Starting today, July 31, 2025, the Minnesota Consumer Data Privacy Act (“MCDPA”) officially takes effect. Signed by Governor Tim Walz in May 2024, this act majorly affects how the personal data of Minnesota residents is handled.

The MCDPA applies to entities doing business in Minnesota or targeting Minnesota residents if those entities:

• Control or process personal data of 100,000 or more consumers in a calendar year (excluding personal data controlled or processed solely to complete a payment transaction);
• Derive over 25% of gross revenue from the sale of personal data and process or control personal data of 25,000 or more consumers.

Under the MCDPA, controllers are obligated to provide consumers with a clear and accessible privacy notice. This notice must detail the categories of personal data being processed and the specific purposes for that processing, indicate any categories of personal data sold or shared with third parties, identify those third parties, explain how consumers can exercise their privacy rights, provide the controller’s contact information (where the consumer can directly contact the controller), and description of the controller’s personal data retention policy. Controllers are restricted to collecting personal data that is “adequate, relevant, and reasonably necessary” for its intended processing.

The MCDPA requires controllers to establish and maintain administrative, technical, and physical data security practices to ensure the “confidentiality, integrity, and accessibility” of personal data. This includes the responsibility of maintaining a detailed inventory of the data under management and the appointment of a chief privacy officer or others in charge of compliance with the law.

For consumers, the MCDPA gives them the rights to access, correct, delete, and obtain copies of their personal data, and to opt out of data sales and targeted advertising. Consumers gain the right to demand a list of specific third parties their data has been shared with, and to question the outcome of profiling decisions, including being informed of how they may receive a different result in the future. The law also mandates an “opt-in” consent for processing sensitive data. It includes non-discrimination provisions. Consumers have 45 days to receive a response to requests, with a right to appeal if denied.

Enforcement of the MCDPA falls to the Minnesota Attorney General, not through a private right of action for consumers. Before an action, controllers receive a warning letter and 30 days to cure alleged violations. Uncured violations can result in civil penalties of up to $7,500 per violation. It’s unclear whether this is for every consumer affected or whether it is just for those with the data. This “right to cure” provision will expire on January 31, 2026.

With the MCDPA in full swing, we will continue to monitor the trend that most states are taking towards stricter consumer privacy laws.

Link to full text of the MCDPA HERE.