{ "jurisdiction_id": "US-MN", "jurisdiction": "United States – Minnesota", "url": "https://dataprotection.gi/jurisdictions/united-states-minnesota/", "generator": "render_jid v13-gdpri-1.0.0", "date_modified": "2026-08-06", "schema_version": "gdpri-v2", "counts": { "categories": 10, "claims": 44, "sub_modules": 57, "source_register": 15 }, "categories": [ { "code": "regulator_and_framework", "name": "Regulator & Framework", "traffic_light": "green", "sub_modules": [ "act_and_instruments", "material_scope", "regulator_and_authority", "regulator_registration_and_filing", "territorial_scope" ], "url": "https://dataprotection.gi/jurisdictions/united-states-minnesota/#regulator-and-framework-regulator-framework", "traffic_light_rationale": "A comprehensive, currently in-force consumer privacy statute exists with a clearly identified enforcement authority and confirmed statutory citation (Minn. Stat. ch. 325M).", "claims": [ { "statement": "The Minnesota Attorney General's Office is the exclusive enforcement authority for the MCDPA, and the Act is not privately enforceable.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Confirmed", "source_publisher": "Minnesota Attorney General's Office", "source_url": "https://www.ag.state.mn.us/Data-Privacy/Business/Controller/Enforcement.asp", "source_tier": null, "observed_at": "2026-08-05" }, { "statement": "The Minnesota Consumer Data Privacy Act was signed into law on May 19, 2024, codified at Minnesota Statutes chapter 325M, and took effect July 31, 2025.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Confirmed", "source_publisher": "Minnesota Attorney General's Office", "source_url": "https://www.ag.state.mn.us/Office/Communications/2025/07/28_MCDPA.asp", "source_tier": null, "observed_at": "2026-08-05" }, { "statement": "The MCDPA applies to entities that control or process the personal data of 100,000 or more Minnesota residents, or that derive over 25% of revenue from selling personal data and process or control personal data of 25,000 or more consumers.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Confirmed", "source_publisher": "Minnesota Attorney General's Office", "source_url": "https://www.ag.state.mn.us/Office/Communications/2025/07/28_MCDPA.asp", "source_tier": null, "observed_at": "2026-08-05" }, { "statement": "Small businesses as defined by the U.S. Small Business Administration are exempt from the MCDPA, and there is no full exemption for HIPAA- or GLBA-covered entities, though targeted exemptions exist for health and financial data processing.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Probable", "source_publisher": "International Association of Privacy Professionals", "source_url": "https://iapp.org/news/a/minnesota-sends-comprehensive-privacy-bill-to-governor", "source_tier": null, "observed_at": "2026-08-05" }, { "statement": "MCDPA applicability is triggered by the volume of Minnesota residents' personal data controlled or processed rather than the controller's physical presence in Minnesota, giving the statute extraterritorial reach.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Probable", "source_publisher": "Minnesota Attorney General's Office", "source_url": "https://www.ag.state.mn.us/Office/Communications/2025/07/28_MCDPA.asp", "source_tier": null, "observed_at": "2026-08-05" }, { "statement": "No provision requiring controllers to register with or file notices to the Minnesota AGO prior to processing personal data was identified in reviewed AGO guidance.", "regulatory_stage": null, "is_binding": false, "confidence": "Uncertain", "source_publisher": "Minnesota Attorney General's Office", "source_url": "https://ag.state.mn.us/Data-Privacy/", "source_tier": null, "observed_at": "2026-08-05" } ] }, { "code": "lawful_processing_and_special_data", "name": "Lawful Processing & Special Data", "traffic_light": "amber", "sub_modules": [ "consent_thresholds", "lawful_bases", "pseudonymisation_and_anonymisation", "special_categories" ], "url": "https://dataprotection.gi/jurisdictions/united-states-minnesota/#lawful-processing-and-special-data-lawful-processing-special-data", "traffic_light_rationale": "Strong sensitive-data consent gate exists, but there is no GDPR Art.6-style enumerated lawful-basis framework, and pseudonymisation/anonymisation safe-harbour detail beyond the de-identified-data carve-out was not independently verified against statutory text.", "claims": [ { "statement": "The MCDPA's operative model relies on consent plus collection/purpose-limitation duties (limiting collection to what is necessary and disclosed) rather than an enumerated multi-basis lawful-processing framework analogous to GDPR Article 6.