Minnesota Consumer Data Privacy Act 325M.17: small businesses must not sell sensitive data without prior consent

What does 325M.17 require?

A small business as defined by the U.S. Small Business Administration that does business in Minnesota or targets Minnesota residents, although otherwise excluded, must not sell a consumer's sensitive data without the consumer's prior consent, and the attorney general's penalties and enforcement apply to it.