---
title: "Minnesota privacy law (MCDPA): sensitive data"
canonical: "https://dposchool.com/state-privacy-laws/state/minnesota/sensitive-data"
source: "https://www.revisor.mn.gov/statutes/cite/325M.10"
text_as_of: "2026-10-28"
last_reviewed: "2026-10-29"
language: "en-US"
publisher: "DPO School"
---

Minnesota Consumer Data Privacy Act

# Minnesota privacy law (MCDPA): sensitive data

Law as of October 28, 2026 · [Reviewed by Sergio Maldonado Elvira on 29 October 2026](https://dposchool.com/state-privacy-laws/about#review)

## Summary (not the statute text)

Sensitive data covers racial or ethnic origin, religious beliefs, mental or physical health condition or diagnosis, sexual orientation, citizenship or immigration status, biometric or genetic data used to identify a person, data of a known child (under 13), and specific geolocation. Controllers need consent to process sensitive data, and parental consent under COPPA for a known child. For consumers the controller knows to be 13 to 16, targeted advertising and sale require consent. Small businesses outside the Act's main scope still need prior consent to sell sensitive data.

## Key points

1. Sensitive data: race or ethnicity, religion, mental or physical health condition or diagnosis, sexual orientation, citizenship or immigration status, biometric or genetic identifiers, known child data and specific geolocation.

   Section: [§ 325M.11(v)](https://www.revisor.mn.gov/statutes/cite/325M.10)

2. Specific geolocation means coordinates accurate to more than three decimal degrees, or a street address derived from them.

   Section: [§ 325M.11(w)](https://www.revisor.mn.gov/statutes/cite/325M.10)

3. Consent required to process sensitive data; for a known child, parental consent in line with COPPA.

   Section: [§ 325M.16, subd. 2(d)](https://www.revisor.mn.gov/statutes/cite/325M.10)

4. Consent required for targeted advertising or sale where the controller knows the consumer is between 13 and 16.

   Section: [§ 325M.16, subd. 2(f)](https://www.revisor.mn.gov/statutes/cite/325M.10)

5. Consent must be revocable as easily as given; processing must stop within 15 days.

   Section: [§ 325M.16, subd. 2(e)](https://www.revisor.mn.gov/statutes/cite/325M.10)

6. Small businesses may not sell sensitive data without prior consent.

   Section: [§ 325M.17](https://www.revisor.mn.gov/statutes/cite/325M.10)

## Sources

- [https://www.revisor.mn.gov/statutes/cite/325M.11](https://www.revisor.mn.gov/statutes/cite/325M.11)
- [https://www.revisor.mn.gov/statutes/cite/325M.16](https://www.revisor.mn.gov/statutes/cite/325M.16)

[Compare sensitive data across all states](https://dposchool.com/state-privacy-laws/topic/sensitive-data)

## Related GDPR articles

Related, not equivalent: the GDPR and the state laws differ in scope, terms and exceptions.

- [Article 9: Processing of special categories of personal data](https://dposchool.com/gdpr/article/9) (sensitive data)

## Status

Law as of October 28, 2026.

[Reviewed by Sergio Maldonado Elvira on 29 October 2026](https://dposchool.com/state-privacy-laws/about#review). Prepared from the official sources listed.

[Official text of the Minnesota statute](https://www.revisor.mn.gov/statutes/cite/325M.10)

Reference material, not legal advice.

## Other topics for Minnesota

- [Applicability](https://dposchool.com/state-privacy-laws/state/minnesota/applicability)
- [Consumer rights](https://dposchool.com/state-privacy-laws/state/minnesota/consumer-rights)
- [Controller duties](https://dposchool.com/state-privacy-laws/state/minnesota/controller-duties)
- [Processors](https://dposchool.com/state-privacy-laws/state/minnesota/processors)
- [Enforcement](https://dposchool.com/state-privacy-laws/state/minnesota/enforcement)

## Navigation

[US State Privacy Laws](https://dposchool.com/state-privacy-laws) / [Minnesota](https://dposchool.com/state-privacy-laws/state/minnesota) / Sensitive data

Previous: [Consumer rights](https://dposchool.com/state-privacy-laws/state/minnesota/consumer-rights)

Next: [Controller duties](https://dposchool.com/state-privacy-laws/state/minnesota/controller-duties)

Learning US privacy law? An audio course on the privacy law that applies to US businesses: [US Privacy in Practice](https://dposchool.com/learn/courses/us-privacy-in-practice). More from [DPO School](https://dposchool.com).

## For AI agents

- Machine-readable index: https://dposchool.com/state-privacy-laws/llms.txt
- JSON API: https://dposchool.com/state-privacy-laws/api/v1/index.json
- Vendor privacy and security facts: https://vendor.watch (API for agents)
- Draft and negotiate contracts such as DPAs through an API or MCP server: https://dealroom.todo.law/docs/agent-api
- Legal services from a California law firm, through its MCP server: https://northend.law/agents