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Probable", "source_publisher": "Minnesota Attorney General's Office", "source_url": "https://www.ag.state.mn.us/Office/Communications/2025/07/28_MCDPA.asp", "source_tier": null, "observed_at": "2026-08-05" }, { "statement": "Controllers must obtain a consumer's affirmative consent before collecting or processing sensitive data, including specific location data or data revealing mental or physical health conditions or citizenship/immigration status.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Confirmed", "source_publisher": "Minnesota Attorney General's Office", "source_url": "https://www.ag.state.mn.us/Office/Communications/2026/02/05_MCDPA.asp", "source_tier": null, "observed_at": "2026-08-05" }, { "statement": "MCDPA sensitive data includes race, ethnicity, religion, mental or physical health condition, sexual orientation, and precise geolocation, as well as genetic and biometric data, subject to enhanced consent requirements.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Confirmed", "source_publisher": "Minnesota Attorney General's Office", "source_url": "https://www.ag.state.mn.us/Office/Communications/2025/07/28_MCDPA.asp", "source_tier": null, "observed_at": "2026-08-05" }, { "statement": "The MCDPA does not restrict processing of de-identified data, defined as data that cannot be linked to individual consumers, nor data that is publicly available.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Confirmed", "source_publisher": "Minnesota Attorney General's Office", "source_url": "https://www.ag.state.mn.us/Data-Privacy/Consumer/", "source_tier": null, "observed_at": "2026-08-05" } ] }, { "code": "data_subject_rights", "name": "Data Subject Rights", "traffic_light": "green", "sub_modules": [ "access_right", "data_portability", "deadlines_and_response_windows", "rectification_and_erasure", "restriction_and_objection" ], "url": "https://dataprotection.gi/jurisdictions/united-states-minnesota/#data-subject-rights-data-subject-rights", "traffic_light_rationale": "Rights are clearly enumerated by the regulator with a defined statutory response deadline (45 days) and complaint escalation path.", "claims": [ { "statement": "Minnesota consumers have rights to know what data a company holds about them and to obtain a list of specific third parties to which their data has been sold.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Confirmed", "source_publisher": "Minnesota Attorney General's Office", "source_url": "https://www.ag.state.mn.us/Office/Communications/2026/02/05_MCDPA.asp", "source_tier": null, "observed_at": "2026-08-05" }, { "statement": "Consumers have the right to request correction of inaccurate data and deletion of their personal and sensitive data held by a business.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Confirmed", "source_publisher": "Minnesota Attorney General's Office", "source_url": "https://www.ag.state.mn.us/Data-Privacy/Consumer/", "source_tier": null, "observed_at": "2026-08-05" }, { "statement": "Consumers may opt out of the sale of their personal data, use of their data for targeted advertising, and profiling, including profiling used in automated decision-making.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Confirmed", "source_publisher": "Minnesota Attorney General's Office", "source_url": "https://www.ag.state.mn.us/Data-Privacy/Consumer/", "source_tier": null, "observed_at": "2026-08-05" }, { "statement": "The Act's consumer rights structure includes a right to obtain a copy of one's data in addition to rights to a third-party disclosure list, opt-out, access, correction, and deletion.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Probable", "source_publisher": "International Association of Privacy Professionals", "source_url": "https://iapp.org/news/a/a-view-from-dc-from-murder-to-movement-in-minnesota-and-beyond", "source_tier": null, "observed_at": "2026-08-05" }, { "statement": "Businesses must respond to consumer rights requests within 45 days, and consumers may file a complaint with the Attorney General's Office if a business fails to respond within that window.