Minnesota Consumer Data Privacy Act (HF 2309)
Enacted privacy legislation establishing comprehensive framework for data protection. Applies to entities conducting business in Minnesota or producing products/services targeted to residents. Requires data protection assessments for high-risk processing activities and establishes consumer rights including access, deletion, correction, and portability. Includes specific provisions regulating automated decision-making systems and profiling activities. Enforcement through attorney general with maximum penalties of $7,500 per violation.
| Jurisdiction | Minnesota |
|---|---|
| Category | Privacy & Data Protection |
| Status | Active |
| Effective date | |
| Latest development |
Analysis
Key Requirements
- Controllers must provide a clear and meaningful online privacy notice detailing categories of personal data processed, processing purposes, consumer rights and exercise methods, third-party disclosures, data retention policies, and a contact mechanism; notices must use a "privacy" hyperlink on the homepage and notify consumers of material changes with opt-out opportunities Minnesota AG Data Privacy page White & Case analysis Felhaber Larson guide.
- Businesses must honor core consumer rights including access, deletion, correction, portability, and confirmation of data processing, with responses required within 45 days (extendable with notice) and free up to twice yearly MN Revisor's Office statute 325M.14 White & Case analysis Transcend blog.
- Data protection assessments are mandatory for high-risk activities such as targeted advertising, data sales, profiling with significant effects, or sensitive data processing; assessments from similar laws may suffice White & Case analysis Frost Brown Todd overview Felhaber Larson guide.
- Controllers and processors must enter binding contracts requiring confidentiality, data deletion/return, subcontractor approvals, and compliance assistance White & Case analysis Transcend blog Frost Brown Todd overview.
- Support universal opt-out mechanisms (UOOM) like Global Privacy Control for sales, targeted advertising, and profiling, with clear notice and opt-out methods White & Case analysis Transcend blog MN House bill text.
- Obtain consent for sensitive data processing (e.g., precise geolocation, health data) and limit collection to data minimization standards Frost Brown Todd overview Felhaber Larson guide Verrill Law overview.
Compliance Challenges
- Determining applicability thresholds (100,000 consumers or 25% revenue from data sales for 25,000 consumers) is complex for multi-state operations, especially with narrow nonprofit exemptions Felhaber Larson guide Transcend blog IRM expert commentary.
- Conducting and maintaining data protection assessments for high-risk activities burdens smaller entities without prior experience, as AG review is possible White & Case analysis Frost Brown Todd overview Verrill Law overview.
- Integrating UOOM and opt-out signals like GPC challenges legacy ad tech stacks, leading to incomplete compliance Transcend blog White & Case analysis.
- Maintaining data inventories and security practices proportionate to data volume, including unique documentation of policies and chief privacy officer details, strains resource-limited firms Frost Brown Todd overview Felhaber Larson guide IRM expert commentary.
Implementation Best Practices
- Conduct a data inventory audit to map personal data flows, categories, and purposes, ensuring minimization and security practices Frost Brown Todd overview Felhaber Larson guide Transcend implementation steps.
- Update privacy notices and deploy opt-out tools with "Your Privacy Rights" links supporting GPC/UOOM White & Case analysis MN AG Data Privacy page.
- Automate consumer rights request handling using tools like Transcend DSR for 45-day responses Transcend blog Felhaber Larson guide.
- Perform DPIAs for high-risk processing and document compliance policies with a designated privacy officer White & Case analysis MN Revisor's Office statute.
- Secure processor contracts with confidentiality and audit rights Frost Brown Todd overview Transcend blog.
Recent Updates
- 30-day cure period expires January 31, 2026, ending pre-enforcement remediation opportunities White & Case analysis Felhaber Larson guide MN AG Data Privacy page.
- Postsecondary institutions gain compliance extension to July 31, 2029 Felhaber Larson guide MN House bill text.
- Law effective July 31, 2025, with full enforcement post-cure expiration White & Case analysis Verrill Law overview MN AG Data Privacy page.
