Minnesota Consumer Data Privacy Act (Laws 2024, chapter 121, article 5; Minn. Stat. 325M.10 to 325M.21): profiling opt-out and the right to question a profiling result

Summary

Minnesota's comprehensive consumer privacy law, enacted in the 2024 commerce omnibus (H.F. 4757, Laws 2024, chapter 121, article 5) and in force since July 31, 2025. Session law coded it as chapter 325O; the Revisor now publishes it as sections 325M.10 to 325M.21. It applies to entities doing business in Minnesota or targeting its residents that control or process the personal data of 100,000 or more consumers a year (excluding data processed only to complete a payment), or that earn over 25 percent of gross revenue from selling personal data and handle data of 25,000 or more consumers. Consumers may opt out of profiling in furtherance of automated decisions with legal or similarly significant effects. Beyond the opt-out found in other state laws, a consumer whose data was profiled in such a decision may question the result, be told the reason for it and, where feasible, what they could have done or could do to get a different decision, review the personal data used, and have inaccurate data corrected and the decision reevaluated. Controllers must document a data privacy and protection assessment for profiling that presents a reasonably foreseeable risk of unfair or deceptive treatment, disparate impact, or financial, physical or reputational injury. Data handled under the Gramm-Leach-Bliley Act in compliance with that law, and data covered by the Fair Credit Reporting Act, are excluded. The Attorney General enforces it; there is no private right of action.

Key dates

1. May 24, 2024Enacted
2. October 16, 2026Checked against sources
3. October 21, 2026Checked against sources

Developments are added when the record is reviewed. Next review: October 16, 2027.

Evidence

Each passage is quoted from its source. The quoted passages are re-checked against the live pages every month.

1. Sections 325M.10 to 325M.21 may be cited as the "Minnesota Consumer Data Privacy Act."

   Supports: Name and statutory location of the act

   is effective July 31, 2025, except that postsecondary institutions regulated by the Office of Higher Education are not required to comply until July 31, 2029.

   Supports: Effective dates

   Minn. Stat. 325M.10, Citation (2025 Minnesota Statutes) Minnesota Office of the Revisor of Statutes Primary source

2. Presented to the governor May 22, 2024 Signed by the governor May 24, 2024

   Supports: Signing date

   Laws of Minnesota 2024, chapter 121 (H.F. 4757) Minnesota Office of the Revisor of Statutes Primary source

3. A consumer has the right to opt out of the processing of personal data concerning the consumer for purposes of targeted advertising, the sale of personal data, or profiling in furtherance of automated decisions that produce legal effects

   Supports: Profiling opt-out

   the consumer has the right to question the result of the profiling, to be informed of the reason that the profiling resulted in the decision

   Supports: Right to question a profiling result and be told the reason

   the consumer has the right to have the data corrected and the profiling decision reevaluated based upon the corrected data

   Supports: Correction and reevaluation

   Minn. Stat. 325M.14, Consumer personal data rights Minnesota Office of the Revisor of Statutes Primary source

4. the processing of personal data for purposes of profiling, where the profiling presents a reasonably foreseeable risk of: (i) unfair or deceptive treatment of, or disparate impact on, consumers; (ii) financial, physical, or reputational injury to consumers

   Supports: Assessment duty for risky profiling

   Minn. Stat. 325M.18, Data privacy policies; data privacy and protection assessments Minnesota Office of the Revisor of Statutes Primary source

5. controls or processes personal data of 100,000 consumers or more, excluding personal data controlled or processed solely for the purpose of completing a payment transaction

   Supports: Applicability threshold

   personal data collected, processed, sold, or disclosed pursuant to the federal Gramm-Leach-Bliley Act, Public Law 106-102, and implementing regulations, if the collection, processing, sale, or disclosure is in compliance with that law

   Supports: GLBA data exclusion

   Minn. Stat. 325M.12, Scope; exclusions Minnesota Office of the Revisor of Statutes Primary source

6. Any controller or processor that violates sections 325M.10 to 325M.21 is subject to an injunction and liable for a civil penalty of not more than $7,500 for each violation.

   Supports: Penalty

   Nothing in sections 325M.10 to 325M.21 establishes a private right of action

   Supports: No private right of action

   Minn. Stat. 325M.20, Attorney General enforcement Minnesota Office of the Revisor of Statutes Primary source