Minnesota Consumer Data Privacy Act (MCDPA) Reference Guide

The MCDPA covers legal entities doing business in Minnesota or targeting residents when they control or process at least 100,000 consumers’ data in a calendar year, excluding data used solely to complete payment transactions. The alternative is 25,000 consumers plus more than 25% of gross revenue from personal-data sales. Minn. Stat. § 325M.12: scope

The statute lists extensive entity, activity and data exclusions. A qualifying small business is generally excluded from the full act but still may not sell a consumer’s sensitive data without prior consent. Minn. Stat. § 325M.12: exclusions Minn. Stat. § 325M.17: small businesses

The statute excludes personal data controlled or processed solely to complete a payment transaction from the 100,000-consumer calculation. Counsel should determine whether a specific dataset fits that condition.

Residents may confirm and access processing, correct, delete and obtain portable data, and opt out of targeted advertising, sale and qualifying profiling. They may also obtain a list of specific third parties receiving personal data and receive explanation, review and correction rights for certain consequential profiling decisions. Minn. Stat. § 325M.14: consumer rights

Controllers generally respond within 45 days, with one justified 45-day extension. Appeals receive a response within 45 days, with a possible 60-day extension. Minn. Stat. § 325M.14: requests and appeals

Minnesota defines sale as an exchange for monetary or other valuable consideration, subject to exclusions. Targeted advertising concerns ads selected using activity over time and across nonaffiliated sites or apps, while first-party, contextual, requested and measurement-only advertising are excluded. Minn. Stat. § 325M.11: definitions

Inventory each client-side and server-side destination, the data sent, the recipient and the purpose. Test whether the actual direct opt-out and a qualifying preference signal produce the expected change.

A controller must allow consumers to opt out of targeted advertising and personal-data sale through a qualifying opt-out preference signal sent with the consumer’s consent. The mechanism must require an affirmative choice and meet the statute’s neutrality and consistency conditions. Minn. Stat. § 325M.14, subd. 3

Test consent rejection and GPC in separate browser sessions, then compare the results. The result should be compared with the site’s direct opt-out route, because the two mechanisms can fail at different points.

The Minnesota Attorney General may enforce the MCDPA and seek an injunction and civil penalties up to $7,500 per violation. The statute creates no private right of action. Its mandatory warning letter and 30-day cure paragraph expired January 31, 2026, so it should not be described as a current cure right. Minn. Stat. § 325M.20

Counsel determines coverage, exemptions, sale, targeted-advertising, profiling and sensitive-data treatment. Product and engineering teams implement those decisions across consent tools, hard-coded scripts, tag managers, APIs and downstream platforms.

Use separate browser sessions to compare the site’s initial behavior, its response to a direct opt-out, and its response to Global Privacy Control where relevant to your review. Record the page URL, test time, browser settings and exact choice made so the result can be reproduced.

Inspect cookies and network requests before and after each choice. Record which requests continue, their destinations and the controls involved. Browser evidence can help diagnose an implementation; it cannot establish statutory applicability, the legal purpose of every transfer or organization-wide compliance.

Qualified privacy counsel should address applicability, exemptions, classifications, profiling, third-party disclosures, notices, contracts, requests, assessments, sensitive data and governance.

This guide relies on the current Minnesota Statutes published by the Revisor of Statutes and the Minnesota Attorney General’s effective-date announcement. The expired cure provision is described by its current temporal status.

Prepared by Etalon Editorial Team. Last reviewed September 27, 2026. Material corrections may be sent to contact@etalondata.com.

Etalon is not a law firm and does not provide legal advice. A passing scan or certificate does not guarantee that an organization satisfies every legal obligation.

Technical testing records observable website behavior. Your legal and privacy team remains responsible for coverage, exemptions, classifications, notices, requests, sensitive data, contracts, assessments and governance.