Minnesota passed a law in 2002 that says your internet provider can’t knowingly hand out a list of the websites you visit. It’s still on the books. It comes with a private lawsuit, a $500 minimum recovery, and a shot at attorney fees. As far as I can find, almost nobody has used it in a published decision.
When the Ninth Circuit needed an example of states protecting broadband customers in 2022, it pointed to Minnesota’s law as one of the ones “requiring them to obtain permission from consumers before sharing the consumers’ data.” ACA Connects v. Bonta, No. 21-15430, slip op. at 32 (9th Cir. Jan. 28, 2022). That’s the reputation. The text is more interesting. Minnesota’s statute lets your provider get that permission by sending you a notice and waiting for you not to answer.
It’s a better law than most people know about, and a weaker one than its reputation says.
What the 2002 law actually forbids
The core prohibition is one sentence:
Except as provided in sections 325M.03 and 325M.04, an Internet service provider may not knowingly disclose personally identifiable information concerning a consumer of the Internet service provider.
— Minn. Stat. § 325M.02
And “personally identifiable information” is defined more broadly than the phrase suggests. It “means information that identifies”:
(1) a consumer by physical or electronic address or telephone number;
(2) a consumer as having requested or obtained specific materials or services from an Internet service provider;
(3) Internet or online sites visited by a consumer; or
(4) any of the contents of a consumer’s data-storage devices.
— Minn. Stat. § 325M.01, subd. 5
Clause (3) is the one that matters in 2026. The sites you visit. The Legislature wrote browsing history into the definition of protected information twenty-four years ago, in a bill the governor signed on May 22, 2002. 2002 Minn. Laws ch. 395, art. 1, §§ 1–9. It took effect March 1, 2003. Id., art. 1, § 11.
The provider also has an affirmative duty: it “shall take reasonable steps to maintain the security and privacy of a consumer’s personally identifiable information.” § 325M.05.
Who it covers, and who it doesn’t
Both definitions are narrower than you’d guess.
An “Internet service provider” is “a business or person who provides consumers authenticated access to, or presence on, the Internet by means of a switched or dedicated telecommunications channel upon which the provider provides transit routing of Internet Protocol (IP) packets for and on behalf of the consumer.” § 325M.01, subd. 3. That’s the company carrying your packets. On those words, the cable, fiber, or DSL company you pay every month is the target. A website isn’t. An app isn’t. Neither routes your traffic. The definition also carves out “the offering, on a common carrier basis, of telecommunications facilities or of telecommunications by means of these facilities.” Id.
And a “consumer” is “a person who agrees to pay a fee to an Internet service provider for access to the Internet for personal, family, or household purposes, and who does not resell access.” § 325M.01, subd. 2. So the statute protects the household that pays for service. On those words, it doesn’t protect you on the coffee shop’s free Wi-Fi, because you didn’t pay a fee for access. It doesn’t protect the account your small business pays for, because that isn’t for personal, family, or household purposes.
The law reaches providers “in the provision of services to consumers in this state.” § 325M.09.
Seven times your provider has to talk
Here’s where the reputation and the text start to split. Section 325M.03 doesn’t say when a provider may disclose. It says when it “shall” disclose, and the list is long:
(1) pursuant to a grand jury subpoena;
(2) to an investigative or law enforcement officer as defined in section 626A.01, subdivision 7, while acting as authorized by law;
(3) pursuant to a court order in a civil proceeding upon a showing of compelling need for the information that cannot be accommodated by other means;
(4) to a court in a civil action for conversion commenced by the Internet service provider or in a civil action to enforce collection of unpaid subscription fees or purchase amounts, and then only to the extent necessary to establish the fact of the subscription delinquency or purchase agreement, and with appropriate safeguards against unauthorized disclosure;
(5) to the consumer who is the subject of the information, upon written or electronic request and upon payment of a fee not to exceed the actual cost of retrieving the information;
(6) pursuant to subpoena, including an administrative subpoena, issued under authority of a law of this state or another state or the United States; or
(7) pursuant to a warrant or court order.
— Minn. Stat. § 325M.03
Clause (5) is the one most people would never think to use. You can ask your own provider for what it holds on you, in writing or electronically, and it can charge you no more than “the actual cost of retrieving the information”.
Clause (6) is the one that swallows a lot of the rest. Clause (3) makes a civil litigant show a court “compelling need” before a provider must disclose. Clause (6) then requires disclosure on a subpoena, including an administrative subpoena, issued under the law of Minnesota, any other state, or the United States. Read the two side by side and you’ll wonder how often anyone bothers with clause (3).
