Regulations › US states › Minnesota
MCDPA
Minnesota Consumer Data Privacy Act
WhenIn effect since 31 July 2025
Who enforces itState Attorney General
Who it applies toBusinesses that process personal data of the state's residents above the law's thresholds. Thresholds, exemptions and sensitive-data rules differ by state.
Thresholds100,000 consumers, or 25,000 consumers plus over 25% of gross revenue from sales
Universal opt-outMust honor opt-out preference signals for targeted ads and sale
Cure period30-day cure after AG warning letter expired January 31, 2026
Request deadline45 days, extendable once by 45 days with notice
Maximum penaltyUp to $7,500 per violation plus injunction and litigation costs
Private actionNo private right of action, including under section 8.31, subd
Every requirement we score, with the rule in plain words and the section it comes from. Darker means more demanding. See every law side by side →
Who it covers
Thresholds
1
100,000 consumers, or 25,000 consumers plus over 25% of gross revenue from sales; SBA small businesses need consent to sell sensitive data.Minn. Stat. §§ 325M.12, subd. 1; 325M.17 · source ↗
Exemptions
2
Banks, credit unions and insurers exempt as entities; GLBA and HIPAA otherwise data-level; nonprofits covered.Minn. Stat. § 325M.12, subd. 2 · source ↗
Sensitive data and minors
Sensitive data
1
Opt-in consent for sensitive data (race, religion, health, orientation, immigration, biometric, genetic, known child, specific geolocation).Minn. Stat. §§ 325M.11(v); 325M.16, subd. 2(d) · source ↗
Children and teens
2
Under 13: parental consent (COPPA). Ages 13 to 16: consent required for targeted ads or sale.Minn. Stat. §§ 325M.11(o); 325M.16, subd. 2(f) · source ↗
Data minimization
1
Collection adequate, relevant and reasonably necessary for disclosed purposes, plus retention limit.Minn. Stat. § 325M.16, subd. 2(a), (g) · source ↗
Consumers' rights
Rights
3
Access, correct, delete, portability, opt out of ads, sale, profiling, question profiling decisions, and list of specific third parties (9 rights).Minn. Stat. § 325M.14, subd. 1 · source ↗
Request deadline
2
45 days, extendable once by 45 days with notice.Minn. Stat. § 325M.14, subd. 4 · source ↗
Appeals
3
Internal appeal decided within 45 days (extendable 60 for complex cases) with AG complaint information; records kept 24 months.Minn. Stat. § 325M.14, subd. 5 · source ↗
Universal opt-out
2
Must honor opt-out preference signals for targeted ads and sale; signals approved under other states suffice.Minn. Stat. § 325M.14, subd. 3 · source ↗
Business duties
Assessments
2
Assessments for targeted ads, sale, sensitive data and risky profiling, plus documented privacy policies, a named privacy officer and data inventory.Minn. Stat. §§ 325M.16, subd. 2(c); 325M.18 · source ↗
Processor contracts
3
Detailed terms, annual independent assessment option, and subcontracting only after controller can object, with equivalent written terms.Minn. Stat. § 325M.13 · source ↗
Privacy notice
3
Notice with retention policies and date; available in every language offered, accessible, conspicuous 'privacy' link, separate opt-out link.Minn. Stat. § 325M.16, subd. 1 · source ↗
Loyalty programs
2
Bona fide loyalty programs allowed; may notify of signal conflicts but must honor the signal.Minn. Stat. §§ 325M.16, subd. 3(b); 325M.14, subd. 3 · source ↗
De-identified data
3
Public commitment and contract duties for deidentified data; pseudonymous data exemptions; no reidentification by processors or third parties.Minn. Stat. §§ 325M.11(k), (t); 325M.15 · source ↗
Enforcement
Cure period
1
30-day cure after AG warning letter expired January 31, 2026.Minn. Stat. § 325M.20 · source ↗
Maximum penalty
2
Up to $7,500 per violation plus injunction and litigation costs.Minn. Stat. § 325M.20 · source ↗
Private action
0
No private right of action, including under section 8.31, subd. 3a.Minn. Stat. § 325M.20(d) · source ↗
Scores are our reading on the published rubric, checked 18 October 2026. Not legal advice.
Regulations library
Every US state privacy law, on one map
24 states have a comprehensive privacy law in the library, alongside the EU, UK, US federal and global laws: 102 in all, each explained in plain words with its sources. Select a state to see what applies there.
- In force
- Coming into force
- Sector laws