Can Minnesota consumers opt out of AI profiling?

Related Questions

• Does the Minnesota Consumer Data Privacy Act cover employment AI decisions? Generally no. The Minnesota Consumer Data Privacy Act applies to covered private controllers processing consumer data, but §325M.11 excludes a natural person acting in an employment or commercial context from the definition of consumer, and §325M.12, subdivision 2(13), excludes data collected or maintained about a job applicant, employee, owner, director, officer, medical staff member, or contractor when the data is collected and used solely within that role. Ordinary resume screening, candidate scoring, and employee evaluation therefore do not receive the MCDPA's consumer opt-out or assessment protections. The same business may still be a covered controller for non-employment consumer data if it meets the Act's thresholds.
• When is a data protection assessment required in Minnesota? Minnesota §325M.18 requires a covered private controller to conduct and document a data privacy and protection assessment for personal-data processing involving targeted advertising, sale of personal data, sensitive data, any heightened risk of harm to consumers, or profiling that presents a reasonably foreseeable risk of unfair or deceptive treatment, disparate impact, financial, physical or reputational injury, offensive intrusion, or other substantial injury. The assessment must weigh benefits against risks and account for safeguards. These duties cover qualifying consumer data, not ordinary employment data: §325M.11 excludes people acting in an employment context from the definition of consumer, and §325M.12 excludes job-applicant and employee-role data used solely within that role.
• How do Colorado and Minnesota AI privacy requirements compare? The two states take different approaches. Colorado's AI Act (SB 26-189, which repealed and reenacted SB 24-205 and whose obligations begin January 1, 2027) is a disclosure-and-notice framework: it does not require data protection assessments or high-risk AI classification. Instead, deployers of automated decision-making technology (ADMT) that makes or substantially influences consequential decisions must give consumers interaction notice, disclose adverse outcomes within 30 days, allow data correction, and provide meaningful human review. Minnesota HF-4757 takes the opposite approach, embedding AI governance within broader consumer data privacy protections and requiring data protection assessments before processing that presents foreseeable risk — including automated profiling producing legal or significant effects.