Starting July 31, 2025, Minnesotans will gain new rights to control how businesses use their personal data, thanks to the Minnesota Consumer Data Privacy Act (MCDPA). This new law aims to give consumers more power over their digital information and limit how companies collect, sell, and share it.
What the Law Does
Under the MCDPA, Minnesota residents will now have the right to:
-
Access the personal data businesses collect about them
-
Edit or correct that data
-
Request that their data be deleted
-
Ask for a copy of their data
-
Opt out of targeted ads, the sale of their data, and automated profiling
This means that if a company has your personal information—such as your location, shopping habits, or browsing activity—you can now tell them to stop using or selling it.
Who Must Follow the Law?
The law applies to businesses that meet any of the following:
-
Collect or handle data from 100,000 or more Minnesota residents
-
Make at least 25% of their revenue from selling personal data
-
Manage personal data from 25,000 or more consumers
Companies will also need to get permission from a parent or guardian before collecting or selling data from users under 16 years old.
Push for Transparency
Attorney General Keith Ellison and Representative Steve Elkins, who authored the legislation, spoke about the law during a press conference on July 28 at the state Capitol.
“For years, we’ve come to believe our private data isn’t really private anymore,” Ellison said. “But starting July 31, companies in Minnesota must respect your privacy rights.”
Ellison noted that everyday actions—like using a smart watch, browsing the internet, or checking a weather app—can expose personal data. These apps and services often collect sensitive information without users realizing it.
Elkins pointed out that many types of businesses will be affected, from health and weather apps to large tech companies like Google, as well as data brokers—companies that collect and sell people’s information.
He highlighted how users are often the product when using free apps: “If you’re not paying for the product, you are the product.”
How This Protects Consumers
One major goal of the MCDPA is to stop businesses from using your data without your permission. Companies must now:
-
List any third parties they’ve sold your data to, if you ask
-
Respond to consumer data requests within 45 days
-
Include a clear way for consumers to make privacy requests, like an email or online form on their website
The law also gives consumers the right to challenge and fix decisions made automatically by systems using personal data, such as loan denials based on credit scores.
Additionally, it bans companies from trying to identify users based on anonymous data—a practice some businesses use to secretly rebuild your identity.
Real-World Impact
One example of how this law could make a difference involves websites that collect and share personal information. Recently, these kinds of websites were reportedly used by a suspect in the shootings of Minnesota lawmakers to find personal addresses. Elkins said all 201 state legislators have already started requesting removal of their data from such data broker websites.
The MCDPA makes Minnesota the 19th state in the U.S. to pass a consumer privacy law. However, Elkins says Minnesota’s version stands out by offering more protections, especially around automated decisions and anonymous data.
What You Can Do
If you want to take control of your data, you can:
-
Contact the company directly through the contact info listed in their privacy policy
-
Visit privacymn.com, the Minnesota Attorney General’s website, for guidance
-
File a complaint if you believe a business is violating your rights under the new law
This law is a step forward in giving people more say in how their data is used in the digital world—and making sure that privacy isn’t just a word, but a right.
