Law / United States / 
Minnesota
HF 4138 (2026), STOP HARMS from Addictive Social Media Act
Minn. Stat. §§ 325M.33, 325M.40 (2026 Minn. Laws ch. 111)
A social media and minors rule binding private bodies.
- Audit expectation
- none
What it requires
- Applies to social media platforms with 10,000 or more Minnesota account holders, or at least $1 billion in worldwide revenue in one of the preceding three years.
- Estimate a new account holder's age after 25 hours of use within six months, and treat the user as a child (age 15 or younger) unless you can conclude with 80 percent confidence that the user is 16 or older; the threshold rises to 90 percent confidence at 50 hours of use.no control in the NIST Privacy Framework
- Obtain verifiable parental consent for child accounts.NIST Privacy FrameworkCT.PO-P1
- Default child accounts to the most private settings.NIST Privacy FrameworkGV.PO-P2
- Do not display addictive interface features such as infinite scroll, autoplay, push notifications, or targeted advertising on child accounts.NIST Privacy FrameworkCT.PO-P1
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- GV.PO-P2Processes to instill organizational privacy values within system/product/service development and operations are established and in place.
- CT.PO-P1Policies, processes, and procedures for authorizing data processing (e.g., organizational decisions, individual consent), revoking authorizations, and maintaining authorizations are established and in place.
Our reading of where this law's duties sit in each framework, and in the NIST Privacy Framework, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
If you get it wrong
Criminal exposureNo
Private right of actionYes
Penalties
Actual damages or $10,000 in statutory damages, whichever is greater, for a reckless or knowing violation, plus possible punitive damages and attorney fees; also enforceable as a deceptive trade practice.
Penalty structure
Available to the Minnesota Attorney General under the general consumer-protection civil-penalty statute, Minn. Stat. sec. 8.31, subd. 3(b), because subd. 10 of this Act deems a knowing or reckless violation a deceptive trade practice under Minn. Stat. sec. 325D.44 and gives the attorney general enforcement authority under sec. 8.31.
- Rule
- Fixed only
- As of
- Currency
- USD
- Fixed cap
- 25,000
Statutory damages
Available only where the covered platform's violation was reckless or knowing: the child or parent recovers actual damages or $10,000 in statutory damages, whichever is greater. A negligent violation recovers general and special damages, court costs and fees, and reasonable attorney fees, but no $10,000 statutory floor. Punitive damages are separately available for a consistent pattern of reckless or knowing conduct.
- As of
- Currency
- USD
- Per person reckless
- 10,000
Who enforces it
Enforcement body
Minnesota Attorney General, who has enforcement authority under Minn. Stat. sec. 8.31 because a knowing or reckless violation is deemed a deceptive trade practice under Minn. Stat. sec. 325D.44; a child or parent also has a private right of action under Minn. Stat. sec. 325M.40, subd. 9.
Settledness
- As of
- Open questions
- How does a covered social media platform reach a "percentage confidence score" of 80 percent under Minnesota Statutes section 325M.40, subdivision 2, paragraph (a), when the statute names no age-estimation method or scoring standard?
- Is time that a new account holder spends on the platform while logged out, or on another device, counted toward the 25 hours in Minnesota Statutes section 325M.40, subdivision 2, paragraph (a)?
What it reaches
Age threshold
16
Covered services
Social media platforms with 10,000 or more Minnesota account holders, or at least $1 billion in worldwide revenue in one of the preceding three years.
How the hook was established
express
What makes it apply
Data subject residence, User location
Obligation class
Age verification, Consent, Design code
Verification methods
Self declaration, Parental consent
Applicability criteria
- As of
- Combinator
- Any of
- Criteria
- a social media platform that has 10,000 or more account holders
- a social media platform that has earned at least $1,000,000,000 in revenues worldwide in one or more of the preceding three years
What it makes you log
What the log must hold
Consent or opt-out state
Logging duty
Subdivision 7, headed "Verifiable parental consent; records", requires a covered platform to retain documentation sufficient to reasonably establish that it obtained verifiable parental consent. It states no retention period and no format. Subdivision 2(d) says the age-estimation duty creates no duty to request, collect or retain any information about an account holder except as subdivision 7 provides. The Attorney General enforces under section 8.31, which this row does not code.
- Kind
- Implicit
- As of
- Provision
- Minn. Stat. § 325M.40, subd. 7 (2026 Minn. Laws ch. 111, sec. 2)
- Trigger
- consent_or_optout
What this law does
Requires a covered social media platform, as the Act defines that term in subdivision 1, to estimate a new account holder's age after 25 hours of use within six months, treating the user as a child (age 15 or younger) unless it can conclude with 80 percent confidence the user is 16 or older, rising to a 90 percent confidence threshold at 50 hours of use.
Child accounts require verifiable parental consent, must default to the most private settings, and may not display addictive interface features such as infinite scroll, autoplay, push notifications, or targeted advertising.
When LexLint raises it
When your app profile says your app operates a social platform.
Back to the example · Lint your app
Page updated .