Minnesota's new consumer data privacy law: What it means for you

Minnesota Consumer Privacy Data Act goes into law

A new data privacy law goes into effect on July 31, 2025, giving Minnesotans more control over how their information is collected and used by companies. FOX 9's Se Kwon has more details on the Minnesota Consumer Privacy Data Act.

ST. PAUL, Minn. (FOX 9) - A new data privacy law goes into effect on Thursday, giving Minnesotans more control over how their information is used by companies.

Minnesota Consumer Data Privacy Act 

The backstory:

The Minnesota Consumer Data Privacy Act (MCDPA), going into effect on July 31, 2025, creates stronger privacy and digital protections for Minnesotans, including better control over how their data is collected and used by companies.

"All of us are constantly creating data about ourselves, often without even realizing it," said Minnesota Attorney General Keith Ellison in a statement. "Each data point may not seem like much on its own, but when all that data comes together, it can become a significant invasion of our privacy and potentially even a threat to our safety. This is especially true when that data is bought and sold to virtually anyone who will pay."

"For years, this loss of privacy has felt inevitable, but it does not have to be. Our state’s new Consumer Data Privacy Act gives Minnesotans greater freedom to control their data," Ellison added.

Protecting your data

Dig deeper:

Under the law, consumers have new rights concerning their data. The MCDPA helps govern the personal data of Minnesota residents, such as your name, email, login credentials and browsing history. The law also provides enhanced protections for "sensitive data," which encompasses personal data like race, ethnicity, religion, sexual orientation, and specific location information.

To help Minnesotans understand their rights, the state Attorney General’s Office introduced an easy-to-remember acronym, Locked+. 

Here’s what that means for consumers:

• List: You can request a list of third parties to whom your data was sold.
• Opt-Out: You can decline to have a business sell your data or use it for profiling and targeted advertising.
• Copy: You have the right to obtain a copy of the personal data that a business has about you.
• Know: You have the right to know what information a business has collected about you.
• Edit: You have the right to edit, or make corrections, to the data that a business has collected about you.
• Delete: You have the right to delete personal information that has been collected.
• Plus: you have the right to question profiling and automated decisions that affect you.

The new law also imposes strict requirements on businesses to enhance consumer data protection. 

However, it only applies to the following types of businesses:

• A business that controls or processes the personal data of 100,000 or more Minnesota residents.
• Earns over 25% of their revenue from the sale of personal data and processes or controls the personal data of 25,000 consumers or more.
• Certain education technology providers are also subject to the new law.

What you can do:

If a consumer submits a request to a company regarding their personal data, the company must respond within 45 days. If they fail to meet this deadline, consumers can then file a complaint with the Minnesota Attorney General’s Office. 

To find out more information about these rights and how to exercise them, visit the Minnesota Attorney General’s Office website here.