Businesses and Nonprofits: Get Ready for the New Minnesota Consumer Privacy Act

With the Minnesota Consumer Privacy Act (MCPA), which takes effect July 31, 2025, Minnesota now joins the many other states, like California, that have passed laws granting enhanced data privacy rights to individuals. I first reported on this new law last year.

Who Is Covered?

The MCPA covers legal entities that conduct business in Minnesota or produce products or services targeted to state residents, and that satisfy one or more of the following:

• During a calendar year, control or process the personal data of at least 100,000 consumers (excluding payment transactions).
• Derive over 25% of gross revenue from the sale of personal data and process or control the personal data of at least 25,000 consumers.

Unlike the California Consumer Privacy Act and other state data privacy laws, there is no broad exemption in the MCPA for nonprofits. Businesses and nonprofit organizations must review their privacy policies and practices to assure compliance and avoid enforcement actions by the Minnesota Attorney General’s office.

The AI Revolution: Tech is Taking Over

Artificial intelligence isn’t just tech jargon anymore—it is the headliner at the global innovation festival. From self-driving cars to AI-powered investment tools, AI is flipping industries upside down and rewriting the startup playbook. PwC estimates that AI will add over $15 trillion to the global economy and boost local GDP by 26% by 2030, with the broader market projected to hit $826 billion in just five years.

That’s not just a stat—it is a wake-up call. AI has shifted from a niche subject to a main stage act, captivating everyone from Fortune 500 execs to founders and innovators who are either building with AI or competing against those who are. 

I remember back in law school, grinding through legal textbooks until 2 a.m. and the struggle was real. Fast forward to now, and tools like ChatGPT can solve a semester’s worth of problems in minutes. For entrepreneurs, this isn’t just technological progress — it is a massive shift in the rules of the game. The message is clear: adapt fast or get left behind. Or, as 50 Cent would say: “Get Rich or Die Tryin’.”

Open AI Raises Record Capital

Venture capital is an industry fed by ambition and optimism. There is no better example than Open AI’s recent investment round which raised a record $6.6 billion, while also reportedly turning down billions in potential oversubscriptions.

To provide some context, $150 billion is approximately what the entire U.S. venture capital industry had under management in 1999 to fuel the internet bubble. Just ten years ago, the states of New York, Texas and Florida raised about $6.5 billion—combined.

Minnesota Enacts Comprehensive Data Privacy Law

On May 24, Governor Tim Walz signed into law the Minnesota Consumer Privacy Act (H.F. 4757) (the “MCPA”), which takes effect July 31, 2025.

Minnesota joins the many other states who have now passed laws similar to the California Consumer Privacy Act, granting enhanced data privacy rights to individuals. In the absence of a comprehensive federal privacy law, businesses and organizations that handle personal data must comply with multiple federal, state, and sometimes global data privacy laws.

States with data privacy laws now include California, Connecticut, Colorado, Delaware, Indiana, Iowa, Kentucky, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Rhode Island, Tennessee, Texas, Utah, and Virginia.

Artificial Intelligence Meets Elvis Presley

Broadly defined, Artificial Intelligence, or AI, refers to technology that can simulate human intelligence, particularly tasks generally thought of as requiring human or cognitive function, such as reasoning, problem-solving, and decision-making. We’re all familiar with the all-knowing “algorithm” on our phones and TVs that appears to hear and see all, and just generally know everything that is happening in our lives.

Obviously, AI can be tremendously productive, providing tools for increased efficiency, cost-savings, and the commodity we all could use more of – time! The Small Business and Entrepreneurship Council (SBEC) late last year released a report showing that 48% of small businesses used AI tools and applications in 2023, and that 93% of small business owners agree with that “AI tools offer cost-effective solutions that drive savings and improve profitability.” Other noteworthy stats from the report include high percentages of small businesses using AI for marketing and sales, drafting business plans, financial management and planning, human resources, and project management, among a myriad of other tasks.

