The Minnesota Consumer Data Privacy Act: Scope, Rights, Assessments and Enforcement in Chapter 325M

How the Act Was Enacted and Where It Sits

The Minnesota Consumer Data Privacy Act did not pass as a standalone bill. It is article 5, headed "Consumer Data Policy," of H.F. No. 4757, an omnibus commerce act whose other articles modify cannabis provisions, Department of Commerce fees and other matters. The session law page records that the bill was presented to the governor on May 22, 2024 and signed on May 24, 2024. In the session law, the privacy sections are numbered as a new chapter 325O, running from section 325O.01 (citation) to section 325O.11 (preemption and severability). The Revisor of Statutes codified them instead at sections 325M.10 to 325M.21, inside a chapter that already held Minnesota's 2002 internet service provider privacy law. Readers comparing older commentary against the current statutes will find the same text under two numbering schemes.

Section 14 of article 5 sets one effective date for the whole article: "This article is effective July 31, 2025, except that postsecondary institutions regulated by the Office of Higher Education are not required to comply with this article until July 31, 2029." The Revisor repeats that note under every codified section. The history line beneath each section, as retrieved on October 19, 2026, lists only the 2024 session law, so none of sections 325M.10 to 325M.21 has been amended since enactment.

Who the MCDPA Applies To

Section 325M.12, subdivision 1, applies the Act to "legal entities that conduct business in Minnesota or produce products or services that are targeted to residents of Minnesota" and that meet at least one of two thresholds:

• During a calendar year, control or process personal data of 100,000 consumers or more, "excluding personal data controlled or processed solely for the purpose of completing a payment transaction"
• Derive over 25 percent of gross revenue from the sale of personal data and process or control personal data of 25,000 consumers or more

Both thresholds count consumers, and section 325M.11(g) defines a consumer narrowly: "a natural person who is a Minnesota resident acting only in an individual or household context," not one "acting in a commercial or employment context." There is no revenue floor of the kind Tennessee and some other states use. The sale definition in paragraph (u) covers an exchange "for monetary or other valuable consideration" and lists six exclusions, among them disclosures to processors and affiliates, transfers in a merger or bankruptcy, and exchanges between a producer and its authorized agents to provision goods and services jointly.

Subdivision 1(b) addresses education technology vendors: a controller or processor "acting as a technology provider under section 13.32" must comply with both that education data section and the Act, and where they conflict, section 13.32 prevails.

Exemptions, Including the Small Business Carve-Out

Subdivision 2 lists 21 exclusions. Some remove whole entities from the Act; others remove only certain data or activities, which leaves the entity covered for everything else. The entity-level exclusions are:

• A government entity as defined in section 13.02, subdivision 7a, and a federally recognized Indian tribe
• A state or federally chartered bank or credit union, or an affiliate or subsidiary principally engaged in financial activities
• An insurance company, insurance producer or third-party administrator of self-insurance, with an exception for a person that runs a self-insurance program without otherwise selling insurance
• A nonprofit organization established to detect and prevent insurance fraud (the only nonprofit named; the list contains no general nonprofit exclusion)
• A small business as defined by the U.S. Small Business Administration under 13 C.F.R. part 121, subject to section 325M.17
• An air carrier, but only for price, route and service data and only to the extent the Airline Deregulation Act preempts the Act

The data-level exclusions follow the federal sectoral map: HIPAA protected health information and Minnesota health records, Part 2 substance use records, human subjects research data, FCRA-regulated consumer report activity, GLBA data handled in compliance with that law, Driver's Privacy Protection Act data, FERPA records, Farm Credit Act data, data covered by the Minnesota Insurance Fair Information Reporting Act, and employment-context data about applicants, employees, owners, directors, officers, medical staff and contractors. Paragraph (b) deems a controller that complies with COPPA compliant with any parental consent obligation in the Act.

The small business exclusion is not complete. Section 325M.17 provides that an SBA-defined small business that conducts business in Minnesota or targets its residents "must not sell a consumer's sensitive data without the consumer's prior consent," and that the penalties and enforcement procedures in section 325M.20 apply to it for that section. The Act does not restate the federal size standards; it adopts the SBA definition by reference to 13 C.F.R. part 121, so the same statute that excludes a business from most of its duties also defines the one duty that business keeps.

