Laws
Minnesota Consumer Data Privacy Act (MCDPA): your rights and how to use them
Quick answer
If you live in Minnesota, the Minnesota Consumer Data Privacy Act lets you ask a covered business to show you, correct or delete the personal data it holds about you, to stop selling it or using it for targeted ads, and to name the specific companies it shared your data with. Send your request through one of the methods the business offers: it has 45 days to answer, and it's free up to twice a year. If the company refuses, appeal to it first, then complain to the Minnesota Attorney General.
All privacy laws“A consumer has the right to delete personal data concerning the consumer.”
- Applies in
- Minnesota
- In force since
- Companies must answer within
- Opt-outs: as soon as feasibly possible and within 45 days. Other requests: within 45 days, extendable once by 45 more days if the business tells you why. Appeals: a decision within 45 days, extendable by 60 more days with notice. Free up to twice a year (Minn. Stat. § 325M.14, subds. 4-5).
- Regulator
- Minnesota Attorney General's Office
- Last updated
Head of Product & Co-Founder
Reviewed by Ludwig Sandgren
Head of Legal
Serus is a privacy company with paid tools to find and remove your personal data. This page is free and based on official sources.
Sources checked: revisor.mn.gov, ag.state.mn.us
Last verified against the official page:
Minnesota residents. The law applies to businesses that operate in Minnesota or target Minnesotans and that, in a calendar year, handle personal data of 100,000 or more consumers (not counting data used only to complete a payment), or of 25,000 or more consumers while earning over 25% of gross revenue from selling personal data. Government entities, federally recognized Indian tribes, banks and credit unions, insurance companies and small businesses as the U.S. Small Business Administration defines them are exempt, but most nonprofits are covered. Data covered by HIPAA, the Fair Credit Reporting Act, GLBA, FERPA and the Driver's Privacy Protection Act is exempt.
Your rights
-
Confirm and access
Ask a business whether it processes your personal data, and see the categories of personal data it processes (Minn. Stat. § 325M.14, subd. 1(b)).
-
Correct
Have inaccurate data fixed (Minn. Stat. § 325M.14, subd. 1(c)).
-
Delete
Have a business delete personal data about you. If it got your data from a third party, it may instead keep a minimal record so the data stays deleted, or opt you out of processing for any purpose the law doesn't exempt (Minn. Stat. § 325M.14, subd. 1(d), subd. 4(k)).
-
Get a portable copy
Where the processing is automated, get the data you gave the business in a portable, readily usable format (Minn. Stat. § 325M.14, subd. 1(e)).
-
Opt out
Stop the business using your data for targeted advertising, selling it, or profiling you for automated decisions with legal or similarly significant effects (Minn. Stat. § 325M.14, subd. 1(f)).
-
Question a profiling decision
If profiling led to a decision with legal or similarly significant effects on you, question the result, hear the reason, learn what you could have done differently, review the data used, and have wrong data corrected and the decision looked at again (Minn. Stat. § 325M.14, subd. 1(g)).
-
See who got your data
Get a list of the specific third parties the business disclosed your data to. If it doesn't keep that per person, it lists the third parties it disclosed any consumer's data to (Minn. Stat. § 325M.14, subd. 1(h)).
-
Use an agent or a browser setting
Name an authorized agent, including a browser setting, browser extension or global device setting, to opt out for you. Businesses must honor opt-out preference signals (Minn. Stat. § 325M.14, subd. 2(d), subd. 3).
-
Appeal
Appeal a refusal. The business must answer within 45 days, or up to 60 days more with notice, and tell you how to complain to the Attorney General (Minn. Stat. § 325M.14, subd. 5).
General information, not legal advice.
How to use it
- 1
Use one of the business's request methods
Covered businesses must offer secure and reliable ways to send a request. A business can't make you create a new account to use your rights, though it can ask you to use an account you already have.
- 2
Say which rights you want to use
Name them plainly: access, correction, deletion, a copy, an opt-out, or the list of third parties. A line like "Under the Minnesota Consumer Data Privacy Act, please delete the personal data you hold about me and send me the list of third parties you disclosed it to" is enough to start.