AI also encompasses the ability to create a broad variety of content, from song lyrics to legal briefs, and to manipulate images, sound, and other materials – often without the consent of those whose images and voices have been doctored through the use of AI technology. A growing number of applications can generate content, create realistic images and videos from descriptions, and copy or clone images, sounds, and voices.

Of course, such use can infringe privacy and intellectual property rights, and raises a host of legal and ethical concerns. And so (and here I’d like to use AI to imitate your mother’s voice and image), this is why we can’t have nice things (or, in the legal context, regulation is here, and more is likely on the way).

Privacy and publicity laws have long protected the use of a person’s image, name, or likeness in commercial use. Tennessee – home of Music City, Nashville - has become the first state to protect vocal likenesses for both commercial and non-commercial use. The law, signed on March 21 and effective July 1, is called the Ensuring Likeness, Voice, and Image Security Act. The so-called ELVIS Act expands Tennessee’s Personal Rights Protection Act to cover any “sound in a medium that is readily identifiable and attributable to a particular individual, regardless of whether the sound contains the actual voice or a simulation.” Both using a voice simulation or creating an AI tool or engine for such purpose are grounds for a civil action and can also be punished as a misdemeanor with penalties including fines and jail time.

A number of states are proposing similar legislation, and more efforts will likely follow. Federal regulation and rulemaking are also underway, with the FTC recently seeking public comment on a proposed rule prohibiting impersonation of individuals generally, and the creation of technology that can facilitate such impersonation. The US Copyright Office is undertaking a study and initiative to examine the impact of generative AI on copyright law and policy.

AI tools clearly serve an important function and offer new tools to small businesses in the constant challenge to save time and money, particularly in the current labor market in which unemployment is low, skilled workers can be difficult to find, and remote work is still commonplace. Users should be mindful, however, of the evolving, and likely increasing, regulatory environment.

It may be true that you Can’t Help Falling in Love, but keep a Suspicious Mind, Don’t Be Cruel, and don’t let AI be the Devil in Disguise (thought up that last sentence all by myself with no AI assistance)!

Malcolm Harris, Palo Alto: A History of California, Capitalism, and the World (Little, Brown and Company, 2023)

Malcolm Harris lured me into this book, a history of the area now encompassing Silicon Valley, with his very first sentences: “Palo Alto is nice. The weather is temperate; the people educated, rich, healthy, innovative.” Check—this matches my initial impressions, formed when I arrived in 1979 to attend law school on the campus of the university Leland Stanford formed in 1891 in memory of his son, a victim of typhoid at the age of 15.

One detail immediately stood out for me. It was difficult for me, a middle-class son of the Midwest, to come to terms with the fact that the undergraduate parking lot was filled with cars newer and more expensive than those I encountered on a daily basis in the suburban Twin Cities neighborhood of my youth. Nonetheless, I came to see Palo Alto as a wonderful place to spend three years, even if throughout that period I had a nagging feeling that there was something not quite “real,” for lack of a better term, about the place. It turns out this is a feeling I share with Harris, who grew up there. “There were signs,” he writes, “that, if Palo Alto was normal, it was too normal, weirdly normal.” Again, right on target.

Is Your Business Ready for 2024 and the New Data Privacy Laws?

I have the perfect tool to get you started.

Our popular 2024 Legal Guide to Privacy and Data Security is now available. This guide is a collaborative effort between Lathrop GPM and the Minnesota Department of Employment and Economic Development (DEED). You can find a digital version here. You can also get an old school paper version by contacting me here.

The guide is written for non-lawyers and offers insight into a variety of privacy and data security related laws, the impact of such laws on businesses, and best practices to mitigate risks.

Keep that Bot out of your Boardroom

I regularly attend the Board meetings of the entrepreneurial companies I work with. I find it is a good way for me, as outside counsel, to stay abreast of the business’s strategies, key challenges, and opportunities. I also frequently serve as “Meeting Secretary,” keeping the minutes of the meeting.

At the risk of sounding too lawyerly, recording accurate minutes of Board meetings is one important part of maintaining good governance for your entity. This can be important for a variety of reasons, including holding officers and directors accountable for their actions and helping to prevent fraud and mismanagement, as well as mitigating risks of certain types of litigation, including corporate veil piercing.

