Consumer Reports opposes, unless amended, Minnesota H.F. 2309 (consumer privacy legislation). The bill would provide consumers with important new protections, including the right to know the information companies have collected about them, the right to access, correct, and delete that information, as well as the ability to require businesses to honor authorized agents’ browser privacy signals as an opt out of sale and targeted advertising.
However, the legislation still contains significant loopholes that would hinder its overall effectiveness. We offer several suggestions to strengthen the bill to provide the level of protection that Minnesota consumers deserve. Our suggestions include:
- Removing the pseudonymous data exception which would essentially exempt the majority of the online advertising ecosystem from the most substantive aspects of this bill’s coverage.
- Broadening opt-out rights to include all data sharing and ensuring targeted advertising is adequately covered.
- Removing entity level carveouts.
- Limiting authentication requirements to request to access, correct, and delete.
- Applying authorized agent provisions to rights to access, correct, and delete.
- Removing the right to cure from the Attorney General enforcement section.
- Including strong civil rights protections.
- Removing ambiguities around requirements that the universal opt out mechanism not “unfairly disadvantage” other controllers.
- Amending prohibitions on default opt-outs.
- Clarifying that approximating geolocation by IP address is sufficient residency authentication.
For the full letter, please see the attached PDF.