Minnesota's Right to Question a Profiling Decision: What Section 325M.14, Subdivision 1(g) Says and Leaves Open

The Profiling Provision in the MCDPA

The provision is a single paragraph in the list of consumer rights in Minn. Stat. § 325M.14, subdivision 1. Paragraph (g) reads in full:

If a consumer's personal data is profiled in furtherance of decisions that produce legal effects concerning a consumer or similarly significant effects concerning a consumer, the consumer has the right to question the result of the profiling, to be informed of the reason that the profiling resulted in the decision, and, if feasible, to be informed of what actions the consumer might have taken to secure a different decision and the actions that the consumer might take to secure a different decision in the future. The consumer has the right to review the consumer's personal data used in the profiling. If the decision is determined to have been based upon inaccurate personal data, taking into account the nature of the personal data and the purposes of the processing of the personal data, the consumer has the right to have the data corrected and the profiling decision reevaluated based upon the corrected data.

Minn. Stat. § 325M.14, subd. 1(g)

Two definitions in section 325M.11 set the paragraph's reach. Paragraph (s) defines profiling as "any form of automated processing of personal data to evaluate, analyze, or predict personal aspects related to an identified or identifiable natural person's economic situation, health, personal preferences, interests, reliability, behavior, location, or movements." Paragraph (i) defines the decisions that count: "decisions made by the controller that result in the provision or denial by the controller of financial or lending services, housing, insurance, education enrollment or opportunity, criminal justice, employment opportunities, health care services, or access to essential goods or services."

Read together, the trigger has three elements: automated processing of personal data that evaluates or predicts a personal aspect, a decision by the controller in one of the listed areas, and a link between the two ("in furtherance of"). The right belongs to a consumer, which section 325M.11(g) limits to a Minnesota resident acting in an individual or household context. Separately, section 325M.12, subdivision 2(a)(13), excludes data collected about a job applicant or employee and used solely within that role; the statute does not say how that exclusion interacts with the employment-opportunity category in the decision definition.

What a Consumer May Request

The paragraph contains five distinct entitlements, each with its own wording:

1. To "question the result of the profiling." The verb is not defined and the statute prescribes no form or outcome for a question.
2. To be "informed of the reason that the profiling resulted in the decision." This is unconditional in the text.
3. If feasible, to be informed of actions the consumer "might have taken to secure a different decision" and actions the consumer "might take to secure a different decision in the future." Both halves sit under the same feasibility qualifier.
4. To "review the consumer's personal data used in the profiling." This is narrower than the general access right in paragraph (b), which reaches only the categories of data processed, and broader in that it targets the specific data behind a decision.
5. If the decision "is determined to have been based upon inaccurate personal data," to have the data corrected and "the profiling decision reevaluated based upon the corrected data."

The general request machinery in subdivisions 2 and 4 applies. A consumer exercises a right by "submitting a request, at any time, to a controller specifying which rights the consumer wishes to exercise." Under subdivision 4(e), the controller must report the action taken "without undue delay and in any event within 45 days," with one 45-day extension. A refusal must come with reasons and appeal instructions, and subdivision 5 requires an appeal decision within 45 days (extendable by 60) that tells the consumer how to complain to the Attorney General. Two limits in subdivision 4 bear directly on a reason or data review: paragraph (i) bars disclosing Social Security numbers, government ID numbers, financial and health account numbers, passwords and biometric data in a response, and paragraph (j) provides that a controller "is not required to reveal any trade secret."

The Attorney General's consumer guide, published on the office's Data Privacy pages, describes the right under the heading "Right to Question Profiling Decisions" and offers an illustration: a consumer worried that a company used personal data "to reject your application for housing or another service" could "submit a request to better understand how the company reached its decision," and if the company used incorrect information, "like an outdated credit report," the consumer has "the right to be reevaluated under the MCDPA." The same page links template request and complaint forms specific to profiling. The office states that its guide pages simplify the Act and are "not intended to provide guidance as to how the AGO would enforce the Act."

How It Differs From the Opt-Out Right

Minnesota also gives the opt-out found in most state laws. Paragraph (f) lets a consumer opt out of processing for "profiling in furtherance of automated decisions that produce legal effects concerning a consumer or similarly significant effects." The two paragraphs are worded differently: paragraph (f) refers to automated decisions, while paragraph (g) refers to "decisions" without that adjective. The statute does not explain the difference. On its face, paragraph (g) is tied to profiling (which is automated by definition) used in furtherance of a decision, without a stated requirement that the decision itself be made by automated means.