Using AI to Create “Creative” Works

I have previously written on this blog about the intersection of entrepreneurship and the creative arts, in particular the copyright considerations that businesses must consider when creating or re-using media. The skyrocketing interest over the past year in artificial intelligence-driven content (aspects of which were covered in recent posts by Alex and Brandi) has led to some exciting but also concerning developments in how we think about creating and protecting media.

 It is now possible to ask a machine learning-powered tool to create an essay or a painting and to receive somewhat convincing results. On the one hand, these developments have been criticized as devaluing the contributions of legitimate human artists. On the other, proponents have argued that these AI tools provide creative services that some people or businesses could not otherwise afford or access.

Will Machine Learning Make Us Less Intelligent?

If you are wondering whether I used AI to write this blog post, the answer is no. This will soon become obvious since no respectable AI program would go off on tangents as much as I do.

Having graded many undergraduate student essays, it is very disheartening to know that students can now ask a computer program to write a full essay for them on just about any topic in a matter of minutes. Will this new machine learning craze fundamentally change the next generation’s ability to do basic, fundamental research and writing?

ChatGPT—The Next Generation of AI?

If you have spent any time on the internet in the last few months (and who hasn’t), you’ve undoubtedly heard of Open AI’s ChatGPT, which has taken the world by storm since its release last November. Rather than try to explain ChatGPT myself, I figured I would let ChatGPT introduce itself to you all. So, I had the following conversation with ChatGPT:

United States Patent and Trademark Office Unveils New IP Identifier Tool to Assist Entrepreneurs

Last week, the United States Patent and Trademark Office (USPTO) unveiled its new Intellectual Property (IP) Identifier Tool to assist inventors, entrepreneurs, and small businesses in identifying inventions, brands, and other business assets that can be protected by intellectual property rights.

The IP Identifier Tool is a user-friendly, virtual resource specifically designed by the USPTO for those who may be less familiar with intellectual property rights—patents, trademarks, copyrights and trade secrets. The IP Identifier Tool enables users to first identify whether they have any intellectual property that can be protected, and then helps them to identify specific protections that would help them secure and further develop their business assets. The IP Identifier Tool also provides easily digestible information on intellectual property basics, including guidance to help a user navigate the application process for a patent, trademark or copyright.

What Do California, Virginia, Colorado, Connecticut and Utah Have in Common? New Data Privacy Laws That Take Effect in 2023

Are you ready for the California Privacy Rights Act (CPRA)?

The CPRA, which becomes effective January 1, 2023, is essentially an extension and amendment of the California Consumer Privacy Act (CCPA). In my last blog post, I wrote about the first CCPA enforcement action by the California Attorney General, which resulted in a $1.2 million settlement with Sephora Now the CPRA has created a new well-funded California Privacy Protection Agency (CPPA), which will likely to be far more aggressive in bringing actions than the California Attorney General’s Office has been.

Other states have followed California and passed more stringent data privacy laws. Virginia’s Consumer Data Protection Act also goes into effect January 1, 2023. The Colorado Privacy Act becomes effective July 1, 2023, as does the new data privacy law in Connecticut. Utah’s Consumer Privacy Act becomes effective December 31, 2023.

Kevin Starr, California: A History (New York: Modern Library, 2005).

Forty years ago, I had just graduated from a law school that is part of a private research university in what is now known as Silicon Valley. At the time, this was a somewhat sleepy area, tucked among the wealthy southern suburbs of San Francisco but devoid of much industry—except for Hewlett-Packard, located just southeast of campus on Page Mill Road, which made hand-held calculators for engineering students.

I now wonder at the personages among whom I lived at the time, and occasionally ponder what might have happened if I had invested my law school tuition with some of the startups occurring all around me. Frequently, after this painful exercise, I consider what it was about the area that was so conducive to entrepreneurial activity in the early 1980s. Here’s where Kevin Starr, in his California: A History, has much to contribute.

