Minnesota Consumer Data Privacy Act (MCDPA)
In force Minnesota · In force Jul 31, 2025 · next deadline Jul 31, 2029 (in 2.9 years)
Deadlines
Summaries for reference, not legal advice. Check the official text.
What it does
Comprehensive privacy law with distinctive rights to question the result of profiling decisions and to obtain a list of specific third parties that received the consumer's data. Requires data inventories, documented privacy policies and procedures, and data protection assessments.
- Who it applies to
- Legal entities doing business in Minnesota or targeting residents that during a calendar year control or process personal data of 100,000+ consumers (excluding payment-only data), or derive over 25% of gross revenue from the sale of personal data and process personal data of 25,000+ consumers. Small businesses as defined by the SBA are exempt except they may not sell sensitive data without consent.
- Penalties
- Civil penalty up to $7,500 per violation plus injunction and litigation expenses. 30-day warning-letter cure period expired Jan 31, 2026.
- Enforced by
- Minnesota Attorney General
- Official name
- Minnesota Consumer Data Privacy Act (HF 4757, 2024 Minn. Laws ch. 121, art. 5), Minn. Stat. 325M.10-325M.21
- Citation
- 2024 Minn. Laws ch. 121, art. 5; Minn. Stat. 325M.10-325M.21
- Topics
- privacy
Verified 2026-09-22 revisor.mn.gov
Research notes
SBA small-business exemption summarized from the act's structure; not re-verified line by line. No 2025-2026 amendments confirmed.
Related
Alabama Personal Data Protection Act (APDPA)
CCPA / CPRA
Colorado AI Act
Connecticut Data Privacy Act (CTDPA)
Delaware Personal Data Privacy Act (DPDPA)Questions about Minnesota Consumer Data Privacy Act (MCDPA)
- What are the Minnesota Consumer Data Privacy Act (MCDPA) compliance deadlines?
- Jul 31, 2025: MCDPA takes effect. Jan 31, 2026: 30-day cure period expires. Jul 31, 2029: Postsecondary institutions must comply.
- When does Minnesota Consumer Data Privacy Act (MCDPA) take effect?
- Minnesota Consumer Data Privacy Act (MCDPA) took effect on Jul 31, 2025. The next milestone is Jul 31, 2029: Postsecondary institutions must comply.
- Who does Minnesota Consumer Data Privacy Act (MCDPA) apply to?
- Legal entities doing business in Minnesota or targeting residents that during a calendar year control or process personal data of 100,000+ consumers (excluding payment-only data), or derive over 25% of gross revenue from the sale of personal data and process personal data of 25,000+ consumers. Small businesses as defined by the SBA are exempt except they may not sell sensitive data without consent.
- What are the penalties under Minnesota Consumer Data Privacy Act (MCDPA)?
- Civil penalty up to $7,500 per violation plus injunction and litigation expenses. 30-day warning-letter cure period expired Jan 31, 2026.