Law note · Minnesota
Minnesota Consumer Data Privacy Act (MCDPA), publicly available information exemption and profiling explanation right
What it asks of an app
- Personal data that is lawfully made available through a government record or widely distributed media, or that a controller reasonably believes the consumer lawfully made public, falls outside the MCDPA's definition of personal data.
- If you profile a Minnesota consumer's data for a decision with legal or similarly significant effect, be prepared to answer the consumer's questions about why the profiling reached that result and what they could have done differently, not merely to honor an opt-out request.
- There is no private right of action under this Act; only the Minnesota Attorney General enforces it.
When LexLint raises it
crawls_webtrains_modelsprocesses_biometrics
What we found
Personal data excludes deidentified data or publicly available information, defined as information lawfully made available from government records or widely distributed media, or that a controller reasonably believes was lawfully made available to the public. This is the ordinary, unqualified exemption, with no biometric carve-back of the kind Maryland's MODPA carries.
The Act applies to an entity doing business in Minnesota or targeting Minnesota residents that in a calendar year controls or processes personal data of 100,000 consumers or more, or derives more than 25% of gross revenue from selling personal data and processes or controls data of 25,000 consumers or more.
Section 325M.14(g) grants an unusual right: where personal data is profiled in furtherance of a decision with legal or similarly significant effect, the consumer has the right to question the result of the profiling, to be informed of the reason that the profiling resulted in the decision, and, if feasible, to be informed of what actions the consumer might have taken to secure a different decision, going beyond the opt-out right most peer state privacy acts stop at.
Section 325M.20(d) expressly states the Act establishes no private right of action for a violation of its provisions or any other law; enforcement is by the Attorney General, with civil penalties up to $7,500 per violation. Effective July 31, 2025, except that postsecondary institutions regulated by the Office of Higher Education have until July 31, 2029.