Blog

Minnesota joins US privacy landscape with Consumer Data Privacy Act

The MCDPA becomes the sixth US privacy law to be passed in 2024 and follows a familiar framework found under similar privacy laws

Keshawna Campbell
Privacy Research Manager, OneTrust Center of Excellence
May 30, 2024

Who does the MCDPA apply to?
Key requirements
Next steps

On May 24, 2024, the Minnesota Consumer Data Privacy Act (MCDPA) was signed into law by the state’s Governor. Minnesota becomes the sixth state to pass comprehensive privacy legislation in 2024 and the 19th overall. The MCDPA sticks to a similar set of requirements found under most US state privacy laws such as risk assessments, privacy notices, and a familiar set of consumer rights. However, in some instances the MCDPA sets out more prescriptive rules and also requires organizations to describe and document their data privacy policies. Read on to learn more about the MCDPA and its requirements.

Who does the MCDPA apply to?

The MCDPA will apply to organizations that conduct business in Minnesota or produce products or services that are targeted to residents of Minnesota. These organizations must also meet at least one of the following thresholds during a calendar year:

Control or process the personal data of more than 100,000 consumers excluding personal data controlled or processed solely for the purpose of completing a payment transaction

Derive over 25% of their gross revenue from the sale of personal data and process or control personal data of 25,000 or more consumers

Key requirements

Consumer rights

The MCDPA outlines a set of consumer rights, similar to those found under many US state privacy laws. These include:

The right to confirm processing of personal data
The right to access personal data
The right to correct inaccuracies
The right to delete personal data
The right to data portability
The right to opt out of:
- targeted advertising
- the sale of personal data
- profiling
The right to obtain a list of the third parties that personal data has been shared with

Consumers will also have the right to review the personal data used in profiling, question the result of the profiling, be informed of the reason that the profiling resulted in the decision, to be informed of what actions might have been taken to secure a different decision, and the actions to secure a different decision in the future.

Organizations must respond to consumer rights requests “as soon as feasibly possible” and within 45 days. In certain instances, there is the possibility for an additional 45-day extension.

Valid consent under the MCDPA

The MCDPA defines consent as “any freely given, specific, informed, and unambiguous indication of the consumer's wishes by which the consumer signifies agreement to the processing of personal data relating to the consumer.”

In a similar fashion to other US state privacy laws, accepting general or broad terms, hovering over, muting, pausing, or closing content does not constitute valid consent. Additionally, consent is not considered valid if it has been obtained by using dark patterns.

Regarding sensitive data, organizations must operate on an opt-in basis and cannot process sensitive data without first obtaining valid consent from the consumer.

Privacy notices

As with most privacy laws, organizations are required to provide consumers with a “reasonably accessible, clear, and meaningful privacy notice.” However, privacy notices under the MCDPA have stricter requirements than similar provisions found across US privacy laws. At a minimum a privacy notice under the MCDPA should include the following information:

The categories of personal data being processed
The purposes for processing
An explanation of consumer rights
How and where consumers may exercise those rights
How a consumer can appeal a controller's decision relating to a consumer rights request
The categories of personal data shared with or sold to third parties
The categories of third parties that personal data is sold to or shared with
Contact information, including an active email address, for the organization
A description of retention policies for personal data
The date the privacy notice was last updated

Organizations that sell personal data to third parties, process personal data for targeted advertising, or engage in profiling must disclose this within its privacy notice. Furthermore, organizations must also provide “a clear and conspicuous method” for opting out of these processing activities such as a hyperlink labeled "Your Opt-Out Rights" or "Your Privacy Rights."

Data privacy policies

One unique feature of the MCDPA is the requirement for organizations to and maintain a description of the policies and procedures it has adopted to comply with the law. This description must include:

Name and contact information of the chief privacy officer or an individual who is responsible noncompliance with the law
A description of the organization’s data privacy policies and procedures
A description of any policies and procedures designed to:
- reflect the requirements of the MCDPA in the design of the organization’s systems
- identify and provide personal data to a consumer as required
- establish, implement, and maintain reasonable administrative, technical, and physical data security practices to protect the confidentiality, integrity, and accessibility of personal data, including the maintenance of a data inventory
- limit the collection of personal data to what is adequate, relevant, and reasonably necessary
- prevent the retention of personal data that is no longer relevant and reasonably necessary
- identify and remediate violations of the MCDPA

Data privacy and protection assessments

The MCDPA includes a requirement for organizations to conduct data privacy and protection assessment. Assessments are required for each of the following processing activities:

Targeted advertising
The sale of personal data
Profiling
Processing sensitive data
Processing activities that present a heightened risk of harm

The MCDPA also outlines that assessments conducted in compliance with other, similar laws will satisfy thse requirements so long as the processing activity is similar in scope. Additionally, a single assessment may address multiple sets of comparable processing operations.

