Does Minnesota require naming the third parties you shared data with?

Most state privacy laws let a consumer ask which categories of third party received their data. Minnesota lets them ask for names.

What subdivision 1(h) says

A consumer has a right to obtain a list of the specific third parties to which the controller has disclosed the consumer's personal data. If the controller does not maintain the information in a format specific to the consumer, a list of specific third parties to whom the controller has disclosed any consumers' personal data may be provided instead.

Two things follow. The default is a named, per-consumer list. And the fallback, for controllers whose systems do not track disclosures per person, is still a named list, just drawn at the level of the whole business rather than the individual.

There is no version of this obligation that is satisfied by writing "advertising partners" and "analytics providers" in a privacy notice.

Why this is a data-inventory problem

The category-level answer that satisfies most states can be written by a lawyer reading a vendor list. A named list cannot. It requires knowing, and keeping current, exactly which entities receive personal data.

For most SaaS businesses the honest starting point is that nobody has that list in one place. It is spread across a vendor register, a tag manager, a CDP configuration, and whatever integrations individual teams enabled. Producing it on a 45-day clock, repeatedly, is an operations task rather than a drafting task.

The aggregate fallback is the pressure valve, and most controllers will use it. It is worth being deliberate about that choice rather than discovering it under a deadline, because relying on the fallback is only available where you genuinely do not maintain the per-consumer format.

What you can hold back

Two limits sit in subdivision 4. Under paragraph (j), a controller is not required to reveal any trade secret in responding to a request. Under paragraph (i), in response to a consumer request the controller must not disclose Social Security number, driver's license number or other government-issued identification number, financial account number, health insurance account number or medical identification number, account password or security questions and answers, or biometric data. Instead the controller must inform the consumer with sufficient particularity that it has collected that type of information.

Those limits shape what a response looks like, but neither is a general excuse for declining to name recipients.

Authentication and cost

Subdivision 4(h) provides that a controller is not required to comply with a request under subdivision 1, paragraphs (b) to (e) and (h), if it cannot authenticate the request using commercially reasonable efforts, and may ask for additional information reasonably necessary to authenticate. Since the third-party list sits in paragraph (h), authentication applies to it.

Under subdivision 4(g), responses are free up to twice annually per consumer. Where requests are manifestly unfounded or excessive, particularly because they are repetitive, the controller may charge a reasonable administrative fee or refuse, but bears the burden of demonstrating that character.

Next step

Naming your data recipients is the kind of obligation that is cheap to satisfy if you already keep the inventory and expensive if you do not. The free 2-minute Obligation Scan tells you which US state privacy laws apply to your business and what each requires. See the Minnesota Consumer Data Privacy Act overview for the applicability thresholds, Minnesota profiling rights for the other unusual right in the same section, and the CCPA right to know for California's narrower category-level equivalent.