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Confirmed", "source_publisher": "Minnesota Attorney General's Office", "source_url": "https://www.ag.state.mn.us/Data-Privacy/Consumer/", "source_tier": null, "observed_at": "2026-08-05" } ] }, { "code": "controller_processor_duties", "name": "Controller/Processor Duties", "traffic_light": "amber", "sub_modules": [ "accountability_and_dpia", "breach_notification", "dpo_requirements", "joint_controller_arrangements", "retention_and_disposal", "ropa_requirements", "security_measures" ], "url": "https://dataprotection.gi/jurisdictions/united-states-minnesota/#controller-processor-duties-controller-processor-duties", "traffic_light_rationale": "Core accountability, assessment, processor-contract, and breach-notification duties are well evidenced from AGO guidance; DPO/ROPA specifics rely on pre-enactment secondary analysis and were not independently verified against final statute text.", "claims": [ { "statement": "Businesses subject to the MCDPA must conduct data protection/privacy assessments and maintain data security practices to protect personal data.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Confirmed", "source_publisher": "Minnesota Attorney General's Office", "source_url": "https://www.ag.state.mn.us/Office/Communications/2025/07/28_MCDPA.asp", "source_tier": null, "observed_at": "2026-08-05" }, { "statement": "Pre-enactment IAPP commentary on the MCDPA bill identified an implied obligation for covered entities to name a chief privacy officer or other individual with primary responsibility for privacy policies and procedures.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Uncertain", "source_publisher": "International Association of Privacy Professionals", "source_url": "https://iapp.org/news/a/minnesota-sends-comprehensive-privacy-bill-to-governor", "source_tier": null, "observed_at": "2026-08-05" }, { "statement": "Processor contracts under the MCDPA must require processors to assist controllers with security of processing, breach notifications, and data protection assessments, and must clearly allocate responsibilities between controller and processor.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Confirmed", "source_publisher": "Minnesota Attorney General's Office", "source_url": "https://www.ag.state.mn.us/Data-Privacy/Business/Processor/", "source_tier": null, "observed_at": "2026-08-05" }, { "statement": "Processors must implement appropriate technical and organizational measures to ensure security appropriate to the risk of processing, and allow controller-directed assessments and inspections.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Confirmed", "source_publisher": "Minnesota Attorney General's Office", "source_url": "https://www.ag.state.mn.us/Data-Privacy/Business/Processor/", "source_tier": null, "observed_at": "2026-08-05" }, { "statement": "Processors must provide notification to controllers upon a breach of the security of systems used to protect personal data, as part of MCDPA processor obligations.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Confirmed", "source_publisher": "Minnesota Attorney General's Office", "source_url": "https://www.ag.state.mn.us/Data-Privacy/Business/Processor/", "source_tier": null, "observed_at": "2026-08-05" }, { "statement": "Minnesota maintains a separate general data-breach-notification statute (Minn. Stat. §325E.61 et seq.) applicable to entities holding Minnesotans' personal information, distinct from MCDPA processor-to-controller notice duties.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Uncertain", "source_publisher": "OneTrust DataGuidance", "source_url": "https://www.dataguidance.com/legal-research/minnesota-statutes-chapter-325e-data", "source_tier": null, "observed_at": "2026-08-05" }, { "statement": "Businesses may not retain personal data longer than is relevant and reasonably necessary for the disclosed purpose.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Confirmed", "source_publisher": "Minnesota Attorney General's Office", "source_url": "https://www.ag.state.mn.us/Office/Communications/2025/07/28_MCDPA.asp", "source_tier": null, "observed_at": "2026-08-05" } ] }, { "code": "cross_border_and_adequacy", "name": "Cross-Border & Adequacy", "traffic_light": "red", "sub_modules": [ "adequacy_granted", "adequacy_received", "data_localisation", "sccs_and_bcrs", "transfer_impact_assessment", "transfer_mechanisms" ], "url": "https://dataprotection.gi/jurisdictions/united-states-minnesota/#cross-border-and-adequacy-cross-border-adequacy", "traffic_light_rationale": "This module is structurally inapplicable to a US state consumer-privacy statute; explicit absence confirmed via AGO guidance review rather than an unexamined gap.", "claims": [ { "statement": "The MCDPA does not establish an EU-style cross-border transfer regime; it imposes controller-processor contractual requirements and consumer rights but contains no identified adequacy determination, SCC/BCR mechanism, transfer impact assessment requirement, or data-localization mandate.