Consumer Rights Under Chapter 325M

Section 325M.14, subdivision 1, lists the rights a controller must honor, subject to the Act's exceptions:

• (b) Confirm whether the controller is processing the consumer's personal data and access the categories of personal data being processed
• (c) Correct inaccurate personal data
• (d) Delete personal data concerning the consumer
• (e) Obtain data the consumer previously provided in a portable, readily usable format where processing is automated
• (f) Opt out of processing for targeted advertising, sale, or profiling in furtherance of automated decisions with legal or similarly significant effects
• (g) Question the result of significant-effect profiling, learn the reason for the decision and review the data used; this right is examined in a separate post on the profiling provision
• (h) Obtain a list of the specific third parties to which the controller has disclosed the consumer's personal data, or, if the controller does not keep that information per consumer, a list of the specific third parties to which it has disclosed any consumer's data

Subdivision 2 lets a parent or legal guardian act for a known child, and a guardian or conservator act for a person under guardianship. A consumer may designate an authorized agent for advertising and sale opt-outs, including by "a technology, including but not limited to an Internet link or a browser setting, browser extension, or global device setting." Subdivision 3 requires controllers to honor opt-out preference signals for targeted advertising and sales, and states that using an IP address to estimate location "is sufficient to determine the consumer's residence." A controller that recognizes signals approved under other state laws is in compliance with that subdivision.

Subdivision 4 sets the response mechanics. The opt-out in paragraph (f) must be completed "as soon as feasibly possible, but no later than 45 days" after receipt. For other requests, the controller must report the action taken within 45 days, extendable once by 45 days with notice and reasons. Information is free up to twice a year; for manifestly unfounded or excessive requests the controller may charge a reasonable fee or refuse, and it bears the burden of showing that character. A controller need not authenticate an opt-out request but may deny one it has "a good faith, reasonable, and documented belief" is fraudulent, and must say so and give its basis.

Paragraph (i) bars a controller from disclosing six categories in a response (Social Security numbers, government ID numbers, financial account numbers, health insurance or medical ID numbers, account passwords and security answers, and biometric data), requiring it instead to state "with sufficient particularity" that it collected that type of information. Paragraph (k) gives a controller holding data obtained from someone other than the consumer two ways to satisfy a deletion request: keep a minimal suppression record, or opt the consumer out of all non-exempt processing.

Subdivision 5 requires an internal appeal process that is "conspicuously available." The controller must answer an appeal within 45 days, extendable by 60, with a written explanation and "information about how to file a complaint with the Office of the Attorney General." It must keep records of all appeals and responses for at least 24 months and compile them for the Attorney General on written request during an investigation.

The Data Inventory and Documented Policies

Two provisions require Minnesota controllers to keep paperwork that most comparable statutes do not name. Section 325M.16, subdivision 2(c), ties the security duty to an inventory: a controller must maintain reasonable administrative, technical and physical security practices, "including the maintenance of an inventory of the data that must be managed to exercise these responsibilities."

Section 325M.18(a) then requires every controller to "document and maintain a description of the policies and procedures the controller has adopted to comply with" the Act. Where applicable, the description must name the chief privacy officer or other person with primary responsibility and describe policies designed to build the Act's requirements into system design, identify and provide personal data to consumers, maintain security and the data inventory, limit collection, prevent over-retention, and "identify and remediate violations." The Attorney General's business guide groups these under "Retention of Records for Oversight."

Section 325M.16 sets the surrounding controller duties. The privacy notice must list categories of data, purposes, rights and appeals, categories sold or shared and the recipients' categories, contact details, retention policies and the date of last update. It must be offered in each language in which the controller provides the relevant product or service, be accessible to people with disabilities, and be linked from the home page or app store page with a hyperlink using the word "privacy." A controller that sells data, runs targeted advertising or profiles for significant decisions must provide an opt-out method outside the notice, which may be a link labeled "Your Opt-Out Rights" or "Your Privacy Rights." Material changes trigger notice to affected consumers and a chance to withdraw consent.

