DPO SchoolDPO School

Minnesota Consumer Data Privacy Act

Minnesota privacy law (MCDPA): controller duties

Law as of October 28, 2026 Reviewed by Sergio Maldonado Elvira on 29 October 2026

Summary (not the statute text)

Controllers must publish a privacy notice that also states retention policies and the date of the last update, provide an opt-out link outside the notice, and notify consumers of material changes. They must limit collection to what is adequate, relevant and reasonably necessary, delete data no longer needed, and keep reasonable security, including an inventory of the data they manage. They must document their privacy policies and procedures (naming a chief privacy officer or responsible person) and conduct data privacy and protection assessments for high-risk processing. Since 31 July 2025 they must honour universal opt-out signals for targeted advertising and sale.

Key points

  1. Privacy notice: data categories and purposes, rights and appeals, data and third parties sold to or shared with, contact details, retention policies, and the date last updated; posted through a 'privacy' link.

    Section: § 325M.16, subd. 1(a) and (g)

  2. A clear opt-out method outside the privacy notice is required where the controller sells data, targets ads or profiles for significant decisions.

    Section: § 325M.16, subd. 1(b)

  3. Collection limited to what is adequate, relevant and reasonably necessary; no retention once data is no longer relevant and reasonably necessary.

    Section: § 325M.16, subd. 2(a) and (g)

  4. Reasonable security practices, including maintaining an inventory of the data.

    Section: § 325M.16, subd. 2(c)

  5. Universal opt-out signals for targeted advertising and sale must be honoured; an IP address is enough to estimate residence.

    Section: § 325M.14, subd. 3

  6. Written description of privacy policies and procedures, naming a chief privacy officer or other responsible person.

    Section: § 325M.18(a)

  7. Data privacy and protection assessments for targeted advertising, sale, sensitive data, risky profiling and other heightened-risk processing.

    Section: § 325M.18(b)

Sources

Compare controller duties across all states

Related GDPR articles

Related, not equivalent: the GDPR and the state laws differ in scope, terms and exceptions.

Law as of October 28, 2026.

Reviewed by Sergio Maldonado Elvira on 29 October 2026. Prepared from the official sources listed.

Official text of the Minnesota statute

Reference material, not legal advice.