Minnesota

A 2025 amendment expanded Minnesota's definition of child sexual abuse material at section 617.246 to reach a visual depiction that has been created, adapted, or modified to appear that an identifiable minor is engaging in sexual conduct, including one created by generative artificial intelligence or other computer technology processing data-input prompts, where the depicted individual is indistinguishable from an actual minor and the material is obscene.

Because section 617.247's dissemination and possession offenses incorporate section 617.246's definition, this AI-generated category carries the same felony exposure as other child sexual abuse material: up to seven years and a $10,000 fine for dissemination (up to 15 years and $20,000 with an aggravating factor), and up to five years and a $5,000 fine for possession (up to ten years and $10,000 with an aggravating factor).

A companion immunity provision, section 617.2471, bars civil or criminal liability under sections 617.246 or 617.247 for material that qualifies as child sexual abuse material solely because it is an AI-generated depiction, from being imposed on an interactive computer service, an information or telecommunications service provider, or their employees, for actions taken to detect, report, or respond to such material, or for content provided by another person.

It is a crime to knowingly or recklessly disseminate a deep fake, or to enter a contract to disseminate one, without the depicted individual's consent, with intent to injure a candidate or influence an election result, within 90 days before a party nominating convention or after the start of absentee voting before a primary or general election. There is no disclosure safe harbor; the offense turns on lack of consent and electoral intent, not on whether the item is labeled synthetic.

A 2024 amendment added that a convicted candidate forfeits the nomination or office and is disqualified from appointment to another office, and armed the attorney general, a county or city attorney, the depicted individual, or an injured candidate with a civil action for injunctive or equitable relief.

It is a crime under section 617.262 to intentionally disseminate a deep fake that realistically depicts a person's intimate parts, artificially generated intimate parts presented as the depicted individual's, or the depicted individual engaging in a sexual act, knowing or with reason to know the depicted individual did not consent, where the individual is identifiable.

The base offense is a gross misdemeanor; it becomes a felony punishable by up to three years and a $5,000 fine where an aggravating factor applies, including that the actor profited, ran a website for the purpose of disseminating the material, obtained it by hacking, or has a prior conviction under the chapter.

A parallel civil cause of action at section 604.32, enacted the same day, lets the depicted individual sue for general and special damages, disgorgement of the disseminator's profit, a civil penalty of up to $100,000, and injunctive relief, with a civil fine of up to $1,000 per day for violating an order under the section.

Both sections exempt dissemination for law-enforcement, medical-treatment, newsworthy, scientific, or legal-proceeding purposes, and section 617.262 immunizes interactive computer services and telecommunications providers for content provided by another person.

A 2026 amendment to the utilization review act adds paragraph (f) to section 62M.09, subdivision 3, barring a utilization review organization from using any form of automated processing alone, without a clinician review by an appropriate health professional as the rest of the subdivision already requires, when making an adverse determination on a health care service, admission, or extension of stay.

A utilization review organization under this chapter is a private entity, such as an insurance company, prepaid limited health service organization, or health plan company, rather than a state agency. The amendment reached enactment as section 6 of House File 4188, an omnibus commerce policy bill, after a conference committee substituted new language for the entire bill (a delete-everything amendment).

House File 2500, a stand-alone bill on the same subject, was introduced in 2025 and never advanced past its initial committee referral. Its companion, Senate File 1856, was amended in committee in 2026 but received no recommendation and no floor vote in either chamber. The House repassed the conference report 121-13 on May 16, 2026, and the Senate 49-15 on May 17, 2026; the governor approved the act, filed as 2026 Minnesota Session Law chapter 124, on May 27, 2026.

The amendment's own effective-date clause makes it effective January 1, 2027, applying to health plans offered, sold, issued, or renewed on or after that date.

Minnesota's breach notification duty, a separate and pre-existing chapter from MCDPA, was originally enacted by 2005 Minn. Laws ch. 167, section 1, and has since been amended by 2006 Minn. Laws ch. 212, article 1, sections 17 and 24, and ch. 233, sections 7 and 8. The Revisor's own history note for this section carries only chapter and year, with no day-precise commencement date, so no effective date is recorded here rather than an invented one; the section is currently in force.

A person or business must disclose a breach of the security of the system, following discovery or notification of the breach, to any Minnesota resident whose unencrypted personal information was or is reasonably believed to have been acquired by an unauthorized person, made in the most expedient time possible and without unreasonable delay.

Unlike Maryland's or Tennessee's fixed-day deadlines, Minnesota uses a reasonableness standard with no numeric cap; a data maintainer that does not own the information must notify the owner immediately upon discovery.

MCDPA governs private-sector processing of Minnesota residents' personal data, enacted as Laws of Minnesota 2024, chapter 121, article 5. A controller must limit collection to what is adequate, relevant, and reasonably necessary for the disclosed processing purpose, and must obtain consent before processing for an undisclosed, incompatible secondary purpose.

The general effective date, July 31, 2025, binds every controller except postsecondary institutions regulated by the Office of Higher Education, which are not required to comply until July 31, 2029, per the statute's own history note.

MCDPA grants a Minnesota consumer the rights to confirm processing, access, correct, delete, port their personal data, and opt out of targeted advertising, sale, and certain profiling, with an appeal right for denials.

A consumer may also demand a list of the specific third parties a controller disclosed their personal data to, going further than the multi-state model's usual categories-only disclosure, and may opt out of automated profiling for decisions with legal or similarly significant effects, question such a decision, receive an explanation, and have it reevaluated if based on inaccurate data.

A controller must respond within 45 days of receipt, extendable once by 45 additional days, and must respond to an appeal within 45 days, extendable by 60 additional days.

The Minnesota Attorney General may bring a civil action to enforce MCDPA under the general false-advertising and consumer-protection statute, Minn. Stat. § 8.31, with a civil penalty of up to $7,500 per violation plus litigation costs and injunctive relief. MCDPA expressly bars any private right of action, including one brought under § 8.31's own private-attorney-general provision.

A discretionary warning-letter and 30-day cure opportunity existed but has already sunset, expiring January 31, 2026; the Attorney General may now sue directly without first offering a cure window.

MCDPA classifies data revealing racial or ethnic origin, religious beliefs, a mental or physical health condition or diagnosis, sexual orientation, or citizenship or immigration status; the processing of biometric data or genetic information to uniquely identify an individual; a known child's data; and precise geolocation data as sensitive data, processable only with the consumer's opt-in consent, the ordinary multi-state model rather than Maryland's outright sale ban.

"Biometric data" means data generated by automatic measurement of biological characteristics used to identify a specific individual, and it excludes a bare photograph, video, or audio recording, but claws that exclusion back the moment data generated from one is used to identify a specific individual.

Subdivision 1 provides that a person is guilty of unauthorized computer access if the person intentionally and without authorization attempts to or does penetrate a computer security system or electronic terminal.

This ties Minnesota's authorization test to circumventing an actual technical security measure rather than a bare access without permission formulation, a meaningfully narrower and more code-centric test than some readings of the federal Computer Fraud and Abuse Act (CFAA): a plain crawl of a public page behind no security system would not, on the statute's own terms, appear to fall within it.

The enhanced felony and gross-misdemeanor tiers in subdivisions 2 and 3 are keyed specifically to electronic terminal access through opening a panel or access door, reading as aimed at ATM or point-of-sale skimming hardware rather than general network intrusion; the base misdemeanor crime in subdivision 1 is the one of general application to network or web access. No reported Minnesota appellate decision applies this section to scraping or public-page access.

Personal data excludes deidentified data or publicly available information, defined as information lawfully made available from government records or widely distributed media, or that a controller reasonably believes was lawfully made available to the public. This is the ordinary, unqualified exemption, with no biometric carve-back of the kind Maryland's MODPA carries.

The Act applies to an entity doing business in Minnesota or targeting Minnesota residents that in a calendar year controls or processes personal data of 100,000 consumers or more, or derives more than 25% of gross revenue from selling personal data and processes or controls data of 25,000 consumers or more.

Section 325M.14(g) grants an unusual right: where personal data is profiled in furtherance of a decision with legal or similarly significant effect, the consumer has the right to question the result of the profiling, to be informed of the reason that the profiling resulted in the decision, and, if feasible, to be informed of what actions the consumer might have taken to secure a different decision, going beyond the opt-out right most peer state privacy acts stop at.

Section 325M.20(d) expressly states the Act establishes no private right of action for a violation of its provisions or any other law; enforcement is by the Attorney General, with civil penalties up to $7,500 per violation. Effective July 31, 2025, except that postsecondary institutions regulated by the Office of Higher Education have until July 31, 2029.

Requires a covered social media platform (10,000 or more account holders, or at least $1 billion in worldwide revenue) to estimate a new account holder's age after 25 hours of use within six months, treating the user as a child (age 15 or younger) unless it can conclude with 80 percent confidence the user is 16 or older, rising to a 90 percent confidence threshold at 50 hours of use.

Child accounts require verifiable parental consent, must default to the most private settings, and may not display addictive interface features such as infinite scroll, autoplay, push notifications, or targeted advertising.