Comprehensive state privacy law
Minnesota privacy law
Minnesota Consumer Data Privacy Act
Law as of October 28, 2026 Reviewed by Sergio Maldonado Elvira on 29 October 2026
- Citation
- Minn. Stat. §§ 325M.10 to 325M.21
- Official text
- https://www.revisor.mn.gov/statutes/cite/325M.10
- Enacted
- May 24, 2024. Laws 2024, chapter 121, article 5, sections 1 to 14, signed by the Governor 24 May 2024
- In force
- July 31, 2025
- Effective dates
- July 31, 2025: whole Act (Laws 2024, ch. 121, art. 5, sec. 14), including the universal opt-out duty
- July 31, 2029: postsecondary institutions regulated by the Office of Higher Education must comply from this date
- Enforcer
- Attorney General (civil action under Minn. Stat. § 8.31)
- Private right of action
- No. The Act creates no private right of action, including under the private attorney general provision in § 8.31, subd. 3a (§ 325M.20(d)).
- Cure period
- 30 days. Ended January 31, 2026. The Attorney General had to send a warning letter and wait 30 days for a cure before suing. That paragraph expired on 31 January 2026, so no cure period applies now. (§ 325M.20(a))
- Rulemaking
- No. The Act grants no rulemaking power.
Amendments
No amendments recorded.
Topics
- ApplicabilityThe Act applies to legal entities that do business in Minnesota or target its residents and that, in a calendar year, control or process personal data of at least 100,000 consumers (not counting payment-only data), or that earn over 25% of gross revenue from selling personal data and handle data of at least 25,000 consumers. Small businesses as defined by the U.S. Small Business Administration are excluded, except that they may not sell sensitive data without consent. GLBA-regulated data is exempt at data level, while banks, credit unions and insurers are excluded as entities; nonprofits are covered, except insurance-fraud prevention bodies. Postsecondary institutions regulated by the Office of Higher Education have until 31 July 2029.
- Consumer rightsConsumers may confirm processing and access the categories of their data, correct, delete, obtain a portable copy, opt out of targeted advertising, sale and significant-effect profiling, and get a list of the specific third parties that received their data. Minnesota adds a right to question the result of significant-effect profiling, to be told the reasons and how a different result could be achieved, to review the data used, and to have the decision re-evaluated if the data was wrong. Controllers must answer within 45 days (one 45-day extension) and act on opt-outs within 45 days; appeals are decided within 45 days, extendable by 60.
- Sensitive dataSensitive data covers racial or ethnic origin, religious beliefs, mental or physical health condition or diagnosis, sexual orientation, citizenship or immigration status, biometric or genetic data used to identify a person, data of a known child (under 13), and specific geolocation. Controllers need consent to process sensitive data, and parental consent under COPPA for a known child. For consumers the controller knows to be 13 to 16, targeted advertising and sale require consent. Small businesses outside the Act's main scope still need prior consent to sell sensitive data.
- Controller dutiesControllers must publish a privacy notice that also states retention policies and the date of the last update, provide an opt-out link outside the notice, and notify consumers of material changes. They must limit collection to what is adequate, relevant and reasonably necessary, delete data no longer needed, and keep reasonable security, including an inventory of the data they manage. They must document their privacy policies and procedures (naming a chief privacy officer or responsible person) and conduct data privacy and protection assessments for high-risk processing. Since 31 July 2025 they must honour universal opt-out signals for targeted advertising and sale.
- ProcessorsProcessors must follow controller instructions and help with rights requests, security, breach notification and assessments. A binding contract must set out instructions, nature and purpose, data types, duration and both parties' rights and obligations, and require confidentiality, subcontracting only after a chance to object, deletion or return, compliance information and assessments (or an annual independent assessment). A processor that decides purposes and means becomes a controller.
- EnforcementThe Attorney General enforces the Act through civil actions under § 8.31 and may recover litigation expenses. The 30-day warning-letter cure period expired on 31 January 2026. Violations carry an injunction and a civil penalty of up to $7,500 per violation. There is no private right of action.
Sources
Law as of October 28, 2026.
Reviewed by Sergio Maldonado Elvira on 29 October 2026. Prepared from the official sources listed.
Official text of the Minnesota statute
Reference material, not legal advice.