Another State, Some New Twists

The Minnesota Consumer Data Privacy Act (MCDPA) took effect on July 31, 2025. At first glance it follows the model most US state privacy laws share: rights to access, correct and delete data, and a right to opt out of targeted advertising, the sale of personal data and certain profiling. But Minnesota added several requirements that go further than its neighbours, and some of them reach into how publishers document and explain their data practices.

This article covers what ad-supported publishers should know. It is an overview, not legal advice.

Who Is Covered

The MCDPA applies to organisations that do business in Minnesota or offer products or services targeted at Minnesota residents, and that in a calendar year either:

• control or process the personal data of 100,000 or more Minnesota consumers, excluding data processed solely to complete a payment transaction; or
• derive more than 25% of gross revenue from the sale of personal data and control or process the personal data of 25,000 or more Minnesota consumers.

Small businesses as defined by the US Small Business Administration are generally exempt, but they may not sell sensitive data without the consumer’s consent. For a publisher, “consumers” can include website and app visitors identified by cookies or device IDs, so a site with modest Minnesota traffic can still reach the threshold.

The Rights Publishers Must Support

Minnesota residents get the familiar set of rights:

• Confirm whether their data is processed and access it.
• Correct inaccurate data and delete data.
• Obtain a portable copy.
• Opt out of targeted advertising, the sale of personal data, and profiling in furtherance of decisions that produce legal or similarly significant effects.

For ad-supported publishers, the targeted advertising and sale opt-outs are the ones that touch the ad stack every day.

What Is Distinctive About Minnesota

The right to question profiling

Where a consumer has been profiled in a way that led to a decision with legal or similarly significant effects, they may question the result, be told the reasons, and, if the decision was based on inaccurate data, have the data corrected and the decision reevaluated. Most publishers do not make decisions of that kind about visitors, but it is worth confirming that none of your tools does.

A list of specific third parties

Consumers can ask for a list of the specific third parties to which the controller has disclosed their personal data, or, if the controller does not keep that information per consumer, a list of the specific third parties it has disclosed personal data to in general. For publishers working with many ad tech partners, this makes an accurate vendor register a practical necessity.

A data inventory

Controllers must maintain an inventory of the personal data they process. Combined with the third-party list requirement, this pushes publishers towards documented knowledge of which tags collect what, and where it goes.

Universal opt-out mechanisms

Controllers must honour a consumer’s opt-out sent through a recognised universal opt-out mechanism, such as a browser privacy signal. Sites should treat such signals as an opt-out of targeted advertising and sale for Minnesota users.

Data protection assessments

Processing for targeted advertising, the sale of personal data, profiling with significant risks and the processing of sensitive data requires a documented data privacy and protection assessment.

Enforcement

The law is enforced by the Minnesota Attorney General; there is no private right of action. A 30-day cure period for violations applied only until January 31, 2026, so since then the Attorney General is no longer required to offer a chance to fix a problem before acting. Civil penalties can reach up to $7,500 per violation.

What Publishers Should Check

1. Threshold. Estimate how many Minnesota consumers you process data about each year, including identified devices.
2. Opt-out link and flow. Make sure US visitors can opt out of targeted advertising and sale, and that the choice reaches your ad partners.
3. Signals. Honour browser opt-out signals such as Global Privacy Control, and pass the resulting choice on through the IAB Global Privacy Platform (GPP) or whichever signal your partners read.
4. Vendor register. Keep a current list of every third party receiving personal data, ready to answer a third-party list request.
5. Data inventory. Document what each tag and SDK collects and why.
6. Assessments. Write and keep a data protection assessment covering targeted advertising.
7. Privacy notice. Update it to describe Minnesota rights and how to exercise them.

Fitting Minnesota Into a Multi-State Setup

Rather than building a separate experience for each state, most publishers run one US opt-out flow that covers the strictest common requirements, then add state-specific details where needed. Minnesota’s additions — the third-party list, the data inventory and the profiling right — are mostly documentation and request-handling duties rather than banner changes, so the work lands with whoever owns your vendor register and privacy requests.

Key Takeaways

• The MCDPA has applied since July 31, 2025, to organisations meeting the 100,000 or 25,000-plus-25%-revenue thresholds.
• Opt-outs cover targeted advertising, sale and significant profiling, and universal opt-out signals must be honoured.
• Consumers can request a list of the specific third parties that received their data.
• A data inventory and data protection assessments are required.
• The cure period ended on January 31, 2026; enforcement is by the Attorney General.