State Privacy Laws and the Right to Opt Out of Profiling

State privacy laws often give consumers the right to opt out of profiling when it is used to further automated decisions with legal or similarly significant effects. The idea appears in multiple frameworks, but coverage is not uniform. Minnesota’s Consumer Data Privacy Act, in Minnesota Statutes §§325M.10–.21, gives consumers a right to opt out of targeted advertising, sale and profiling in furtherance of decisions with legal or similarly significant effects. If such profiling occurs, Minnesota also gives rights to question the result, receive the reason, learn feasible actions that might have changed it, review the data used, correct inaccurate data and obtain reevaluation. Connecticut’s Data Privacy Act defines profiling and gives consumers a right to opt out of profiling for such consequential decisions, while requiring assessments for certain high-risk processing. Colorado’s Privacy Act covers certain profiling and has detailed rules; its newer automated decision statute follows a separate 2027 schedule. Virginia’s law uses a similar significant-effect framework but has its own definitions and applicability thresholds. These laws generally apply only to covered controllers processing data about residents in an individual or household context, with statutory thresholds and exclusions. Some exempt entities or data, and some laws exclude decisions governed by other regimes. Consumer rights may be exercised through direct requests, and laws that require universal opt-out signals may specify which processing those signals cover. A routine content recommendation usually differs from an automated decision about credit, employment, housing, education, healthcare or essential services. However, the exact line depends on statute, system role and effect. Businesses should not infer that a single state’s definitions or exceptions apply nationwide.