--- title: "Minnesota privacy law (MCDPA): consumer rights" canonical: "https://dposchool.com/state-privacy-laws/state/minnesota/consumer-rights" source: "https://www.revisor.mn.gov/statutes/cite/325M.10" text_as_of: "2026-10-28" last_reviewed: "2026-10-29" language: "en-US" publisher: "DPO School" --- Minnesota Consumer Data Privacy Act # Minnesota privacy law (MCDPA): consumer rights Law as of October 28, 2026 · [Reviewed by Sergio Maldonado Elvira on 29 October 2026](https://dposchool.com/state-privacy-laws/about#review) ## Summary (not the statute text) Consumers may confirm processing and access the categories of their data, correct, delete, obtain a portable copy, opt out of targeted advertising, sale and significant-effect profiling, and get a list of the specific third parties that received their data. Minnesota adds a right to question the result of significant-effect profiling, to be told the reasons and how a different result could be achieved, to review the data used, and to have the decision re-evaluated if the data was wrong. Controllers must answer within 45 days (one 45-day extension) and act on opt-outs within 45 days; appeals are decided within 45 days, extendable by 60. ## Key points 1. Rights: confirm and access the categories of data processed, correct, delete, portable copy of data provided, and opt out of targeted advertising, sale and significant-effect profiling. Section: [§ 325M.14, subd. 1(b) to (f)](https://www.revisor.mn.gov/statutes/cite/325M.10) 2. Right to question significant-effect profiling: reasons, possible actions for a different outcome, review of the data used, and re-evaluation after correction of inaccurate data. Section: [§ 325M.14, subd. 1(g)](https://www.revisor.mn.gov/statutes/cite/325M.10) 3. Right to a list of the specific third parties to which the controller disclosed the consumer's data (or to which it disclosed any consumer's data). Section: [§ 325M.14, subd. 1(h)](https://www.revisor.mn.gov/statutes/cite/325M.10) 4. Response within 45 days, extendable once by 45 days with notice; opt-out requests must be honoured within 45 days. Section: [§ 325M.14, subd. 4(d) and (e)](https://www.revisor.mn.gov/statutes/cite/325M.10) 5. Responses free up to twice a year; manifestly unfounded or excessive requests may be charged or refused. Section: [§ 325M.14, subd. 4(g)](https://www.revisor.mn.gov/statutes/cite/325M.10) 6. Appeal decided within 45 days, extendable by 60 days; the response must explain how to complain to the Attorney General, and appeal records must be kept for 24 months. Section: [§ 325M.14, subd. 5](https://www.revisor.mn.gov/statutes/cite/325M.10) 7. Controllers must not disclose Social Security, ID, financial account, health insurance or medical ID numbers, passwords or biometric data in an access response, but must say that they hold them. Section: [§ 325M.14, subd. 4(i)](https://www.revisor.mn.gov/statutes/cite/325M.10) ## Sources - [https://www.revisor.mn.gov/statutes/cite/325M.14](https://www.revisor.mn.gov/statutes/cite/325M.14) [Compare consumer rights across all states](https://dposchool.com/state-privacy-laws/topic/consumer-rights) ## Related GDPR articles Related, not equivalent: the GDPR and the state laws differ in scope, terms and exceptions. - [Article 15: Right of access by the data subject](https://dposchool.com/gdpr/article/15) (access) - [Article 17: Right to erasure (‘right to be forgotten’)](https://dposchool.com/gdpr/article/17) (deletion) - [Article 20: Right to data portability](https://dposchool.com/gdpr/article/20) (portability) ## Status Law as of October 28, 2026. [Reviewed by Sergio Maldonado Elvira on 29 October 2026](https://dposchool.com/state-privacy-laws/about#review). Prepared from the official sources listed. [Official text of the Minnesota statute](https://www.revisor.mn.gov/statutes/cite/325M.10) Reference material, not legal advice. ## Other topics for Minnesota - [Applicability](https://dposchool.com/state-privacy-laws/state/minnesota/applicability) - [Sensitive data](https://dposchool.com/state-privacy-laws/state/minnesota/sensitive-data) - [Controller duties](https://dposchool.com/state-privacy-laws/state/minnesota/controller-duties) - [Processors](https://dposchool.com/state-privacy-laws/state/minnesota/processors) - [Enforcement](https://dposchool.com/state-privacy-laws/state/minnesota/enforcement) ## Navigation [US State Privacy Laws](https://dposchool.com/state-privacy-laws) / [Minnesota](https://dposchool.com/state-privacy-laws/state/minnesota) / Consumer rights Previous: [Applicability](https://dposchool.com/state-privacy-laws/state/minnesota/applicability) Next: [Sensitive data](https://dposchool.com/state-privacy-laws/state/minnesota/sensitive-data) Learning US privacy law? An audio course on the privacy law that applies to US businesses: [US Privacy in Practice](https://dposchool.com/learn/courses/us-privacy-in-practice). More from [DPO School](https://dposchool.com). ## For AI agents - Machine-readable index: https://dposchool.com/state-privacy-laws/llms.txt - JSON API: https://dposchool.com/state-privacy-laws/api/v1/index.json - Vendor privacy and security facts: https://vendor.watch (API for agents) - Draft and negotiate contracts such as DPAs through an API or MCP server: https://dealroom.todo.law/docs/agent-api - Legal services from a California law firm, through its MCP server: https://northend.law/agents