The Eighth Circuit noticed. In 2014 a defendant argued that § 325M.02 gave him a reasonable expectation of privacy in the name and address his cable company handed to police on a county attorney’s administrative subpoena. The court said the statutes weren’t the kind of proof the Fourth Amendment requires, and then added that “to the extent Minnesota statutes are relevant,” he “could not have reasonably expected § 325M.02 to protect his subscriber information given that law’s provisions requiring the disclosure of information” to law enforcement and on “an administrative subpoena, issued under authority of a law of this state”. United States v. Wheelock, 772 F.3d 825, 829 (8th Cir. 2014).
Does my provider have to tell me it got a subpoena?
Not under this law. Nothing in §§ 325M.01 to 325M.09 requires a provider to notify you before or after it discloses. And Minnesota’s electronic-records statute says the government side doesn’t owe you notice either: “A governmental entity receiving records or information under this subdivision is not required to provide notice to a subscriber or customer.” Minn. Stat. § 626A.28, subd. 3(c). If you’re going to find out, it’ll usually be because someone files a case and serves you.
Silence counts as yes
Section 325M.04 lists four times a provider may disclose. Two of them are wide.
The first is disclosure to “any person if the disclosure is incident to the ordinary course of business of the Internet service provider”. § 325M.04, subd. 1(1). The statute defines that phrase, and the definition is short: “debt-collection activities, order fulfillment, request processing, or the transfer of ownership.” § 325M.01, subd. 4. That last item means that when your provider gets sold, your information goes with it, and the statute calls that ordinary.
The second is disclosure to “any person with the authorization of the consumer”. § 325M.04, subd. 1(3). This is where the Ninth Circuit’s description and Minnesota’s text part ways. Here’s how a provider gets your authorization:
In order for an authorization to be effective, a contract between an Internet service provider and the consumer must state either that the authorization will be obtained by an affirmative act of the consumer or that failure of the consumer to object after the request has been made constitutes authorization of disclosure. The provision in the contract must be conspicuous.
— Minn. Stat. § 325M.04, subd. 2
Either. The provider picks. If the service agreement conspicuously says that your failure to object after a request counts as authorization, then a request you never answered is consent. The request has to “reasonably describe the types of persons to whom personally identifiable information may be disclosed and the anticipated uses of the information.” Id. And then the subdivision adds that authorization “may be obtained in a manner consistent with self-regulating guidelines issued by representatives of the Internet service provider or online industries”. Id. The industry got to help write the rulebook for its own permission slips. That’s privacy, 2002 edition.
The other two permitted disclosures are narrower: to another provider to report or prevent violations of an acceptable-use policy or service agreement, with the recipient bound by the same chapter, and “as provided by section 626A.27”, Minnesota’s stored-communications statute. § 325M.04, subd. 1(2), (4).
What you can actually sue for
The remedy section reads like a negotiated settlement.
A consumer who prevails or substantially prevails in an action brought under sections 325M.01 to 325M.09 is entitled to the greater of $500 or actual damages. Costs, disbursements, and reasonable attorney fees may be awarded to a party awarded damages for a violation of this section. No class action shall be brought under sections 325M.01 to 325M.09.
In an action under sections 325M.01 to 325M.09, it is a defense that the defendant has established and implemented reasonable practices and procedures to prevent violations of sections 325M.01 to 325M.09.
— Minn. Stat. § 325M.07
Four things in those two paragraphs.
The money is “the greater of $500 or actual damages.” The statute doesn’t say $500 per violation, per disclosure, or per day. A provider that sold a year of your browsing history to one buyer is, on the text, looking at $500 or whatever you can prove you lost.
Fees “may be awarded”. That’s discretion, not a guarantee.
“No class action shall be brought”. So a provider that did the same thing to every customer in the state faces one $500 case at a time, and only from the customers willing to bring one.
And the provider gets a defense if it “has established and implemented reasonable practices and procedures to prevent violations”. A compliance binder isn’t a free pass, but it’s a defense the statute hands over in writing.
Put those together and you can see why a statute this old has so little case law. I searched CourtListener’s opinion database for every section number from § 325M.01 to § 325M.07 and for the statute’s own phrases, and found two decisions that mention it, both federal appellate opinions: Wheelock, on a suppression motion, and ACA Connects, in a list of state laws. Neither is a consumer suing a provider. CourtListener doesn’t index Minnesota district court files, so a trial-court case could exist without showing up there. But I found no appellate decision applying the remedy section.
One more provision a litigator should know. Outside a case about violating the chapter itself, personally identifiable information “obtained in any manner other than as provided in sections 325M.01 to 325M.09 may not be received in evidence in a civil action.” § 325M.06. If the other side got your subscriber records from your provider without going through one of the routes in §§ 325M.03 and 325M.04, that’s an evidence objection waiting to be made.
