Law note · Minnesota
Minnesota Consumer Data Privacy Act (MCDPA), general applicability
MCDPA governs private-sector processing of Minnesota residents' personal data, enacted as Laws of Minnesota 2024, chapter 121, article 5. A controller must limit collection to what is adequate, relevant, and reasonably necessary for the disclosed processing purpose, and must obtain consent before processing for an undisclosed, incompatible secondary purpose.
The general effective date, July 31, 2025, binds every controller except postsecondary institutions regulated by the Office of Higher Education, which are not required to comply until July 31, 2029, per the statute's own history note.
What it asks of an app
- Limit your collection of a Minnesota resident's personal data to what is adequate, relevant, and reasonably necessary for the purpose you disclosed to them, and obtain consent before processing it for an undisclosed, incompatible secondary purpose.
- Confirm whether you are a postsecondary institution regulated by the Minnesota Office of Higher Education before assuming MCDPA already binds you; that sector's compliance date is July 31, 2029, not the general July 31, 2025 date.
When LexLint raises it
Declared activities: automated_outreach, crawls_web, deploys_chatbot, processes_biometrics, processes_voice, trains_models
Primary source: official Minnesota statute text, Minn. Stat. Chapter 325M, Office of the Revisor of Statutes