data, and personal data of employees and job applicants processed solely within the employment context — the last of which is why the MHRA item in this entry, not the MCDPA, governs AI hiring tools in Minnesota. Small businesses are excluded from the Act generally but remain bound by § 325M.17 (see separate requirement).

Beyond the profiling right, § 325M.14, subd. 1 provides the rights to confirm processing and access data, to correct inaccurate data, to delete, to obtain a portable copy where processing is automated, and to opt out of targeted advertising, sale of personal data, and "profiling in furtherance of automated decisions that produce legal effects concerning a consumer or similarly significant effects." Subd. 4(d) requires a controller to comply with an opt-out request "as soon as feasibly possible, but no later than 45 days of receipt of the request," and subd. 4(e) sets the same 45-day clock for requests generally with one additional 45-day extension where reasonably necessary given complexity or volume. Subd. 4(b) requires one or more secure and reliable request channels, and subd. 4(c) forbids requiring a consumer to create a NEW account to exercise a right (though an existing account may be required). Subd. 3 requires controllers to honor an opt-out preference signal sent by a platform, technology, or mechanism with the consumer's consent; the mechanism must not use a default setting but require an affirmative, freely given, unambiguous choice, and a controller that recognizes opt-out preference signals approved under other state laws is in compliance. Parents/guardians may exercise rights for a known child, and guardians/conservators for a consumer under guardianship (subd. 2(b)-(c)); authorized agents may be designated by browser setting or extension (subd. 2(d)).

A trap for entities that correctly conclude they are outside the MCDPA. Small businesses as defined by the US Small Business Administration under 13 C.F.R. part 121 are excluded from the Act generally by § 325M.12, but § 325M.17(a) provides that a small business "that conducts business in Minnesota or produces products or services that are targeted to residents of Minnesota, must not sell a consumer's sensitive data without the consumer's prior consent." Paragraph (b) applies the § 325M.20 penalties and Attorney General enforcement procedures to a small business that violates the section. There is no consumer-count or revenue threshold on this duty — it reaches any SBA-small business touching Minnesota residents. Practical effect: a small AI or adtech vendor that monetizes precise geolocation, biometric or health-adjacent inference data must obtain prior consent even though none of the Act's other machinery applies to it.

Chapter 325M carries a Social Media Manipulation subchapter (§§ 325M.30-.34) that is separate from the MCDPA and reaches recommender systems directly. Section 325M.33 (Laws 2024, ch. 114, art. 3, s. 66) requires a covered social media platform to publicly and conspicuously post on its website an explanation of how it limits excessive account interactions; an explanation of how it assesses the quality of content and of how those assessments are utilised "in each of the social media platform's algorithmic ranking system, including how the assessments are weighted in relation to other signals"; usage statistics across percentiles of users; an explanation of how it determines whether a notification is time sensitive; and a description of all product experiments conducted on 1,000 or more users. The algorithmic-weighting disclosure is the operative AI provision — it obliges a platform to describe the signal weighting inside its ranking model, not merely to state that a ranking model exists. Section 325M.335 (Laws 2025, 1st Spec. Sess., ch. 3, art. 19, s. 13), effective July 1, 2026 and therefore already live, requires a mental health warning label warning users of potential negative mental health impacts of accessing the platform and providing access to crisis resources including the website and telephone number of a national suicide prevention and mental health crisis hotline system, expressly including but not limited to the 988 Suicide and Crisis Lifeline; the label must appear each time a user accesses the platform and may only be dismissed when the user exits or acknowledges the risk and chooses to proceed. Enforcement for both sits in § 325M.34: the Attorney General may investigate and bring an action for an alleged violation of § 325M.33 or § 325M.335. The statute specifies no penalty figure, and it provides that nothing in §§ 325M.30 to 325M.34 creates a private cause of action for a person injured by a violation of § 325M.33 — note the drafting, which names only § 325M.33 in that bar.

Minn. Stat. § 325E.61 (headed "DATA WAREHOUSES; NOTICE REQUIRED FOR CERTAIN DISCLOSURES" — the heading obscures that this is Minnesota's breach-notification statute) requires disclosure of any breach of the security of the system, following discovery or notification of the breach, to any Minnesota resident whose unencrypted personal information was, or is reasonably believed to have been, acquired by an unauthorized person. Two features matter for AI systems holding training or inference data. First, the individual-notice deadline is a standard-based one — "in the most expedient time possible and without unreasonable delay" — with no fixed day count, so a controller cannot point to a safe-harbour number of days. Second, subd. 2 imposes a hard 48-HOUR clock for notifying consumer reporting agencies where more than 500 persons are affected at one time; that is among the shortest such clocks in the country and is frequently missed because it runs independently of the individual-notice work. Honest absence recorded: subd. 1 contains no Attorney General notification requirement or deadline — Minnesota, unusually, does not require regulator notice of a private-sector breach, though subd. 6 gives the Attorney General enforcement authority. Related but distinct: § 325E.64 (Plastic Card Security Act, "ACCESS DEVICES; BREACH OF SECURITY") and § 325E.59 (use of Social Security numbers) impose separate duties not folded into this item.

Under Minn. Stat. § 609.771 (HF 1370, 2023), it is a crime to disseminate a realistic AI-generated/synthetic depiction of a candidate's speech or conduct WITHOUT that candidate's consent, with intent to injure the candidate or influence an election result, during the window from 90 days before precinct caucuses/conventions through the election. There is no disclosure-label safe harbor — labeling content "AI-generated" does not exempt it if consent and intent elements are met. Obtain the depicted candidate's consent, or ensure content is clearly satire/parody a reasonable person would not mistake for fact (courts have found content "clearly unbelievable" as such falls outside the statute's reach — Kohls v. Ellison, 2025).

Minnesota Human Rights Act (Minn. Stat. § 363A) prohibits employment discrimination. AI-powered resume screening, interview analysis, or selection tools that disproportionately screen out protected classes (race, sex, age, disability) violate the MHRA. Validate AI hiring tools for disparate impact before deployment and document validation methodology.