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Probable", "source_publisher": "Minnesota Attorney General's Office", "source_url": "https://www.ag.state.mn.us/Data-Privacy/Business/Processor/", "source_tier": null, "observed_at": "2026-08-05" } ] }, { "code": "sectoral_watch", "name": "Sectoral Watch", "traffic_light": "amber", "sub_modules": [ "credit_and_scoring", "education", "employment_data", "financial_sector_overlay", "health_sector_overlay", "insurance", "telecoms_and_eprivacy" ], "url": "https://dataprotection.gi/jurisdictions/united-states-minnesota/#sectoral-watch-sectoral-watch", "traffic_light_rationale": "Financial, health, and education overlays are evidenced; several other sectors carry unresolved gaps requiring primary-source verification.", "claims": [ { "statement": "The MCDPA provides no full exemption for GLBA-covered financial institutions but includes targeted exemptions for financial data processing.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Probable", "source_publisher": "International Association of Privacy Professionals", "source_url": "https://iapp.org/news/a/minnesota-sends-comprehensive-privacy-bill-to-governor", "source_tier": null, "observed_at": "2026-08-05" }, { "statement": "The MCDPA provides no full exemption for HIPAA-covered entities but includes targeted exemptions for health data processing.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Probable", "source_publisher": "International Association of Privacy Professionals", "source_url": "https://iapp.org/news/a/minnesota-sends-comprehensive-privacy-bill-to-governor", "source_tier": null, "observed_at": "2026-08-05" }, { "statement": "In 2023, the Minnesota Attorney General joined a 32-state settlement with health-data clearinghouse Inmediata over a multi-year breach of protected health information affecting approximately 113,000 Minnesota residents, predating MCDPA but illustrating active health-data enforcement posture.", "regulatory_stage": null, "is_binding": false, "confidence": "Confirmed", "source_publisher": "Minnesota Attorney General's Office", "source_url": "https://www.ag.state.mn.us/Office/Communications/2023/10/23_Inmediata.asp", "source_tier": null, "observed_at": "2026-08-05" }, { "statement": "Certain education technology providers are subject to the MCDPA regardless of the general consumer-volume thresholds applicable to other controllers.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Probable", "source_publisher": "Minnesota Attorney General's Office", "source_url": "https://www.ag.state.mn.us/Office/Communications/2025/07/28_MCDPA.asp", "source_tier": null, "observed_at": "2026-08-05" } ] }, { "code": "adtech_and_commercial_privacy", "name": "AdTech & Commercial Privacy", "traffic_light": "amber", "sub_modules": [ "clean_rooms_and_dcr", "cookies_and_trackers", "cross_context_advertising", "dark_patterns", "direct_marketing", "opt_out_signals" ], "url": "https://dataprotection.gi/jurisdictions/united-states-minnesota/#adtech-and-commercial-privacy-adtech-commercial-privacy", "traffic_light_rationale": "Universal opt-out and targeted-advertising opt-out are strongly evidenced; dark patterns and clean-room provisions remain unconfirmed gaps.", "claims": [ { "statement": "The MCDPA requires businesses to honor universal opt-out mechanisms (browser-based signals) that communicate a consumer's opt-out of targeted advertising and data collection/sale across websites.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Confirmed", "source_publisher": "Minnesota Attorney General's Office", "source_url": "https://www.ag.state.mn.us/Office/Communications/2025/07/28_MCDPA.asp", "source_tier": null, "observed_at": "2026-08-05" }, { "statement": "Consumers have the right to opt out of the sale of personal data and its use for targeted advertising.