What You Need to Know about the Minnesota Consumer Data Privacy Act (MCDPA)
Compliance has always been a major part of running any business, but it is becoming increasingly important as technology becomes more advanced and integrated with business operations. At ArcStone, we have a commitment to evolving our company as the world around us shifts, and we find technology to be a significant part of change. It’s also important to us to share what we’re learning with our community so we can support each other and grow together.
On July 31, 2025, Minnesota’s first comprehensive privacy law protecting consumer rights will go into effect. You likely have the same questions we did––what is the law, who does it apply to, and what do you need to do? We checked into it and are here to pass on the key points, along with some resources containing more detailed information.
What is the law?
The new policy is called the Minnesota Consumer Data Privacy Act (MCDPA). Simply put, it regulates the collection and use of consumers’ personal information in the state of Minnesota. To help understand the specifics, the MCDPA includes a list of key definitions crucial to the policy. It also lays out penalties for noncomplying entities and exemptions to the law. We encourage you to dive into the details yourself, but here are some of the policy’s highlights.
- Personal information may only be collected from consumers if it is necessary to the processing purposes that were disclosed to the consumer
- Controllers and third-party processors are required to sign a legally binding agreement that ensures (among other things) confidentiality, deletion of personal data at the end of the contract, and allowance of reasonable assessments and inspections
- Personal data must be processed without discrimination
- Consumers are granted the right to use a universal opt-out mechanism (a browser setting or extension that declines targeted advertisements from sites they visit)
Who does it apply to?
The MCDPA applies to the consumers, or residents, of Minnesota. Businesses operating within Minnesota, or whose products and services are targeted at Minnesota consumers, are required to be in compliance with this policy if one or both of the following are true:
- They process at least 100,000 consumers’ personal data annually
- More than 25% of its gross revenue is gained from the sale of personal data, and they the process personal data of 25,000 consumers or more
Some organizations within these parameters are exempt, including those below:
- Government entities
- Nonprofits established to detect and prevent insurance fraud
- Federally recognized Native American tribes
Entities determined by the United States Small Business Administration to be Small Businesses are exempt from the policy, but are still required to obtain legal consent before selling sensitive consumer data.
What do you need to do?
First, we recommend doing a deeper dive to find out if your entity will need to comply. Check out the resources at the bottom of this article to guide you in the right direction.
Next, you’ll almost certainly need to revamp your privacy and cookie policies. Information about your collection and use of consumers’ personal data will need to be disclosed in ample detail.
You will also need to ensure your website is updated with the appropriate tools for privacy management. These tools include a consent management platform, a data subject access request form, and the ability to recognize data from universal opt-out mechanisms used by consumers. This will give consumers the capability to manage their privacy preferences, take advantage of their right to opt-out to targeted advertising, and submit requests regarding their personal data.
Finally, you’ll need to perform the required assessments and sign the necessary contracts if you work with third-party processing providers.
This list may seem daunting, especially with strict enforcement and penalties in place for non-complying entities. However, with several months ahead of us before the policy goes into effect, we’re confident that you’ll have all your ducks in a row in no time.
Additional Resources
Check out these tools and reference points for more information on the MCDPA:
