HF4511

Purpose

This proposed Minnesota law aims to protect children’s privacy and safety online. It requires online products that kids are likely to access to be designed with kids’ best interests in mind, imposes requirements for evaluating privacy risks, and sets rules for how personal data about children can be collected, used, and shared. Enforcement would be handled by the state attorney general.

Main Provisions (What the bill would do)

• Create a new era of design rules for online products:
  • Businesses that offer online products that children are reasonably likely to access must prioritize privacy, safety, and well-being of children over commercial interests.
  • The design must consider the different developmental stages of children aged 0 to 17 (0–4, 6–9, 10–12, 13–15, 16–17) and tailor features accordingly.
• Data protection impact assessments (DPIA):
  • Businesses must complete a DPIA for any new online product that is reasonably likely to be accessed by children, and keep and update these assessments as processing changes.
  • The DPIA must identify the product’s purpose, how it uses children’s data, and whether its design or data practices could harm children (physically, financially, emotionally, or privacy-wise) including harms from algorithms, targeting, or cross-context advertising.
  • The DPIA must be shared with and available to the attorney general on request, with specific timelines.
• Default privacy and user information:
  • Default privacy settings for products accessed by children must be high-privacy unless there is a compelling reason to do otherwise.
  • Privacy information, terms of service, and community standards must be clear, concise, and age-appropriate.
  • Tools must be available for children and their parents/guardians to exercise privacy rights and report concerns.
• Restrictions on data use and design:
  • Do not process a child’s data in ways that conflict with the child’s best interests.
  • Prohibit default profiling of children unless safeguards ensure it aligns with the child’s best interests or a compelling reason.
  • Limit collection and use of specific geolocation data for children to what is strictly necessary to provide the service and for only as long as needed; require clear signals to the child when location data is being collected.
  • Prohibit “dark patterns” that push children to share more data or bypass privacy protections.
  • Do not allow monitoring of a child’s online activity by someone other than a parent/guardian without clear notice.
  • Limit data collection to what is reasonably necessary to provide the online product the child is actively using.
• Prohibitions and risk management:
  • Do not enable children to be harmed by contracts or activities on the online product.
  • Avoid design or data practices that would facilitate exploitation or harmful interactions affecting a child.
  • Ensure product design does not increase time spent or encourage use through manipulative incentives.
• Scope of applicability and exclusions:
  • The act applies to businesses that collect personal data or have it collected on their behalf in Minnesota, and meet specific size or data-use thresholds.
  • Exclusions include protected health information under HIPAA and related entities, certain financial privacy rules, and certain clinical trial or medical data protections.
  • Online products are defined broadly but exclude telecommunications services, broadband services, or the sale/delivery of physical goods.
• Business structure and data sharing:
  • If a business has affiliates sharing a common brand, those entities may be treated in relation to thresholds in a specific way, and personal data in possession of one affiliate may not be shared with another without compliance.
  • Cross-context behavioral advertising and data sharing with third parties are tightly regulated under the DPIA and best-interests framework.

Scope and Exclusions (When the law would apply)

• Thresholds for applicability:
  • Annual gross revenues over $25 million (adjusted every odd-numbered year for inflation).
  • Or data activities involve selling/sharing personal data for commercial purposes to at least 50,000 consumers, households, or devices.
  • Or at least 50% of annual revenue comes from selling personal data.
• Exclusions:
  • HIPAA health information and certain health-related entities and data.
  • Data covered by other major federal privacy or financial privacy laws.
  • Information collected as part of clinical trials or other regulated contexts.
  • Other specified legal protections and content controls.

Enforcement and Penalties

• The attorney general may seek injunctive relief and civil penalties for violations.
  • Up to $2,500 per affected child for negligent violations.
  • Up to $7,500 per affected child for intentional violations.
• Penalties are recovered through civil actions and deposited into a special revenue fund to offset AG enforcement costs.
• Optional cure process:
  • If a business is in substantial compliance and receives a notice of violation, it can cure the issue within a set period and avoid penalties by remedying the violation and documenting steps to prevent recurrence.
• No private right of action:
  • The law does not create a private right of action by individuals, and it does not preempt other rights to search content or privacy protections otherwise available.

Definitions and Key Terms (selected)

• Best interests of children: actions and design that avoid harm, intrusion, discrimination, or other harms to children.
• Online product: online service, product, or feature (excludes certain telecom and physical goods).
• Child: a consumer under 18.
• Data protection impact assessment (DPIA): a systematic review of how an online product affects children’s privacy and safety.
• Dark pattern: user interface tactics that manipulate users to disclose more data or bypass protections.
• Profiling: automated analysis to predict or infer personal attributes or behavior.
• Specific geolocation data: precise location information about a child.
• Aggregate consumer information: de-identified data that cannot reasonably identify a person or household.
• Cross-context behavioral advertising: sharing data with third parties to target ads outside the original context.

Practical Implications

• For businesses: you may need to redesign products likely to be used by children, implement robust DPIAs, set high-privacy defaults, simplify privacy disclosures for a younger audience, and prepare to respond to AG requests and potential penalties.
• For families and children: privacy protections, clearer rights, and visibility into how online products handle data about minors.
• For regulators: new responsibilities to review DPIAs and enforce compliance with penalties and cure opportunities.

Relevant Terms

• best interests of children, online product, data protection impact assessment, dark pattern, profiling, specific geolocation data, cross-context behavioral advertising, aggregate consumer information, child, consent, privacy rights, high privacy defaults, attorney general, civil penalties, injunction, threshold, affiliate, common branding, harm, discrimination, consent, notice, cure period.