Minnesota: AI health laws

Minnesota Consumer Data Privacy Act (HF 4757, Laws 2024, Chapter 121, Article 5; Minn. Stat. 325M.10 to 325M.21)

Gives consumers rights to access, correct, delete and port their personal data, to opt out of targeted advertising, sale and profiling for decisions with legal or similarly significant effects, including decisions on health care, and to question the result of such profiling, and requires consent before a controller processes sensitive data, which includes mental or physical health conditions and diagnoses.

Physician read. The act excludes protected health information under HIPAA, Minnesota health records and related health information, not HIPAA-covered practices as such, so a practice that meets its thresholds must still apply it to other personal data it holds. Since July 31, 2025, a covered business needs a consumer's consent to process health data and must let consumers question the result of profiling used in decisions with legal or similarly significant effects, which include decisions on health care services.

Applies to: Businesses that control or process personal data of 100,000 or more Minnesota consumers (excluding data processed only to complete a payment), or of 25,000 or more while deriving over 25 percent of gross revenue from selling personal data; small businesses as defined by the U.S. Small Business Administration are exempt except from a bar on selling sensitive data without consent

Notes: Postsecondary institutions regulated by the Office of Higher Education need not comply until July 31, 2029. Enforced by the attorney general. The revisor's notes on 325M.10 and 325M.17 give the July 31, 2025 effective date, and the revisor shows no amendments to sections 325M.10 to 325M.21 after 2024. The health exclusions in 325M.12 are data-level: protected health information, health records under section 144.291, patient information under 42 C.F.R. part 2 and related research and quality data. Consent for sensitive data is in 325M.16; the definition of decisions with legal or similarly significant effects in 325M.11 lists health care services. Laws 2026, ch. 111 (HF 4138) added social media rules for minors to the same chapter (section 325M.40, effective July 1, 2027); it is outside the map's scope.