First CCPA Enforcement Action by the California AG – Lessons Learned

The California Privacy Rights Act (CPRA) and other new state data privacy laws are set to take effect in 2023. If you needed an incentive to review your compliance obligations, the California Attorney General recently provided one in its $1.2 million settlement of an enforcement action under the California Consumer Privacy Act (CCPA), upon which the CPRA expands. Anyone with an e-commerce website should take heed.

Summary of the Enforcement Action. According to the California AG, Sephora, a French cosmetics brand, failed to disclose to consumers it was “selling” (a broadly defined term under the CCPA) their personal information; failed to honor user requests to opt out of sales via a user-enabled Global Privacy Control; and failed to cure these violations within the 30-day period allowed by the CCPA. In addition to the settlement amount, Sephora promised to report to the AG on its changes to its privacy regimen for a period of two years.

Metals Here, Metals There, Metals Everywhere

What do most environmentalists and techies have in common? Metals. Whether you are trying to save the planet from greenhouse gases or just really like to have the latest phone from that certain fruit-named company and a self-driving electric car from that one car company whose CEO also likes to shoot stuff into space, you are likely a consumer of a lot of metals, many of which you may never have even heard. So, you are a consumer of metals, so what?

WIPO Global Awards reward small and medium-sized enterprises making a global impact

In 2022, the World Intellectual Property Organization (WIPO) launched a new initiative to recognize the innovative efforts of small and medium-sized enterprises (SMEs) from around the world. WIPO’s new Global Awards are designed to identify new inventions and creative commercial solutions that impact economic, social, and cultural progress, and in turn, encourage innovation and the commercialization of IP assets.

WIPO is a self-funding agency of the United Nations (comprising 193 member states) that provides a global forum for IP services, policy, information, and cooperation. WIPO’s mission is to ensure a world where innovation and creativity from anywhere in the world is supported by IP rights for the good of everyone. An aim of the Global Awards is to recognize and support enterprises and individuals striving to make a positive impact through innovation both at home and beyond borders.

Minneapolis/St. Paul Ranked High for Startups:

As a lawyer who works with startups for a living, I wasn’t surprised to see that M25, an early-stage venture firm based in Chicago that invests in tech startups headquartered in the Midwest, has (again) ranked the Twin Cities #2 among its Best of the Midwest Startup Cities Rankings. I’ve known for a couple of decades that the Twin Cities is a pretty great place to start a business and this report just validates that.

The rankings are rooted in three general areas: the amount of startup activity, how supportive the area’s ecosystem is for startups, and the general business climate. The top two (Chicago at #1) have been consistent among the 59 metropolitan areas ranked since these rankings started in 2017. Pittsburgh, which had consistently been ranked third fell to fourth behind a rising Indianapolis, which really benefitted from aggressive funding availability through programs (direct investment, angel tax credit, etc.)

Is that the Real McCoy?

Counterfeit products are fake goods designed, packaged, and branded to look like the real thing. They were historically of a lesser quality. For many years, the counterfeit market was considered a problem primarily for manufacturers of well-known luxury or high-end consumer goods such as name-brand clothing, shoes, purses, shoes, watches, jewelry, and electronics.

The fake items were sold by street vendors to persons who might not be likely customers for the genuine products, so actual “lost sales” to the brand owner were questionable. In most of these situations, purchasers would have (or should have) a fairly good idea that they were not purchasing a genuine product, so lack of quality would not be a surprise or blamed on the brand owner.

Digital Assets: Lathrop GPM Takes on Consensus

Author: Julian Sansano 

I recently attended the largest cryptocurrency, non-fungible token (“NFT”), and digital asset conference in the world. Consensus by Coindesk attracts tens of thousands of people from around the world, in a variety of fields and sectors, who either participate in the world of digital assets or are looking to build their knowledge and network in the digital asset world. Incredible buzz and excitement—think trade show meets rock concert, but the rockstars were the largest players and influencers in the digital asset game. For example, the founder of Cardano, a cryptocurrency, presented in jeans and a tee-shirt about his optimistic views on the future of cryptocurrency and their utility in the modern world, while the Chairman of the U.S. Commodity Futures Trading Commission presented in a suit about incoming crypto regulation.