Minnesota Consumer Data Privacy Act

The Minnesota Consumer Data Privacy Act took effect on July 31, 2025. It applies to businesses that handle the personal data of 100,000 or more Minnesota consumers (not counting payment-only data), or 25,000 or more while getting over 25% of gross revenue from selling personal data.

Small businesses under U.S. SBA standards are exempt, except that they may not sell sensitive data without consent. The law exempts only nonprofits set up to fight insurance fraud, so other nonprofits that meet the thresholds appear to be covered. Colleges regulated by the Office of Higher Education have until July 31, 2029.

• Rights to confirm and access, correct, delete, get a portable copy, and opt out of targeted advertising, sale and profiling.
• A right to question the result of profiling used for decisions, learn why, review the data used, and have the decision looked at again after a correction.
• A right to a list of the specific third parties you disclosed their data to.
• Respond within 45 days, extendable once by 45 more with notice.
• Appeals: answer within 45 days, extendable by 60 more; explain how to complain to the Attorney General, and keep appeal records for 24 months.

Businesses must honor opt-outs sent through an opt-out preference signal, such as Global Privacy Control, that the consumer chose to turn on. Signals recognized under other states’ laws count, and an IP address is enough to treat a visitor as a Minnesota resident.

Sensitive data needs consent, and a known child’s data needs a parent’s consent. For consumers you know are 13 to 16, you need consent before targeted advertising or sale.

Give a reasonably accessible, clear and meaningful privacy notice. Minnesota also requires a data inventory as part of reasonable security, documented privacy policies and procedures naming a chief privacy officer or similar contact, and documented assessments for targeted advertising, sale, sensitive data and profiling.

Only the Attorney General enforces the law; there’s no private right of action. The required warning letter and 30-day cure period ended on January 31, 2026. Penalties are up to $7,500 per violation, plus injunctions and costs.

In February 2026 the Attorney General reported sending hundreds of education letters and dozens of warning letters, some about universal opt-out signals, and receiving more than 200 complaints.