Minnesota Age-Appropriate Design Code Act establishment
SF4574 would create the Minnesota Age-Appropriate Design Code Act, a consumer data privacy law focused on online products that are reasonably likely to be accessed by children. The bill requires covered businesses to design products with children’s best interests in mind and to prioritize children’s privacy, safety, and well-being over commercial interests when those interests conflict. It defines covered terms such as “child” (under 18), “online product,” “profiling,” “dark pattern,” and “specific geolocation data,” and sets out age-based developmental stages that businesses should consider when designing products.
The bill imposes a series of obligations on businesses that meet specified size or data-use thresholds and do business in Minnesota. These include conducting and maintaining data protection impact assessments for child-accessible products, updating those assessments when practices change, using high-privacy default settings for children, writing privacy disclosures in age-appropriate language, and providing accessible tools for children and parents to exercise privacy rights. It also prohibits certain practices, such as profiling children by default, collecting unnecessary personal data, using children’s data for purposes beyond those for which it was collected, collecting precise geolocation data by default, and using dark patterns to pressure children into giving up privacy protections.
The bill would add a new chapter to Minnesota Statutes, chapter 325M, and make a related amendment to section 13.6505 to classify data protection impact assessments held by the attorney general as nonpublic/private data. It would apply to businesses operating in Minnesota that exceed revenue or data-processing thresholds, while excluding certain HIPAA-regulated health information, clinical trial data, and Gramm-Leach-Bliley Act data. Enforcement would rest exclusively with the attorney general, who could seek injunctions and civil penalties of up to $2,500 per negligent violation or $7,500 per intentional violation per affected child, subject to a 90-day cure period for qualifying businesses. The bill also states that it creates no private right of action and does not require age-gating or monitoring of third-party content.
Based on the bill text and available context, the measure appears to be framed as a child-safety and privacy protection bill rather than a punitive enforcement measure. The overall policy direction is protective of minors’ online privacy and well-being, with a strong emphasis on limiting data collection and manipulative design practices. No committee transcript or vote record is available here, so there is no documented recorded debate or vote sentiment to assess beyond the bill’s stated purpose and structure.
The main likely points of contention are the scope of business obligations, the breadth of the “best interests of children” standard, and the operational burden of conducting impact assessments and changing product design for child-accessible services. Businesses may also object to restrictions on profiling, geolocation collection, and default privacy settings, as well as the attorney general’s authority to demand assessments on short timelines. On the other hand, supporters would likely emphasize the need to curb data exploitation, dark patterns, and harmful design features affecting children. The bill attempts to address some concerns by excluding certain regulated health and financial data, preserving Section 230 consistency, and explicitly rejecting a private right of action and mandatory age-gating.