Minnesota’s Consumer Data Privacy Act: An Overview
Twenty-nine years after Prince warned us about the dangers of the Internet, his home state has taken action to protect consumers who use it. [1] On July 31, 2025, Minnesota joined the roughly twenty states that have adopted comprehensive privacy statutes. The new law, the Minnesota Consumer Data Privacy Act (MCDPA), grants the state’s residents new rights and requires businesses to honor them. This article gives a high-level summary of the new landscape. To Whom Does the Minnesota Consumer Data Privacy Act Apply? The MCDPA does not apply to every company doing business in Minnesota, and it also applies to many that have no operations in the state at all. The law applies if a company does business in Minnesota and meets one of two other tests. It applies where a company controls or processes personal data of 100,000 or more Minnesota consumers in a given year (with some exceptions). It also applies if a company controls or processes the personal data of 25,000 or more Minnesota co...