SF 5221

04/21/26  REVISOR  RSI/MG  26-07963  as introduced
  SENATE
  STATE OF MINNESOTA
  NINETY-FOURTH SESSION  S.F. No. 5221
  (SENATE AUTHORS: LUCERO)
  DATE       D-PG  OFFICIAL STATUS
  04/27/2026      9174 Introduction and first reading
  Referred to Commerce and Consumer Protection
1.1A bill for an act
1.2relating to consumer data privacy; governing certain geolocation data; providing
1.3civil penalties; proposing coding for new law in Minnesota Statutes, chapter 325M.
1.4    BE IT ENACTED BY THE LEGISLATURE OF THE STATE OF MINNESOTA:
1.5Section 1. [325M.40] GEOLOCATION DATA; USE; LIMITATIONS.
1.6Subdivision 1. Definitions. (a) For purposes of this section, the following terms have
1.7    the meanings given.
1.8(b) "Collect" means buying, renting, gathering, obtaining, receiving, accessing, or
1.9    otherwise acquiring personal data by any means.
1.10(c) "Consumer" means an individual who is a resident of Minnesota. Consumer does
1.11   not include an individual acting: (1) in a commercial or employment context; or (2) as an
1.12   employee, owner, director, officer, or contractor of a company, partnership, sole
1.13   proprietorship, nonprofit entity, or government agency whose communications or transactions
1.14   with the controller occur solely within the context of the individual's role with the company,
1.15   partnership, sole proprietorship, nonprofit entity, or government agency.
1.16(d) "Controller" has the meaning given in section 325M.11, paragraph (h).
1.17(e) "Device" means a physical object that is capable of directly or indirectly connecting
1.18   to the Internet or another device.
1.19(f) "Personal data" has the meaning given in section 325M.11, paragraph (p).
1.20(g) "Precise geolocation data" means information derived from technology, including
1.21   but not limited to latitude and longitude coordinates from global positioning system
Section 1.  1
 04/21/26  REVISOR  RSI/MG  26-07963  as introduced
2.1  mechanisms or other similar positional data, that reveals with precision and accuracy within
2.2  a radius of 1,750 feet the past or present physical location of (1) an individual, or (2) a
2.3  device that identifies, is linked, or is reasonably linkable to one or more individuals. Precise
2.4  geolocation data does not include the content of a communication, photograph, or video
2.5  unless the content is used to identify an individual's or device's precise geolocation.
2.6      (h) "Process" or "processing" has the meaning given in section 325M.11, paragraph (q).
2.7      (i) "Processor" means a person who collects, processes, or transfers personal data on
2.8  behalf and at the direction of a controller or another processor.
2.9      (j) "Sale of personal data" has the meaning given in section 325M.11, paragraph (u).
2.10     (k) "Third party" means a person that collects personal data from another person who
2.11 is not (1) the consumer to whom the data pertains, or (2) a processor with respect to the
2.12 data.
2.13     Subd. 2. Consumer protections. (a) A controller that collects a consumer's precise
2.14 geolocation data must, in the controller's publicly accessible privacy notice, inform the
2.15 consumer that the consumer's precise geolocation data is being collected. The privacy notice
2.16 must also include:
2.17     (1) the type of precise geolocation data collected, including the data's precision level;
2.18     (2) the goods or services the consumer requested that are the basis for the controller to
2.19 collect, process, or disclose the consumer's precise geolocation data, including a description
2.20 of how the controller processes the precise geolocation data for the purposes indicated in
2.21 this clause;
2.22     (3) whether the controller is collecting, processing, or disclosing precise geolocation
2.23 data to prevent or respond to security incidents, fraud, harassment, malicious or deceptive
2.24 activities, or illegal activity, including a description of how the controller processes the
2.25 precise geolocation data for the purposes indicated in this clause; and
2.26     (4) disclosures describing the precise geolocation data necessary to provide the goods
2.27 or services requested by the consumer, including the identity of each third party to whom
2.28 the precise geolocation data is disclosed.
2.29     (b) In addition to providing notice under paragraph (a), a controller that collects a
2.30 consumer's precise geolocation data must prominently display a notice that informs the
2.31 consumer that the consumer's precise geolocation data is being collected. The notice must
2.32 be provided to the consumer at the time or before collection occurs.
 Section 1.  2
 04/21/26  REVISOR  RSI/MG  26-07963  as introduced
3.1      (c) A controller or processor is prohibited from:
3.2      (1) collecting or processing more precise geolocation data than is necessary to provide
3.3  the goods or services requested by the consumer;
3.4      (2) retaining precise geolocation data for more time than is necessary to provide the
3.5  goods or services requested by the consumer or more than one year after the date the
3.6  consumer last intentionally interacted with the controller, whichever occurs first; or
3.7      (3) selling, trading, or leasing precise geolocation data to a third party.
3.8      (d) Notwithstanding paragraph (c), a controller or processor may collect or process
3.9  precise geolocation data that is necessary to: (1) prevent or respond to security incidents,
3.10 fraud, harassment, malicious or deceptive activities, or illegal activity targeted at the
3.11 consumer; or (2) enable the controller or processor to investigate, report, or prosecute a
3.12 person responsible for an action identified in clause (1). A controller or processor is
3.13 prohibited from retaining precise location information collected and processed under this
3.14 subdivision for more than 90 days, except as required under law. A controller or processor
3.15 is prohibited from using precise location information collected and processed under this
3.16 subdivision for any other purpose.
3.17     (e) Notwithstanding paragraph (c), a controller or processor may use precise geolocation
3.18 data to perform services on behalf of the controller or processor, including maintaining or
3.19 servicing accounts, providing customer service, processing or fulfilling orders and
3.20 transactions, verifying customer information, processing payments, providing financing,
3.21 providing storage, or providing similar services on behalf of the controller or processor. A
3.22 controller or processor is prohibited from using precise location information collected and
3.23 processed under this subdivision for any other purpose.
3.24     Subd. 3. Enforcement. A consumer injured by a violation of subdivision 2 may bring
3.25 a civil action against the party that commits the violation. In a civil action brought under
3.26 this subdivision, the court may award the injured consumer one or more of the following:
3.27     (1) damages in an amount not less than $5,000 per individual per violation, as adjusted
3.28 annually to reflect an increase in the Consumer Price Index, or actual damages, whichever
3.29 is greater;
3.30     (2) punitive damages;
3.31     (3) injunctive relief, including an order that an entity retrieved personal data transferred
3.32 in violation of this section;
3.33     (4) declaratory relief; or
 Section 1.  3
04/21/26  REVISOR  RSI/MG  26-07963   as introduced
4.1     (5) reasonable attorney fees and litigation costs.
Section 1.  4