Mandatory privacy notices required to be titled as surveillance notices.
HF4475 amends Minnesota’s consumer data privacy law to require certain privacy notices to be labeled as “surveillance notices” when a controller sells personal data, uses it for targeted advertising, or engages in profiling that can lead to legal or similarly significant effects for a consumer. The bill keeps the existing transparency framework in place, including required disclosures about categories of data processed, purposes, consumer rights, third-party sharing, contact information, retention policies, and the date of the last update.
In addition to the new title requirement, the bill reinforces how privacy notices must be presented. Controllers must make notices publicly available in all languages used for the covered product or service, ensure accessibility for people with disabilities, post notices conspicuously online or through other consumer-facing channels, and notify consumers when material changes are made. It also requires a clear opt-out mechanism outside the notice itself for sale of data, targeted advertising, and certain profiling activities.
The bill would amend Minnesota Statutes section 325M.16, subdivision 1, by adding a mandatory labeling requirement for certain privacy notices and by reaffirming disclosure and accessibility obligations for data controllers. It would not create a new privacy regime, but it would change how covered businesses present their notices and how consumers can identify and opt out of data practices involving sale, targeted advertising, and profiling. Affected parties include businesses and other entities that act as controllers under Minnesota’s consumer privacy law, especially those engaged in data monetization or behavioral advertising.
Based on the bill text and available context, the measure appears to be framed as a consumer-protection and transparency bill, with a clear emphasis on making data practices more visible to the public. There is no recorded committee debate or vote history in the provided materials, so no direct evidence of support or opposition is available. The title choice, however, suggests an intent to draw attention to invasive data practices and may indicate a policy stance that is more critical of surveillance-based advertising and profiling.
The main point of contention is likely the requirement that qualifying privacy notices be called “surveillance notices,” which is a stronger and more value-laden term than a standard privacy notice. Supporters would likely view the label as an honest description of data practices involving sale, targeted advertising, and profiling, while opponents may argue that the term is pejorative, potentially confusing, or burdensome for businesses. Another possible area of concern is the expanded notice and opt-out obligations for controllers, particularly for companies that operate across multiple languages, platforms, or jurisdictions.