Minnesota MCDPA
Minnesota Consumer Data Privacy Act (Minn. Stat. 325M.10 to 325M.21)
Minnesota's consumer privacy law took effect on 31 July 2025 (31 July 2029 for certain postsecondary institutions). It goes further than most state laws on profiling, giving consumers the right to question a profiling result, learn the reasons and have the decision re-evaluated, and it requires controllers to keep a data inventory.
Who it applies to
Persons doing business in Minnesota or targeting its residents that control or process the personal data of 100,000 or more consumers (excluding payment-only data), or 25,000 or more consumers while deriving more than 25 percent of gross revenue from selling personal data. Small businesses are exempt except from the ban on selling sensitive data without consent.
Identity requirements
- Obtain consent before processing sensitive data, including biometric and genetic data, and stop processing within 15 days of consent being withdrawn
- Obtain parental consent for known children under 13 and consent for targeted advertising or sale involving consumers aged 13 to 16
- Let consumers question profiling decisions, be told the reasons, review the data used and have the decision re-evaluated
- Maintain an inventory of personal data as part of documented security policies
- Conduct and document data privacy and protection assessments
How it impacts identity systems
| Identity area | Impact |
|---|---|
| Customer identity & consent (CIAM) | Consent and withdrawal handling has a fixed 15-day deadline to stop processing. |
| Identity governance (IGA) | The data inventory requirement maps directly to knowing which systems hold consumer identity data. |
| Audit, logging & accountability | Profiling decisions must be explainable and reviewable on request. |
Penalties
The Attorney General may seek civil penalties of up to 7,500 dollars per violation and injunctive relief. The 30-day cure provision expired on 31 January 2026.
Status and dates last verified against primary sources on 2026-10-31.
Minnesota MCDPA: frequently asked questions
- When did Minnesota's privacy law take effect?
- It took effect on 31 July 2025, with certain postsecondary institutions given until 31 July 2029.
- What profiling rights does Minnesota add?
- Consumers can question the result of profiling that produces significant effects, learn the reasons, review the personal data used and have inaccurate data corrected and the decision re-evaluated.