Minnesota has a comprehensive consumer privacy statute, the Minnesota Consumer Data Privacy Act (MCDPA). This page collects our coverage touching Minnesota, alongside the federal rules that apply there. For the statute itself rather than the news, see our Minnesota privacy law page.
State Comprehensive Privacy Laws
October 19, 2026
Minnesota's Consumer Data Privacy Act, Minn. Stat. 325M.10 to 325M.21, has applied since July 31, 2025 to entities that control or process data on 100,000 Minnesotans, or 25,000 with a sale-revenue test. It adds a third-party list right and a written policy inventory to the familiar model, and since January 31, 2026 the Attorney General may sue without a warning letter.
Read more →
Breach Notification
October 19, 2026
Minnesota's private-sector breach statute, Minn. Stat. 325E.61, has changed little since 2006. It requires notice to residents whose unencrypted personal information was or is reasonably believed acquired, without a risk-of-harm exception or a day count, adds a 48-hour credit bureau notice above 500 persons, and leaves government entities to a separate statute with its own rules.
Read more →
Automated Decision-Making
October 19, 2026
Paragraph (g) of Minn. Stat. 325M.14, subdivision 1, gives a consumer profiled for a significant decision the right to question the result, be told the reason, learn (if feasible) what might have changed it, review the data used and obtain reevaluation on corrected data. Colorado, Tennessee and California treat the same ground differently, and the statute does not define most of its terms.
Read more →