On use of data, subdivision 2 limits collection to what is "adequate, relevant, and reasonably necessary," requires consent for sensitive data and for targeted advertising or sale where the controller knows the consumer is between 13 and 16, and requires that a consent revocation mechanism be at least as easy as the one used to give consent, with processing to stop within 15 days of revocation. Subdivision 3 prohibits processing that unlawfully discriminates in housing, employment, credit, education or public accommodations, and retaliation against consumers who exercise their rights, while allowing bona fide loyalty programs.

Data Protection Assessments

Section 325M.18(b) requires a controller to "conduct and document a data privacy and protection assessment" for five processing activities: targeted advertising, sale of personal data, processing of sensitive data, "any processing activities involving personal data that present a heightened risk of harm to consumers," and profiling that presents a reasonably foreseeable risk of unfair or deceptive treatment or disparate impact, financial, physical or reputational injury, an offensive intrusion on seclusion, or other substantial injury.

The assessment must weigh benefits to the controller, consumer, other stakeholders and the public against risks to the consumer as mitigated by available safeguards, and must factor in deidentified data, consumers' reasonable expectations, context and the relationship with the consumer. Paragraph (e) adds a Minnesota-specific element: each assessment "must include the description of policies and procedures required by paragraph (a)." One assessment may cover comparable processing operations, and assessments done for other laws qualify if they have "a similar scope and effect."

Paragraph (f) gives the Attorney General access. As part of a civil investigative demand, the office may request in writing any assessment relevant to an investigation, and the controller must produce it. Assessments are classified as nonpublic data under section 13.02, subdivision 9, and disclosure to the Attorney General does not waive attorney-client privilege or work product protection. Processors must supply controllers with the information needed to conduct assessments under section 325M.13(b)(2), which also obliges them to assist with breach notification under the state's breach statute, discussed in a separate post on section 325E.61.

Attorney General Enforcement and the Cure Period

Section 325M.20 makes the Attorney General the only enforcer. Paragraph (b) authorizes civil actions "in accordance with section 8.31," and lets the state recover "the reasonable value of all or part of the state's litigation expenses" when it prevails. Paragraph (c) makes a violating controller or processor "subject to an injunction and liable for a civil penalty of not more than $7,500 for each violation." Paragraph (d) closes the door that section 8.31 would otherwise open: nothing in the Act establishes a private right of action, "including under section 8.31, subdivision 3a," for a violation of the Act "or any other law." Section 325M.21 preempts local ordinances on processing personal data by controllers or processors.

Paragraph (a) required the Attorney General, before suing, to send a warning letter identifying the provisions allegedly violated and to wait 30 days for a cure. The paragraph ends with its own sunset: "This paragraph expires January 31, 2026." The office's enforcement page states that after that date it "is under no obligation to provide any warning letter to a potential violator before initiating an enforcement action."

In a February 5, 2026 update, the office described what it did during the warning period. It reported sending "hundreds of education letters," receiving more than 200 complaints in six months (many about attempts to exercise the right to delete), and sending "dozens of warning letters to companies that identified problems with privacy policies, procedures for honoring consumer data rights, consent mechanisms for collecting sensitive data, and responses to universal opt-out signals." It characterized company responses as "generally" productive, resulting in "quick corrections." The office maintains template request forms and a complaint portal at privacymn.com, which redirects to its Data Privacy pages.

No lawsuit, assurance of discontinuance or settlement under sections 325M.10 to 325M.21 was located on the Attorney General's site or in searches for this post, so the enforcement record under the Act itself stands at zero filed actions as of October 19, 2026. The office's own guide pages carry a disclaimer that they are "not intended to provide guidance as to how the AGO would enforce the Act."

One development outside the statute bears on its future. On June 3, 2026, the Attorney General announced that Minnesota had joined 15 other attorneys general, the California Privacy Protection Agency and Hawaii's consumer affairs department in a letter opposing the proposed federal SECURE Data Act, which the office states "would preempt Minnesota's stronger data privacy protections." How the Act compares with the other state statutes is set out in the state privacy law comparison.

Frequently Asked Questions