Since January 31, Minnesota’s attorney general no longer has to warn a company before suing it over a privacy violation involving residents’ personal data, including sensitive health information. The change, confirmed by the Minnesota Attorney General’s office, marks the end of a built-in grace period under the Minnesota Consumer Data Privacy Act and shifts the law from a compliance-education phase into one with real enforcement risk.
How the law treats health data
The Minnesota Consumer Data Privacy Act, which took full effect on July 31, 2025, classifies a mental or physical health diagnosis as “sensitive data,” a category that also includes genetic and biometric information, racial or ethnic origin, religious beliefs, sexual orientation, citizenship status, precise geolocation and data collected from known children. Companies covered by the law must secure consumer consent before collecting or processing sensitive data, including information that reveals a health condition, and the law separately bars companies from setting up geofences around healthcare facilities to track or harvest visitor data without consent, a provision aimed squarely at the practice of location-data firms monitoring who enters clinics, hospitals and reproductive health centers.
What changed on January 31
When the law first took effect, it included a standard consumer-protection safety valve: before suing over a suspected violation, the attorney general was required to give the company 30 days’ notice and a chance to fix the problem. That cure period expired on January 31, 2026, and the attorney general’s office has said publicly that it will no longer be required before bringing an enforcement action. In practice, that means a Minnesota company, or an out-of-state company doing business with Minnesota residents, that mishandles health data can now be sued directly rather than given a month to quietly correct course first.
Who the law actually covers
The act applies to companies that control or process personal data belonging to 100,000 or more Minnesota consumers, or that process data on at least 25,000 Minnesota consumers while deriving more than a quarter of their gross revenue from selling personal data. Enforcement rests exclusively with the attorney general; unlike Washington’s My Health My Data Act, Minnesota’s law gives consumers no private right of action to sue on their own. Violations can draw civil penalties of up to $7,500 each, plus the state’s attorney’s fees, a per-violation structure that can scale quickly for a company processing data on tens of thousands of people.
A push to go further on health data specifically
Minnesota lawmakers introduced a follow-up bill, House File 2700, aimed at carving consumer health data out as its own distinct protected category with additional safeguards beyond the general “sensitive data” bucket, including tighter consent requirements for processing or selling health information. As of this year the bill remains pending, but its introduction reflects a broader trend: among states debating how aggressively to restrict AI and data companies’ use of health information for utilization review and other purposes, Minnesota has been flagged by legal trackers including the NADP as the only state to have proposed banning the use of AI in insurance utilization review outright, a notably stricter stance than neighboring states pursuing disclosure-only approaches.
Business groups versus privacy regulators
Trade associations representing data-driven health and wellness companies have argued that removing the cure period removes a reasonable safety net for businesses still working through a genuinely complex compliance landscape, especially smaller health-app developers that may not have dedicated privacy counsel. Attorney General Keith Ellison’s office has countered that a year of advance warning, from the law’s passage through its first six months in effect, was ample time for companies to come into compliance, and that the cure period’s expiration was written into the statute from the start rather than a surprise policy shift.
What’s next
Privacy lawyers expect Minnesota’s office to bring its first post-cure-period enforcement actions sometime this year, and many are watching specifically for a case involving health or location data given the law’s explicit geofencing ban. If House File 2700 advances, Minnesota would join a small group of states, alongside Washington and Nevada, with health-data-specific privacy statutes layered on top of general consumer privacy law, intensifying the patchwork that national health-tech and AI companies must now navigate state by state.
Photo: TheDigitalArtist / PIXABAY via Pixabay
