DPO SchoolDPO School

Minnesota Consumer Data Privacy Act

Minnesota privacy law (MCDPA): enforcement

Law as of October 28, 2026 Reviewed by Sergio Maldonado Elvira on 29 October 2026

Summary (not the statute text)

The Attorney General enforces the Act through civil actions under § 8.31 and may recover litigation expenses. The 30-day warning-letter cure period expired on 31 January 2026. Violations carry an injunction and a civil penalty of up to $7,500 per violation. There is no private right of action.

Key points

  1. The Attorney General may bring a civil action under § 8.31 and recover the reasonable value of litigation expenses.

    Section: § 325M.20(b)

  2. The 30-day warning letter and cure step expired on 31 January 2026.

    Section: § 325M.20(a)

  3. Injunction and civil penalty of up to $7,500 for each violation.

    Section: § 325M.20(c)

  4. No private right of action, including under § 8.31, subd. 3a.

    Section: § 325M.20(d)

  5. The Attorney General may obtain data privacy and protection assessments through a civil investigative demand.

    Section: § 325M.18(f)

Sources

Compare enforcement across all states

Related GDPR articles

Related, not equivalent: the GDPR and the state laws differ in scope, terms and exceptions.

Law as of October 28, 2026.

Reviewed by Sergio Maldonado Elvira on 29 October 2026. Prepared from the official sources listed.

Official text of the Minnesota statute

Reference material, not legal advice.