Minnesota
For Minnesota, law name and abbreviation is Minnesota Consumer Data Privacy Act (MCDPA); effective date is July 31, 2025; consumer volume threshold is during a calendar year, controls or processes personal data of 100,000 consumers or more, excluding personal data controlled or processed solely for the purpose of completing a payment transaction; revenue-from-data-sales threshold is derives over 25 percent of gross revenue from the sale of personal data and processes or controls personal data of 25,000 consumers or more; threshold combination logic is OR — satisfies one or more of the following thresholds, recorded from its source on 2026-08-12.
- State
- Minnesota our reading
- Law name and abbreviation
- Minnesota Consumer Data Privacy Act (MCDPA)
- Effective date
- July 31, 2025 verified
- Consumer volume threshold
- during a calendar year, controls or processes personal data of 100,000 consumers or more, excluding personal data controlled or processed solely for the purpose of completing a payment transaction verified
- Revenue-from-data-sales threshold
- derives over 25 percent of gross revenue from the sale of personal data and processes or controls personal data of 25,000 consumers or more verified
- Threshold combination logic
- OR — satisfies one or more of the following thresholds verified
- Key exemptions
- State and local government entities; HIPAA-covered entities; GLBA-regulated financial institutions; nonprofit organizations; institutions of higher education (postsecondary institutions regulated by the Office of Higher Education not required to comply until July 31, 2029)
- Enforcement mechanism
- Attorney General; no private right of action
- Statute citation
- Minn. Stat. §§ 325M.10 to 325M.21
- Notes
- Minnesota uses a 25% revenue threshold (like Colorado and Oregon), lower than the 50% in Virginia-model states. Minnesota has stronger data minimization rules than most states. Postsecondary institutions regulated by the Office of Higher Education have a delayed compliance date of July 31, 2029. verified
Values marked our reading are our classification of what the source says — the source does not print them in those words. The quote below is the evidence for each one; judge it yourself.
What the source says
This section, as added by Laws 2024, chapter 121, article 5, section 3, is effective July 31, 2025, except that postsecondary institutions regulated by the Office of Higher Education are not required to comply until July 31, 2029. Laws 2024, chapter 121, article 5, section 14. 325M.12 SCOPE; EXCLUSIONS. § Subdivision 1. Scope. (a) Sections <https://www.revisor.mn.gov/statutes/cite/325M.10> 325M.10 to <https://www.revisor.mn.gov/statutes/cite/325M.21> 325M.21 apply to legal entities that conduct business in Minnesota or produce products or services that are targeted to residents of Minnesota, and that satisfy one or more of the following thresholds: (1) during a calendar year, controls or processes personal data of 100,000 consumers or more, excluding personal data controlled or processed solely for the purpose of completing a payment transaction; or (2) derives over 25 percent of gross revenue from the sale of personal data and processes or controls personal data of 25,000 consumers or more.
— revisor.mn.gov, retrieved 2026-08-12
Source
- revisor.mn.govhttps://www.revisor.mn.gov/statutes/cite/325M/full