Why a 2002 law matters more after 2017
In December 2016 the Federal Communications Commission published broadband privacy rules that required providers to “obtain opt-in or opt-out customer approval to use and share sensitive or non-sensitive customer proprietary information, respectively”, and it listed “web browsing history” and “application usage history” among the sensitive categories. Protecting the Privacy of Customers of Broadband and Other Telecommunications Services, 81 Fed. Reg. 87274 (Dec. 2, 2016). Opt-in for browsing history. Stronger than Minnesota.
Congress killed it four months later. Pub. L. 115-22, signed April 3, 2017, is one sentence long: Congress “disapproves the rule” and “such rule shall have no force or effect.” 131 Stat. 88. The FCC then published a notice that the rule “shall be treated as if it had never taken effect.” 82 Fed. Reg. 44118 (Sept. 21, 2017). And under the Congressional Review Act, a disapproved rule “may not be reissued in substantially the same form” unless a later law specifically authorizes it. 5 U.S.C. § 801(b)(2). So the FCC can’t just try again.
The federal law that’s left is the Stored Communications Act, and it splits the world in two. A public provider “shall not knowingly divulge a record or other information pertaining to a subscriber to or customer of such service” to “any governmental entity.” 18 U.S.C. § 2702(a)(3). But it may divulge those same records “to any person other than a governmental entity”. § 2702(c)(6). The government needs process. A data broker needs a contract.
Minnesota’s own version of that statute says the same thing, with one exception written into it: “Except as provided in paragraph (b) or sections 325M.01 to 325M.09, a provider of electronic communication service or remote computing service may disclose a record or other information pertaining to a subscriber to or customer of the service, not including the contents of communications, to any person other than a governmental entity.” Minn. Stat. § 626A.28, subd. 3(a). That exception is the 2002 law. Take it away, and Minnesota’s own statute says your provider’s records about you can go to anyone who isn’t the government.
The law that was built to self-destruct
This one surprised me. Article 1 of the 2002 act, the article that created §§ 325M.01 to 325M.09, carries an expiration clause. The Revisor prints it as a note under each section: “This section expires on the effective date of federal legislation that preempts state regulation of the release of personally identifiable information by Internet service providers.” 2002 Minn. Laws ch. 395, art. 1, § 11. And § 325M.08 adds that if Congress passes a federal ISP-privacy law that doesn’t preempt, the federal law “supersedes any conflicting provisions” of the Minnesota sections.
The Legislature was expecting Washington to show up. In 2017 Washington showed up, killed the federal rule, and preempted nothing. Pub. L. 115-22 has no preemption clause; it doesn’t have room for one. So the Minnesota law that was written to step aside for a federal standard is still here, because there’s no federal standard to step aside for.
Minnesota tried to go further and didn’t
On March 29, 2017, the day after the U.S. House passed the resolution, the Minnesota Senate added a new section to its omnibus jobs and commerce bill. It would have barred a telecommunications or internet provider with a franchise, right-of-way agreement, or other contract with the state or a political subdivision (or one using facilities subject to such an agreement) from collecting a customer’s personal information “without express written approval from the customer”, and added that “[n]o such telecommunication or Internet service provider shall refuse to provide its services to a customer on the grounds that the customer has not approved collection of the customer’s personal information.” S.F. 1937, 3d Engrossment, § 21, 90th Minn. Leg. (2017) (proposed § 237.417). Express written approval is opt-in. That’s a different animal from § 325M.04’s “failure of the consumer to object”.
The Senate passed the bill with that section in it, 58 to 9, on March 29, 2017. The conference committee’s version, adopted May 15, doesn’t have it. And that conference bill was vetoed anyway. There is no § 237.417 in the Minnesota Statutes. Chapter 325M’s first nine sections haven’t been amended since 2002.
What your provider actually knows
In October 2021 the Federal Trade Commission published a staff report on six of the largest providers. Its opening line on the industry: providers “can monitor and record their customers’ every online move”. FTC Staff Report, A Look At What ISPs Know About You: Examining the Privacy Practices of Six Major Internet Service Providers i (Oct. 21, 2021). Among its findings: “Two of the ISPs in our study stated that they use web browsing information to target ads to consumers,” and many placed consumers into advertising segments “allowing advertisers to target consumers by their race, ethnicity, sexual orientation, economic status, political affiliations, or religious beliefs.” Id. at iii. The report also found “a trend in the ISP industry to offer real-time location data about specific subscribers to the ISPs’ third-party customers.” Id. Real-time location brings in a different set of rules; I wrote about the FCC’s location-data penalties against carriers at /news/fcc-att-location-data-penalties-minnesota/, and about Minnesota’s warrant requirement for location data at /news/chatrie-geofence-warrants-minnesota-got-there-first/.
The FTC report is about national companies’ practices, not about whether any of them violated Minnesota law. But it tells you what’s at stake in clause (3) of § 325M.01, subdivision 5. “Internet or online sites visited by a consumer” isn’t a theoretical category.
Doesn’t the new privacy act cover this now?
