79%
of Minnesota's 19 requirements are already met by California (CA). Here is what MCDPA adds, biggest gaps first.
AppealsConsumers' rightsBig gap
CA0 No statutory appeal process for denied requests.
MCDPA adds3 Internal appeal decided within 45 days (extendable 60 for complex cases) with AG complaint information; records kept 24 months.
Minn. Stat. § 325M.14, subd. 5 · source ↗
ThresholdsWho it coversGap
CA0 For-profit businesses with gross revenue over $26,625,000 (2025 adjusted), or buying/selling/sharing data of 100,000+ consumers or households, or 50%+ revenue from selling/sharing.
MCDPA adds1 100,000 consumers, or 25,000 consumers plus over 25% of gross revenue from sales; SBA small businesses need consent to sell sensitive data.
Minn. Stat. §§ 325M.12, subd. 1; 325M.17 · source ↗
Sensitive dataSensitive data and minorsGap
CA0 Broad sensitive personal information list, including neural data, IDs and financial log-ins; consumers get a right to limit use rather than opt-in consent.
MCDPA adds1 Opt-in consent for sensitive data (race, religion, health, orientation, immigration, biometric, genetic, known child, specific geolocation).
Minn. Stat. §§ 325M.11(v); 325M.16, subd. 2(d) · source ↗
De-identified dataBusiness dutiesGap
CA2 Deidentified data requires reasonable measures, a public commitment not to reidentify, and contract flow-down to recipients.
MCDPA adds3 Public commitment and contract duties for deidentified data; pseudonymous data exemptions; no reidentification by processors or third parties.
Minn. Stat. §§ 325M.11(k), (t); 325M.15 · source ↗
Already covered by CA: Exemptions, Children and teens, Data minimization, Rights, Request deadline, Universal opt-out, Assessments, Processor contracts, Privacy notice, Loyalty programs, Who enforces, Cure period, Maximum penalty, Private action, Rulemaking.
A gap means MCDPA is more demanding than CA on that requirement, on our 0 to 3 scale (how we score). Read the cited section before acting. Not legal advice.