The opt-out and the right to question also run on different clocks. Subdivision 4(d) requires an opt-out to be honored "as soon as feasibly possible, but no later than 45 days," and subdivision 4(h) says a controller "is not required to authenticate an opt-out request." The right to question falls under the general 45-day reporting rule in subdivision 4(e).

Elsewhere in the Act, profiling for significant decisions carries two further duties. Section 325M.16, subdivision 1(b), requires a controller that engages in it to disclose the processing in its privacy notice and to provide "a clear and conspicuous method outside the privacy notice" to opt out. Section 325M.18(b)(5) requires a documented data privacy and protection assessment for profiling that presents a reasonably foreseeable risk of unfair or deceptive treatment or disparate impact, financial, physical or reputational injury, an offensive intrusion on seclusion, or other substantial injury. The broader structure of the Act, including those assessments, is covered in a companion post on the MCDPA.

Colorado, Tennessee and California Compared

Colorado's Privacy Act uses the same building blocks. Its definition of profiling in C.R.S. 6-1-1303(20) and of "decisions that produce legal or similarly significant effects" in 6-1-1303(10) closely track Minnesota's, as published in the 2024 Colorado Revised Statutes. The rights in section 6-1-1306(1) are an opt-out of "profiling in furtherance of decisions that produce legal or similarly significant effects concerning a consumer," plus general access, correction, deletion and portability. That section contains no right to question a result, to be told the reason for a decision, or to have a decision reevaluated. The Colorado AI Act's separate consequential-decision regime is discussed in a separate post.

Tennessee, whose statute is the subject of a companion post, offers a useful contrast in the definition itself. Public Chapter 408 of 2023 defines profiling as "a form of solely automated processing," and its consumer rights in section 47-18-3203 include an opt-out of "profiling in furtherance of decisions that produce legal or similarly significant effects" but no question or explanation right. Minnesota's "any form of automated processing" contains no "solely" qualifier.

California reaches comparable ground by regulation rather than statute. The California Privacy Protection Agency's approved regulation text defines automated decisionmaking technology as technology that processes personal information and "uses computation to replace human decisionmaking or substantially replace human decisionmaking," and limits significant decisions to financial or lending services, housing, education, employment or independent contracting, and health care. Section 7222 requires a business responding to a request to access ADMT to give plain-language explanations of the specific purpose, "the logic of the ADMT," and the outcome, including how the output was used. Section 7221 provides an opt-out, with an exception where the business offers an appeal to a human reviewer with authority to overturn the decision. Under section 7200(b), a business using ADMT for a significant decision before January 1, 2027 must comply by that date. The full California regime is described in the post on the CPPA's ADMT regulations.

What the Statute Leaves Undefined

Several terms in paragraph (g) have no definition in section 325M.11, and no rule or Attorney General opinion construing them was located for this post. The Act contains no rulemaking grant to the Attorney General.

• Question. The statute gives the consumer a right to question the result but does not say what a controller does with the question beyond the duty to respond to a request within 45 days. It does not require the controller to change the decision, except through reevaluation where data was inaccurate.
• Reason. There is no standard for how specific the reason must be, and no statement of how the trade secret clause in subdivision 4(j) applies to a reason.
• If feasible. The qualifier governs both the past and future counterfactual actions. The statute does not say who decides feasibility or whether a controller must explain why disclosure is not feasible.
• Determined. Correction and reevaluation follow if the decision "is determined to have been based upon inaccurate personal data." The text does not say who makes that determination.
• Reevaluated. The statute does not require human review of the reevaluation or set a deadline for it beyond the general response period.

Two cross-references also leave paragraph (g) in an unusual position. The definition of "authenticate" in section 325M.11(c) covers requests to exercise rights under "paragraphs (b) to (h)," which includes (g). But subdivision 4(h), which excuses a controller from complying when it cannot authenticate a request, lists "paragraphs (b) to (e) and (h)," omitting (g). Section 325M.15(b), which exempts pseudonymous data from certain rights, uses the same list and also omits (g). The text does not explain the omissions.

Finally, the decision definition in paragraph (i) speaks of decisions "made by the controller" resulting in provision or denial "by the controller." Where one company profiles and another decides, the statute does not say which, if either, owes the reason. Section 325M.13(b) requires processors to assist controllers in responding to rights requests, which covers vendors acting on a controller's instructions but not independent controllers.

No lawsuit or published settlement under paragraph (g) was located. The Attorney General's February 5, 2026 update on the Act's first six months describes more than 200 complaints and dozens of warning letters but does not identify any concerning profiling. Since January 31, 2026, the office may sue without first sending a warning letter.

Frequently Asked Questions