Key Facts
Overview
Minnesota's MCDPA introduces several firsts among US state privacy laws: mandatory Chief Privacy Officer designation, required data inventory maintenance, and the right to challenge profiling decisions. The expanded sensitive data definition includes SSN, government IDs, financial and insurance accounts, and passwords.
What This Means for Your Website
- You must designate a Chief Privacy Officer (or equivalent), the first US state to require this
- A documented data inventory must be maintained, the first US state to require this
- GPC/UOOM signals must be honored
- Consumers have a unique right to question profiling decisions
- Opt-in consent is required for sensitive data (expanded definition)
- The 30-day cure period sunsets January 1, 2026
Key Requirements
The Minnesota AG enforces the MCDPA with penalties up to $7,500 per violation. Consumer requests must be fulfilled within 45 days. The CPO and data inventory requirements are organizational obligations that go beyond typical US state privacy laws. The right to question profiling decisions creates a unique challenge mechanism for consumers.
How ConsentStack Handles This
ConsentStack detects Minnesota visitors, honors GPC signals, applies opt-in for the expanded sensitive data categories, and supports the consent record-keeping that complements organizational CPO and inventory requirements.
Penalties
Up to $7,500 per violation.
Key Requirements
- Designate a Chief Privacy Officer, the first US state to require this
- Maintain documented data inventory, the first US state to require this
- Honor GPC/universal opt-out signals
- Opt-in consent for sensitive data
- Right to question profiling decisions, unique
- Data protection assessments for profiling with legal effects
Notable Provisions
- First US state requiring Chief Privacy Officer
- First requiring data inventory maintenance
- Right to question profiling decisions, unique
- Expanded sensitive data definition (SSN, government IDs, financial accounts, passwords)
- Cure period sunsets January 2026
Data Subject Rights
Confirm whether a controller is processing your personal data and access the categories of personal data the controller is processing.
Correct inaccurate personal data about you, taking into account the nature of the data and the purposes of the processing.
Have a controller delete personal data concerning you.
Obtain personal data you previously provided to the controller in a portable and, where technically feasible, readily usable format you can transmit to another controller, where the processing is carried out by automated means.
Opt out of the processing of your personal data for targeted advertising, including through an opt-out preference signal the controller must honor.
Opt out of the sale of your personal data, including through an opt-out preference signal the controller must honor.
Opt out of profiling in furtherance of automated decisions that produce legal or similarly significant effects concerning you.
If your personal data is profiled in furtherance of a decision with legal or similarly significant effects, question the result, learn the reason and, if feasible, what you could do differently, review the data used, and have inaccurate data corrected and the decision reevaluated.
Obtain a list of the specific third parties to which the controller has disclosed your personal data, or, if it does not keep that per consumer, of the specific third parties it has disclosed any consumer's data to.
Designate an authorized agent, including through an Internet link, browser setting, browser extension or global device setting, to opt out of targeted advertising and sale on your behalf; this agent right covers those opt-outs only.
Appeal a controller's refusal to act on your request through an internal appeal process that must be conspicuously available and as easy to use as the request process.
When a controller decides your appeal, it must tell you clearly and prominently how to file a complaint with the Minnesota Attorney General's Office.
Revoke consent you previously gave, for example to the processing of sensitive data, through a mechanism at least as easy as the one used to give it, after which the controller must stop processing that data.
A controller may not discriminate against you for exercising your rights, including by denying goods or services, charging different prices or rates, or providing a different level of quality, except through a bona fide loyalty or rewards program.
US State Specifics
Other North America Regulations
Frequently Asked Questions
Minnesota MCDPA requires you to recognize an opt-out preference signal such as Global Privacy Control. Check whether GPC is working on your site to confirm the signal reaches you and that trackers actually stop firing when it does.
Stay compliant with Minnesota MCDPA
ConsentStack helps you implement Opt-out consent for Minnesota, United States automatically.