Related Regulations
- Overlaps with other state privacy laws (e.g., California CCPA, Colorado CPA) in consumer rights and DPIAs; Minnesota accepts equivalent assessments and shares UOOM requirements White & Case analysis Transcend blog.
- Interacts with federal laws like COPPA for child data consent in sensitive processing Frost Brown Todd overview MN House bill text.
- Small business exemptions align with SBA definitions, but sensitive data sales require consent regardless White & Case analysis Felhaber Larson guide.
Industry Impact
- Broad applicability to tech/advertising due to targeted ad and profiling rules, potentially increasing opt-outs and assessments White & Case analysis Transcend blog.
- Challenges nonprofits and small entities with limited exemptions, unlike broader waivers elsewhere Transcend blog IRM expert commentary.
- $7,500 per violation penalties via AG enforcement heighten risks for non-compliant firms post-2026 Felhaber Larson guide Frost Brown Todd overview.
Sources
- Minnesota AG Data Privacy page
- White & Case: Minnesota Enacts Comprehensive Consumer Data Privacy Law
- Felhaber Larson: Minnesota's New Consumer Data Privacy Act
- Transcend: Minnesota Consumer Data Privacy Act
- Frost Brown Todd: Minnesota Consumer Data Privacy Act
- MN House Bill Text
- MN Revisor's Office: Statute 325M.14
- IRM: Minnesota Consumer Data Privacy Act Application
- Verrill Law: Minnesota's Consumer Data Privacy Act Overview
Recent developments
- — Minnesota enacted a comprehensive state privacy law, the Minnesota Consumer Privacy Act (H.F. 4757), making it the 19th state with such a law; the statute provides broad consumer data rights and business obligations and will take effect on 2025-07-31.[4] (source)
- — The new Minnesota Consumer Privacy Act is enforceable solely by the Attorney General with civil penalties up to $7,500 per violation, includes a 30‑day cure period for businesses, and introduces detailed rights around profiling and access to third‑party disclosure lists; the cure period expires 2026-01-31.[4] (source)
- — The Minnesota Attorney General announced that the Minnesota Consumer Data Privacy Act (MCDPA) would take effect on 2025-07-31, emphasizing new consumer rights to access, correct, delete, and opt out of sale, targeted advertising, and profiling of their personal data.[6] (source)
- — The AG’s communication highlighted new obligations for covered businesses under the MCDPA, including data minimization, retention limits, security and assessment requirements, consent for sensitive data, and special protections and parental consent requirements for children under 16.[6] (source)
- — Privacy practitioners reported that the Minnesota Consumer Data Privacy Act bill HF 2309 continued to advance in the Legislature, clearing the House Judiciary Committee on 2024-03-05 and scheduling a hearing in the House State Government Committee for fiscal note consideration.[2] (source)
- — Digital Policy Alert noted the formal introduction of the Minnesota Consumer Data Privacy Act (HF 2309), describing its applicability thresholds, enumerated consumer rights (access, correction, deletion, opt-out of sale/targeted advertising/profiling), and requirements for data protection assessments and opt-out mechanisms.[7] (source)
Related regulations
- UK Data Protection Act 2018 — United Kingdom, Active
- Texas Data Privacy and Security Act (TDPSA) — Texas, Active, effective 2024-07-01
- General Data Protection Law (LGPD) — Brazil, Active, effective 2020-09-18
- COPPA (Children's Online Privacy Protection Act) — United States, Active
- Oregon Consumer Privacy Act (OCPA) — Oregon, Active, effective 2024-07-01
- Montana Consumer Data Privacy Act (MCDPA) — Montana, Active, effective 2024-10-01
- New Hampshire Privacy Act (NHPA) — New Hampshire, Active, effective 2025-01-01
- Nebraska Data Privacy Act (NDPA) — Nebraska, Active, effective 2025-01-01
Put it into practice
- Generate the policy: Minnesota CDPA policy generator (generatepolicy.com)
- Buy the policy pack: State Privacy Law Checklist (cyberpolicy.shop)
- Build it yourself: 2026 US Privacy Program Workbook (ciso.diy)
Browse all regulations · Compliance deadlines · Latest updates