- 3
Turn on an opt-out preference signal
Minnesota businesses must treat an opt-out preference signal, such as Global Privacy Control, as an opt-out of targeted advertising and sales. Switch it on in your browser and it goes out to every site you visit. The signal can't be switched on by default: you have to choose it.
- 4
Wait up to 45 days
The business must act within 45 days, or 90 if it tells you it needs more time and why. Opt-outs have to be honored within 45 days. If it refuses, it must explain why within 45 days and tell you how to appeal.
- 5
Appeal if the business refuses
Use the business's appeal process. It must decide within 45 days, or up to 105 days in total if it tells you it needs an extension, and tell you how to complain to the Attorney General.
- 6
Complain to the Minnesota Attorney General
If a business ignores or denies your request, take it to the Minnesota Attorney General's Office, which enforces the law. Its data privacy complaint page is the place to start. You can't sue a business under this law yourself.
No answer in time? Complain to Minnesota Attorney General's Office .
Who has to follow the MCDPA
The law covers businesses that operate in Minnesota or target Minnesota residents and that handle personal data of 100,000 or more consumers in a calendar year. Data used only to complete a payment doesn't count toward that number. A smaller business is covered too if it handles data of 25,000 or more consumers and earns over 25% of its gross revenue from selling personal data.
Most nonprofits are covered. Postsecondary institutions regulated by the Office of Higher Education get until July 31, 2029.
Two rights worth knowing about
The first is the list of third parties. You can ask for the specific companies your data was disclosed to, by name, not just categories like "advertising partners". That's useful when you're trying to work out which data brokers got your details.
The second is the right to question a profiling decision. If an automated profile led to a decision with legal or similarly significant effects on you, you can ask why, see the data used, get mistakes corrected and have the decision looked at again.
The cure period is over
Until January 31, 2026, the Attorney General had to send a business a warning letter and give it 30 days to fix a violation before acting. That requirement has expired. The Attorney General can now go straight to enforcement, with civil penalties of up to $7,500 per violation.
Why a company can say no
Some organizations and some data sit outside the law. Government entities, federally recognized Indian tribes, state or federally chartered banks and credit unions, insurance companies and small businesses are exempt. Data covered by federal laws is exempt too, including HIPAA (health), the Fair Credit Reporting Act (credit reports), GLBA (banking) when processed in line with it, FERPA (school records) and the Driver's Privacy Protection Act. Employment data is also outside it.
So if a company tells you your data falls under the FCRA or GLBA, that's the likely reason it's declining. You can still appeal, and complain to the Attorney General if you think the refusal is wrong. Our guide on what to do when a company won't delete your account covers the next steps.
Where Serus fits
The MCDPA works one company at a time, and you first have to know which companies hold your data. Serus finds the data brokers that operate where you live, sends the deletion and opt-out requests for you, and checks whether your data shows up again. The steps above are free if you'd rather do them yourself.
Data brokers that list people in United States
Each guide shows how to opt out of that site, step by step.
- Remove yourself from CourtRecords.us
- Remove yourself from TruePeopleSearch
- Remove yourself from Spokeo
- Remove yourself from LexisNexis
- Remove yourself from TruthFinder
- Remove yourself from FastPeopleSearch
- Remove yourself from BeenVerified
- Remove yourself from Intelius
Let Serus send the requests for you
Serus finds the data brokers that list you where you live and removes you from them.
Related
Frequently asked
When did the Minnesota privacy law take effect?
July 31, 2025. Postsecondary institutions regulated by the Office of Higher Education have until July 31, 2029.
Can I sue under the MCDPA?
No. The law creates no private right of action. The Attorney General enforces it and can seek injunctions and civil penalties of up to $7,500 per violation.
Is there still a cure period?
No. The rule that the Attorney General had to send a warning letter and give a business 30 days to fix a violation expired on January 31, 2026.
Will a business send me my Social Security number if I ask for my data?
No. In an access response it must not disclose your Social Security number, ID numbers, financial account numbers, health insurance or medical ID numbers, passwords, security answers or biometric data. It has to tell you it collected them, though.
Are small businesses covered?
Small businesses as the U.S. Small Business Administration defines them are excluded, but they still may not sell your sensitive data without your prior consent.
Sources
Something wrong or out of date? Tell us and we'll re-check it.