Partly, and differently. The Minnesota Consumer Data Privacy Act, §§ 325M.10 to 325M.21, reaches legal entities doing business in Minnesota that, during a calendar year, control or process personal data of 100,000 or more consumers, or derive over 25 percent of gross revenue from selling personal data and process data of 25,000 or more. § 325M.12, subd. 1(a). Its list of excluded entities runs to twenty-one clauses (government, banks, insurers, small businesses, an air carrier for some data) and doesn’t exclude internet providers. § 325M.12, subd. 2(a). A large provider is a “controller” like anyone else that “determines the purposes and means of the processing of personal data.” § 325M.11(h). I walked through what the Act requires at /news/minnesota-consumer-data-privacy-act-325m/.
The difference is who gets to sue. The 2024 Act is enforced by the Attorney General. Until early this year it required a warning letter and 30 days to cure before a lawsuit, but that paragraph “expires January 31, 2026”, and it has. The Act also says “[n]othing in sections 325M.10 to 325M.21 establishes a private right of action, including under section 8.31, subdivision 3a, for a violation of sections 325M.10 to 325M.21 or any other law.” § 325M.20(a), (d). The 2002 law, by contrast, has a private action and says nothing about the Attorney General at all. The two laws sit next to each other in the same chapter and run on opposite engines. I explained how the chapter got that crowded, and how it fits with the breach statute and the Data Practices Act, at /news/minnesota-three-privacy-regimes/.
The newest privacy law in Minnesota is the one you can’t sue under. The oldest one, you can, for $500, by yourself.
Madgett Law, LLC
Madgett Law, LLC represents Minnesotans whose personal information was exposed or misused, and advises businesses on the privacy and security laws that govern the customer and employee data they hold. More on that work is on our identity theft and data protection page. If you think your provider disclosed something it shouldn’t have, or your company needs to know which of chapter 325M’s three laws applies to it, send us a message.
Sources: Minn. Stat. § 325M.01, subd. 2 (consumer), subd. 3 (Internet service provider; common-carrier exclusion), subd. 4 (ordinary course of business), subd. 5 (personally identifiable information); § 325M.02 (prohibition); § 325M.03 (required disclosures, clauses (1)–(7)); § 325M.04, subd. 1(1)–(4) (permitted disclosures), subd. 2 (authorization; affirmative act or failure to object; conspicuous contract provision; self-regulating guidelines); § 325M.05 (security); § 325M.06 (exclusion from evidence); § 325M.07 (greater of $500 or actual damages; discretionary fees; no class action; reasonable-practices defense); § 325M.08 (other law; non-preemptive federal law supersedes conflicting provisions); § 325M.09 (application), each with the Revisor’s expiration note. 2002 Minn. Laws ch. 395, art. 1, §§ 1–9 (enacting §§ 325M.01–.09), § 10 (amending § 626A.28, subd. 3), § 11 (effective March 1, 2003; expiration on preemptive federal legislation); signed May 22, 2002. Minn. Stat. § 626A.27 (stored-communications contents); § 626A.28, subd. 3(a) (records to non-governmental persons, except as provided in §§ 325M.01–.09), subd. 3(c) (no notice to subscriber). Minn. Stat. § 325M.11(h) (controller); § 325M.12, subd. 1(a) (MCDPA thresholds), subd. 2(a) (exclusions); § 325M.20(a) (warning letter and cure; expired January 31, 2026), (b) (Attorney General civil action under § 8.31), (d) (no private right of action). S.F. 1937, 90th Minn. Leg. (2017), 3d Engrossment § 21 (proposed § 237.417) and bill status (third reading passed 58–9, March 29, 2017; conference committee report adopted May 15, 2017; vetoed May 15, 2017, veto ch. 64, May 16, 2017); 4th Engrossment (conference version, no such section). Protecting the Privacy of Customers of Broadband and Other Telecommunications Services, 81 Fed. Reg. 87274 (Dec. 2, 2016) (summary; sensitive customer information). Pub. L. 115-22, 131 Stat. 88 (Apr. 3, 2017). 82 Fed. Reg. 44118 (Sept. 21, 2017). 5 U.S.C. § 801(b)(1)–(2) (govinfo, United States Code 2023 edition). 18 U.S.C. § 2702(a)(3), (c)(6) (govinfo, United States Code 2023 edition). United States v. Wheelock, 772 F.3d 825, 829 (8th Cir. 2014). ACA Connects v. Bonta, No. 21-15430, slip op. at 32 (9th Cir. Jan. 28, 2022). FTC Staff Report, A Look At What ISPs Know About You: Examining the Privacy Practices of Six Major Internet Service Providers i, iii (Oct. 21, 2021). This article is general information about Minnesota law, not legal advice. Reading it does not create an attorney–client relationship, and no outcome is promised or implied.