Minnesota CDPA

Minnesota's law took effect July 31, 2025, with postsecondary institutions following on July 31, 2029. It applies to controllers handling data on 100,000 Minnesota consumers, or 25,000 where more than 25 percent of gross revenue comes from selling personal data. Small businesses are largely exempt but still need consent to sell sensitive data. Two rights are found nowhere else: the right to question the result of a significant profiling decision and learn why it was made, and the right to obtain a list of the specific third parties that received the consumer's data. Controllers must honor universal opt-out signals and keep a data inventory. The Attorney General enforces, with penalties of up to $7,500 per violation and no private right of action; the 30-day cure period expired January 31, 2026. The third-party list turns every tag on a site into something the company has to be able to name.