A new state law that took effect Thursday boosts consumer protections designed to empower Minnesotans to control how their private personal information is used online. 

The Minnesota Consumer Data Privacy Act states that any data that reveals details about a person — such as names, email addresses, login credentials or browsing history — is classified as personal data.

Under the provisions, consumers have a right to know what personal information a business has about them and a right to tell them to delete it. They can also be provided a list of third parties who purchased the data; seek a copy of any of that data; and opt out of businesses selling, profiling or using their data for target ads, among other provisions. 

Minnesota is one of 20 states with similar laws. There is no federal law on consumer privacy or data retention, so state legislatures are filling the void, said Megan Bowman, an attorney with Fredrickson & Byron who works with businesses on data privacy.

"[The laws are] meant to ensure that you and I know where our personal information is, who has it and to give us control over that," Bowman said. 

Companies that have the data of 100,000 or more Minnesota residents or earn over 25% of their revenue from the sale of personal data must comply with the new statutes. The new rules limit the amount of information they collect, and businesses are required to get consent before collecting or selling sensitive information like race, ethnicity, religion and location.

"The things that are required by this law have for several years been considered best practice," Bowman said. 

Businesses have to respond to consumers' requests to change or remove their personal data within 45 days. Minnesotans can file complaints with the attorney general's office if they believe companies aren't complying.

Sen. Bonnie Westlin, DFL-Plymouth, one of the authors of the legislation, said state lawmakers took cues from other states, including California, which was the first to approve a similar measure in 2018.

"This particular bill, I think, has drawn on sort of the best of some of the other states, and it does provide really significant protections for consumers," Westlin said. "Your data should be in your control, and this really allows you to decide who has access to it."

The Minnesota Legislature approved the measure during the 2024 session. The change comes in the wake of the targeted lawmaker shootings in June that killed DFL Speaker Emerita Melissa Hortman and her husband, Mark, and injured Sen. John Hoffman and his wife, Yvette. 

Authorities say the accused assassin used websites that aggregate personal information to stalk lawmakers before the attack, and he had a hit list with the names of other Democratic state and federal elected officials on it. 

Westlin said the shootings highlight the importance of data privacy in a very "unfortunate and tragic way" and that she and her colleagues have a heightened sensitivity to their online footprints as a result.

"It's not just for us. This is really a provision to make sure that everybody else has those same protections and the ability to protect their private information," she said. "Because it's not just legislators who may be subject to somebody nefarious, you know, looking for that information."

For more information about the new law, click here.