Minnesota Consumer Data Privacy Act

Minnesota Consumer Data Privacy Act (MCDPA)
Minnesota · 2024 Minn. Laws ch. 123 (HF 4757); Minn. Stat. §§ 325M.01–.21

Status
In effect
Took effect
July 31, 2025
Applies to
Controllers at 100,000-consumer or 25,000/50%-revenue thresholds
Enforced by
Minnesota Attorney General

Minnesota's privacy law gives residents data rights plus something unique: the right to question automated profiling decisions with significant effects — including the right to know why the decision was made and what would change the outcome. Full AG enforcement began February 2026.

Who is protected: Minnesota residents

Legal detail

MCDPA (HF 4757), Minn. Stat. §§ 325M.01–.21, eff. July 31, 2025; unique profiling-decision-questioning right (§ 325M.14); data protection assessments; AG-enforced up to $7,500/violation; cure period expired Jan. 31, 2026.

Key facts

JurisdictionMinnesota
LevelState
StrengthLimited
EnactedMay 24, 2024
Citation2024 Minn. Laws ch. 123 (HF 4757); Minn. Stat. §§ 325M.01–.21
Private right of actionNo, agency enforcement only
PenaltiesUp to $7,500 per violation plus investigation costs
Topicsconsumer data privacy · data retention · automated decision-making · consumer protection
StatuteMinn. Stat. § 325M.14 — Consumer Personal Data Rights

More AI rules in Minnesota

Related consumer data privacy rules elsewhere

See something wrong or out of date? Submit a correction. Every entry must carry a verifiable source.