DPO SchoolDPO School

Minnesota Consumer Data Privacy Act

Minnesota privacy law (MCDPA): consumer rights

Law as of October 28, 2026 Reviewed by Sergio Maldonado Elvira on 29 October 2026

Summary (not the statute text)

Consumers may confirm processing and access the categories of their data, correct, delete, obtain a portable copy, opt out of targeted advertising, sale and significant-effect profiling, and get a list of the specific third parties that received their data. Minnesota adds a right to question the result of significant-effect profiling, to be told the reasons and how a different result could be achieved, to review the data used, and to have the decision re-evaluated if the data was wrong. Controllers must answer within 45 days (one 45-day extension) and act on opt-outs within 45 days; appeals are decided within 45 days, extendable by 60.

Key points

  1. Rights: confirm and access the categories of data processed, correct, delete, portable copy of data provided, and opt out of targeted advertising, sale and significant-effect profiling.

    Section: § 325M.14, subd. 1(b) to (f)

  2. Right to question significant-effect profiling: reasons, possible actions for a different outcome, review of the data used, and re-evaluation after correction of inaccurate data.

    Section: § 325M.14, subd. 1(g)

  3. Right to a list of the specific third parties to which the controller disclosed the consumer's data (or to which it disclosed any consumer's data).

    Section: § 325M.14, subd. 1(h)

  4. Response within 45 days, extendable once by 45 days with notice; opt-out requests must be honoured within 45 days.

    Section: § 325M.14, subd. 4(d) and (e)

  5. Responses free up to twice a year; manifestly unfounded or excessive requests may be charged or refused.

    Section: § 325M.14, subd. 4(g)

  6. Appeal decided within 45 days, extendable by 60 days; the response must explain how to complain to the Attorney General, and appeal records must be kept for 24 months.

    Section: § 325M.14, subd. 5

  7. Controllers must not disclose Social Security, ID, financial account, health insurance or medical ID numbers, passwords or biometric data in an access response, but must say that they hold them.

    Section: § 325M.14, subd. 4(i)

Sources

Compare consumer rights across all states

Related GDPR articles

Related, not equivalent: the GDPR and the state laws differ in scope, terms and exceptions.

Law as of October 28, 2026.

Reviewed by Sergio Maldonado Elvira on 29 October 2026. Prepared from the official sources listed.

Official text of the Minnesota statute

Reference material, not legal advice.