Minnesota Privacy Law

The Minnesota Consumer Data Privacy Act (MCDPA) was signed into law on May 24, 2024, and became effective on July 31, 2025. Minnesota's law is one of the more consumer-protective state privacy laws, combining standard access, deletion, correction, portability, sale opt-out, targeted-advertising opt-out, and profiling opt-out rights with several duties that are less common in the Virginia-model statutes.

The MCDPA gives Minnesota consumers a right to question certain consequential profiling decisions, review the personal data used in the profiling, and have a profiling decision reevaluated if inaccurate data drove the result. It also gives consumers a right to obtain a list of the specific third parties to which the controller disclosed their personal data, unless the controller does not maintain consumer-specific recipient records. Controllers must honor universal opt-out preference signals for sales and targeted advertising, and they must publish privacy notices that include retention-policy disclosures and a last-updated date.

The law applies to entities conducting business in Minnesota or targeting Minnesota consumers that control or process personal data of 100,000 or more Minnesota consumers, or control or process personal data of 25,000 or more Minnesota consumers while deriving more than 25% of gross revenue from the sale of personal data. The Minnesota Attorney General enforces the MCDPA, penalties can reach $7,500 per violation, and the initial mandatory warning-letter cure period expired on January 31, 2026. As of June 3, 2026, businesses should treat Minnesota as an active no-current-mandatory-cure state.

For the keyword "Minnesota data privacy law," the practical 2026 answer is that the MCDPA is no longer a future deadline. The law has been effective since July 31, 2025, the initial mandatory cure window expired January 31, 2026, and the Minnesota Attorney General can seek injunctions and civil penalties up to $7,500 per violation.

Minnesota is not just another 100,000-consumer threshold law. Its distinct compliance burden is the combination of universal opt-out signal recognition, a right to a list of specific third-party recipients, detailed privacy-notice retention disclosures, and unusually explicit profiling transparency rights.

Source check: Last verified June 3, 2026 against Minnesota Statutes Chapter 325M, especially § 325M.14 consumer rights and universal opt-out mechanisms, § 325M.16 controller responsibilities, § 325M.18 data privacy and protection assessments, and § 325M.20 Attorney General enforcement (date_retrieved: 2026-06-03).

• Effective date: July 31, 2025 for most covered controllers; postsecondary institutions regulated by the Office of Higher Education have a delayed compliance date of July 31, 2029.
• Applicability: 100,000 Minnesota consumers, or 25,000 Minnesota consumers plus more than 25% of gross revenue from personal-data sales.
• Enforcement posture: no current mandatory cure period after January 31, 2026; AG enforcement only; no private right of action.
• High-risk processing: data privacy and protection assessments are required for targeted advertising, sale of personal data, sensitive-data processing, and profiling that presents a reasonably foreseeable risk of unfair or deceptive treatment, financial/physical/reputational injury, intrusion, or other substantial injury.