Enforcement and penalties

The MCDPA will be enforced by the Attorney General, that will be able to grant a 30-day cure period for organizations that are found to be in violation of the law. The cure period clause will expire on January 31, 2026. Penalties for non-compliance will range up to $7,500 per violation and the MCDPA contains no private right of action.

Next steps

The MCDPA will become effective on July 31, 2025 giving organizations over 12 months to prepare. Organizations covered by the law should pay close attention to the information presented to consumers within their privacy notices as this is more nuanced under the MCDPA. Organizations will also need to prepare for a range of new consumer rights being afforded to individuals as well as risk assessment requirements and other contractual provisions between controllers and processors.

Request a demo to learn more about how OneTrust can help with your US privacy compliance efforts.

Blog

Minnesota joins US privacy landscape with Consumer Data Privacy Act

Table of contents

Who does the MCDPA apply to?

Key requirements

Consumer rights

Valid consent under the MCDPA

Privacy notices

Data privacy policies

Data privacy and protection assessments

Enforcement and penalties

Next steps

You may also like

Privacy Management

2024 to 2025: Preparing for the next wave of privacy regulations

Prepare for 2025's privacy changes with this recap webinar on 2024's regulations and explore upcoming laws, trends, and compliance strategies.

January 23, 2025

Privacy Management

Staying equipped for compliance: A global recap of emerging privacy laws

November 20, 2024

Consent & Preferences

Mastering US opt-out requirements: A practical guide for marketers

Discover how to manage US opt-out requirements and enhance your marketing efforts with this guide. Download now to simplify compliance and build trust.

October 22, 2024

Privacy Automation

Global regulatory update: Recent privacy developments and compliance trends

Join us for a webinar on the latest updates and emerging trends in global privacy regulations.

September 12, 2024

Privacy Management

Preparing for child data protection laws in the US

Join DataGuidance and a panel of experts as we discuss US privacy laws the protection of minors' data.

August 07, 2024

Privacy Management

The road to 50 states: Rhode Island joins the US privacy landscape with a new law

Rhode Island has become the 20th US State to pass a privacy law. On June 25, 2024, the Governor of Rhode Island transmitted the Data Transparency and Privacy Protection Act (RIDTPPA) without signature allowing the Act to become law. Join the webinar to learn more.

July 16, 2024

Privacy Management

Preparing for the future of privacy in healthcare: Going beyond HIPAA compliance

Join us for a discussion on preparing your organization for healthcare privacy compliance that goes beyond HIPAA.

July 11, 2024

Privacy Management

The road to 50 states: Minnesota and Vermont join the US privacy landscape

In this webinar, OneTrust DataGuidance and expert contributors unpack the MCPA and VDPA, examining the requirements, exceptions, and practical implications of the legislations on the data controllers and processors.

June 17, 2024

Privacy Management

From legislation to operation: How to prepare for the new wave of US Privacy laws

Prepare your organization for the new wave of US privacy laws.

June 06, 2024

Third-Party Risk

TPRM privacy compliance: Questions to ask when working with third parties

Download this checklist to learn what questions to ask when designing a third-party risk management program that enables privacy compliance.

May 31, 2024

Comparing US state privacy law requirements

Download our infographic and compare the many US state privacy law requirements that have been enacted or will soon come into effect.

May 14, 2024

Privacy Management

Federal US privacy bill on the horizon? Exploring the draft APRA & new state privacy legislation

Join OneTrust DataGuidance and expert contributors for an overview of the Kentucky Consumer Privacy Act (KCPA), Maryland's Senate Bill 0541, and the draft American Privacy Rights Act and explore how a federal bill could shape the US privacy landscape.

April 23, 2024

Privacy Management

US state privacy laws timeline

View our timeline to understand the progression of current US state privacy laws and key dates.

April 23, 2024

Privacy Management

Spring into action! Navigating CPRA: Ensuring compliance and protecting privacy

Join us for an interactive webinar we dive into the CPRA, which will go into force on March 29th.

March 21, 2024

Privacy Management

The road to 50 states: New Jersey and New Hampshire join the US privacy landscape

oin OneTrust DataGuidance for a webinar highlighting the key requirements within the new US laws, New Jersey Senate Bill 332 and New Hampshire Senate Bill 255.

February 01, 2024

Privacy Automation

Embedding Privacy by Design through PIA Automation

Join us for a webinar on Embedding Privacy by Design through PIA Automation.

January 11, 2024

Privacy Management

Automating fulfillment of subject rights requests in the US

Learn how Privacy Rights Automation helps to fully automate privacy rights requests.

December 06, 2023

Privacy Management