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Confirmed", "source_publisher": "Minnesota Attorney General's Office", "source_url": "https://www.ag.state.mn.us/Data-Privacy/Consumer/", "source_tier": null, "observed_at": "2026-08-05" } ] }, { "code": "algorithmic_biometric_and_surveillance_governance", "name": "Algorithmic, Biometric & Surveillance Governance", "traffic_light": "amber", "sub_modules": [ "ai_risk_assessments", "automated_decision_making_transparency", "biometric_regime", "genetic_data", "profiling_restrictions", "state_surveillance_carveouts" ], "url": "https://dataprotection.gi/jurisdictions/united-states-minnesota/#algorithmic-biometric-and-surveillance-governance-algorithmic-biometric-surveill", "traffic_light_rationale": "Profiling/ADM rights are strongly evidenced and materially significant; biometric/genetic standalone-regime status and state-surveillance carve-outs remain unresolved gaps.", "claims": [ { "statement": "Minnesota's Attorney General has characterized the MCDPA as providing some of the nation's strongest protections against harmful data profiling and automated decision-making, including a consumer right to opt out of profiling used in furtherance of significant decisions.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Confirmed", "source_publisher": "Minnesota Attorney General's Office", "source_url": "https://www.ag.state.mn.us/Office/Communications/2025/07/28_MCDPA.asp", "source_tier": null, "observed_at": "2026-08-05" }, { "statement": "Consumers may request information regarding a profiling or automated decision made about them, including the reasoning behind the decision and the data used to reach it, and may question automated decisions facilitated by artificial intelligence.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Confirmed", "source_publisher": "Minnesota Attorney General's Office", "source_url": "https://www.ag.state.mn.us/Data-Privacy/Business/Processor/", "source_tier": null, "observed_at": "2026-08-05" }, { "statement": "The MCDPA creates rights intended to ensure that AI and automated systems cannot deprive Minnesota residents of critical goods and services.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Probable", "source_publisher": "Minnesota Attorney General's Office", "source_url": "https://www.ag.state.mn.us/Office/Communications/2025/07/28_MCDPA.asp", "source_tier": null, "observed_at": "2026-08-05" }, { "statement": "Biometric data is classified as sensitive data under the MCDPA and subject to consent requirements before collection; no standalone biometric-specific statute comparable to Illinois' BIPA has been confirmed as currently enacted in Minnesota.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Uncertain", "source_publisher": "Minnesota Attorney General's Office", "source_url": "https://www.ag.state.mn.us/Office/Communications/2025/07/28_MCDPA.asp", "source_tier": null, "observed_at": "2026-08-05" }, { "statement": "Genetic data is classified as sensitive data under the MCDPA requiring consumer consent before collection; Minnesota separately maintains government-data-practices provisions addressing genetic information (Minn. Stat. §13.386), though current text of that provision was not independently retrieved.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Uncertain", "source_publisher": "Minnesota Attorney General's Office", "source_url": "https://www.ag.state.mn.us/Office/Communications/2025/07/28_MCDPA.asp", "source_tier": null, "observed_at": "2026-08-05" } ] }, { "code": "children_and_vulnerable_groups", "name": "Children & Vulnerable Groups", "traffic_light": "green", "sub_modules": [ "age_verification", "dependent_adults", "education_settings", "minor_profiling_bans", "parental_consent" ], "url": "https://dataprotection.gi/jurisdictions/united-states-minnesota/#children-and-vulnerable-groups-children-vulnerable-groups", "traffic_light_rationale": "Children's-data provisions are clearly documented by the regulator with specific age thresholds and guardianship extension.", "claims": [ { "statement": "Controllers may not process a consumer's personal data for targeted advertising or sell that consumer's personal data without the consumer's consent where the controller knows the consumer is between 13 and 16 years of age.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Confirmed", "source_publisher": "Minnesota Attorney General's Office", "source_url": "https://www.ag.state.mn.us/Data-Privacy/Business/Controller/Context-Driven-Obligations.asp", "source_tier": null, "observed_at": "2026-08-05" }, { "statement": "Controllers may not process the personal data concerning a known child without obtaining consent from the child's parent or lawful guardian (with limited exceptions), and must comply with COPPA.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Confirmed", "source_publisher": "Minnesota Attorney General's Office", "source_url": "https://www.ag.state.mn.us/Data-Privacy/Business/Controller/Context-Driven-Obligations.asp", "source_tier": null, "observed_at": "2026-08-05" }, { "statement": "Certain education technology providers are subject to the MCDPA regardless of the general applicability thresholds, extending coverage into student-data contexts.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Probable", "source_publisher": "Minnesota Attorney General's Office", "source_url": "https://www.ag.state.mn.us/Office/Communications/2025/07/28_MCDPA.asp", "source_tier": null, "observed_at": "2026-08-05" }, { "statement": "The MCDPA allows consumers to exercise their statutory rights on behalf of their children or any person over whom the consumer has guardianship or conservatorship.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Confirmed", "source_publisher": "Minnesota Attorney General's Office", "source_url": "https://www.ag.state.mn.us/Data-Privacy/Consumer/", "source_tier": null, "observed_at": "2026-08-05" } ] }, { "code": "enforcement_and_redress", "name": "Enforcement & Redress", "traffic_light": "amber", "sub_modules": [ "collective_redress_and_class_actions", "enforcement_activity_index", "private_right_of_action", "recent_developments_180d", "regulator_funding_and_capacity", "regulator_powers_and_penalties" ], "url": "https://dataprotection.gi/jurisdictions/united-states-minnesota/#enforcement-and-redress-enforcement-redress", "traffic_light_rationale": "Enforcement powers, penalties, and activity are well documented and robust, but the absence of a private right of action and expiration of the cure period both materially shift risk allocation, and no collective-redress mechanism exists.", "claims": [ { "statement": "The Minnesota Attorney General may seek injunctive relief, litigation expenses, and civil penalties of up to $7,500 per violation against MCDPA violators.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Confirmed", "source_publisher": "Minnesota Attorney General's Office", "source_url": "https://www.ag.state.mn.us/Data-Privacy/Business/Controller/Enforcement.asp", "source_tier": null, "observed_at": "2026-08-05" }, { "statement": "Since the MCDPA took effect, the Attorney General's Office sent hundreds of education letters and dozens of formal warning letters to companies regarding privacy policy, consent, and universal opt-out compliance issues, and the Act's mandatory pre-enforcement cure/notice period expired on January 31, 2026.", "regulatory_stage": null, "is_binding": false, "confidence": "Confirmed", "source_publisher": "Minnesota Attorney General's Office", "source_url": "https://www.ag.state.mn.us/Office/Communications/2026/02/05_MCDPA.asp", "source_tier": null, "observed_at": "2026-08-05" }, { "statement": "The MCDPA included funding for the Attorney General's Office to hire four new attorneys and an investigator focused primarily on enforcing the Act, placing Minnesota among the most heavily resourced state privacy enforcers per independent industry analysis.", "regulatory_stage": null, "is_binding": false, "confidence": "Probable", "source_publisher": "Minnesota Attorney General's Office", "source_url": "https://www.ag.state.mn.us/Office/Communications/2025/07/28_MCDPA.asp", "source_tier": null, "observed_at": "2026-08-05" }, { "statement": "No collective-redress or class-action mechanism specific to MCDPA enforcement has been identified; enforcement is vested exclusively in the Attorney General.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Probable", "source_publisher": "Minnesota Attorney General's Office", "source_url": "https://www.ag.state.mn.us/Data-Privacy/Business/Controller/Enforcement.asp", "source_tier": null, "observed_at": "2026-08-05" }, { "statement": "The MCDPA contains no private right of action; only the Attorney General may enforce the Act.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Confirmed", "source_publisher": "Minnesota Attorney General's Office", "source_url": "https://www.ag.state.mn.us/Data-Privacy/Business/Controller/Enforcement.asp", "source_tier": null, "observed_at": "2026-08-05" }, { "statement": "In June 2026, Minnesota joined a coalition of 18 attorneys general and agencies opposing the proposed federal SECURE Data Act, with the Minnesota AGO stating the bill would preempt and weaken protections under the state's Consumer Data Privacy Act.", "regulatory_stage": null, "is_binding": false, "confidence": "Confirmed", "source_publisher": "Minnesota Attorney General's Office", "source_url": "https://www.ag.state.mn.us/Office/Communications/2026/06/03_SECURE-Data-Act.asp", "source_tier": null, "observed_at": "2026-08-05" } ] } ] }