Open workspace

Guide · US state law

MCDPA: Minnesota's law and its new rights

The Minnesota Consumer Data Privacy Act has applied since July 31, 2025 and brought rights that other states did not have, such as questioning the result of an automated profile. In this guide you will understand who must comply, the data inventory, the mandatory GPC and what changes for a site with AdSense or Ad Manager.

Audit my site for the USRead the guide
  • ✓Based on Chapter 325M of the Minnesota statutes and the state attorney general
  • ✓Practical examples for sites with ads
  • ✓Read-only scan, no changes to the site
100,000Minnesota consumers per year: the main threshold of the law
25%of revenue from the sale of data: with that, 25,000 consumers are enough
45 daysto respond to requests and to apply an opt-out
$7,500maximum civil penalty per violation

What it is

A privacy law with rights that go beyond opt-out

The Minnesota Consumer Data Privacy Act, or MCDPA, is Minnesota's general privacy law. It was signed on May 19, 2024, is in Chapter 325M of the state's statutes and took effect on July 31, 2025. State-regulated higher education institutions only have to comply from July 31, 2029.

The base is the same as the Connecticut and Colorado laws: access, correction, deletion, portability and opt-out of targeted advertising, sale and automated profiling. A covered site must also honor universal opt-out signals, such as GPC.

Minnesota went further on two points. The consumer can question the result of an automated profile that produced an important decision about them. And the company must keep an inventory of the data it processes and document its privacy policies, with the name of the person responsible.

For a site with ads, the part that weighs most is the usual one: an opt-out that works, GPC honored and a complete privacy page. But the new internal duties show that Minnesota expects more organization from those who process data in volume.

Checklist

What you need to meet

If your site exceeds the MCDPA thresholds, these points need to be working.

  1. Respect the universal opt-out signal

    The site must accept the opt-out sent by a preference signal, such as GPC, turned on by the visitor themselves. The signal cannot be turned on by default.

    Example

    Visitor with GPC turned on: the site turns on Google's restricted data processing for them only.

    <!-- AdSense: anúncio sem dados de comportamento -->
<ins class="adsbygoogle" ...
     data-restrict-data-processing="1"></ins>

// GPT (Ad Manager)
googletag.pubads().setPrivacySettings({
  'restrictDataProcessing': true
});

  2. Opt-out outside the privacy notice

    Anyone who sells data, does targeted advertising or profiling needs a clear and visible method to opt out, outside the text of the notice.

    Example

    A footer link called Your Opt-Out Rights or Your Privacy Rights.

  3. Link with the word privacy

    The privacy notice must be on a visible link, with the word privacy, starting from the home page.

    Example

    Privacy Policy link in the footer of the home page.

  4. Policy with the sentences Google requires

    AdSense requires the privacy policy to warn about the ad cookies of Google and other vendors. It must also say how the visitor opts out of personalized ads.

    Example

    Third-party vendors, including Google, use cookies to serve ads based on a user's previous visits to your website or other websites. You can opt out of personalized advertising in Google's Ads Settings.

  5. 45-day deadline

    The opt-out takes effect as soon as possible, within 45 days at most. Other requests also have 45 days, with one possible extension.

  6. Consent for sensitive data

    Sensitive data can only be processed with consent. If the visitor withdraws consent, the use stops within 15 days.

    Example

    Withdrawing consent must be as easy as giving it, for example with the same button in the same place.

  7. Teens aged 13 to 16

    If you know the visitor is 13 to 16 years old, you need their consent to use the data for targeted advertising or to sell it.

  8. Inventory and documented policies

    Keep an inventory of the data the site processes. Document the privacy policies with the name and contact of the person in charge.

In practice

Right and wrong

Official tools

Certified CMPs and official links

Google does not require a certified CMP or GPP for Minnesota, so you can use Google's own message or a CMP with GPP.

Who must comply and definitions

The MCDPA thresholds and the law's key terms

The law applies to those who do business in Minnesota or offer products and services directed to residents of the state and, in a calendar year, exceed one of the thresholds below. There is no general exemption for nonprofits. Personal data is any information linked or linkable to a person, such as cookies and ad identifiers.

100,000 consumers

Controls or processes data of at least 100,000 Minnesota consumers. Data used only to complete a payment does not count.

25,000 and data sales

Controls or processes data of at least 25,000 consumers and gets more than 25% of gross revenue from the sale of personal data.

Small business

Small businesses under the US federal definition are outside most of the law, but cannot sell sensitive data without prior consent.

Sensitive data

Racial or ethnic origin, religious belief, health, sexual orientation, immigration status, biometric or genetic data that identifies the person, data of a known child and specific geolocation.

Sale

The exchange of personal data for money or other valuable consideration. Transfers to processors, to companies in the same group and in mergers are excluded.

Targeted advertising

An ad chosen with data from the visitor's activity over time on other companies' sites and apps. First-party ads, contextual ads and performance measurement are not included.

People's rights

What the Minnesota resident can ask for

The response must go out within 45 days, with a further 45-day extension if notified within the initial period. Two requests a year are free. The opt-out does not require proof of identity.

Confirm and access

Know whether the company processes their data and learn the categories of data processed.

Correct, delete and take

Correct wrong data, request deletion and receive a portable copy of the data.

Refuse targeted ads and sale

Ask that the data not be used for targeted advertising and not be sold, including through a universal signal such as the GPC.

Refuse automated profiling

Opt out of profiles used in decisions with legal or similarly significant effects, such as housing, insurance, education, employment, health or financial services.

Question a profile

Question the result of a profile that produced an important decision, understand the reasons and review the data used.

List of third parties

Receive the list of the specific third parties that received their data, or the list of all third parties, if the company does not record it per person.

What is different about Minnesota

Questioning profiles and keeping a data inventory

The right to question profiles is the biggest novelty of the law. When an automated profile leads to a decision with legal or similarly significant effects, the consumer can question the result, learn the reasons and, when possible, what they could have done to get a different decision. They can also review the data used and, if it is wrong, ask for correction and a new assessment.

The Minnesota attorney general stressed that these rights apply with or without artificial intelligence. For most content sites, this right rarely comes up, but it matters for sites that do credit pre-screening, insurance quotes or job screening.

The second novelty is internal. The law asks for reasonable security, including an inventory of the data the company processes. It also asks the company to document its privacy policies and procedures, with the name and contact of the main person responsible, such as a privacy officer, when there is one.

For those who live off ads, the inventory is a good exercise: list which scripts and ad partners run on the site, what data each receives and where it goes. It is the same map that helps answer the list of third parties the consumer can ask for.

Site obligations

What a covered site must have working

  1. Full privacy noticeThe notice must include the categories of data and the purposes, how to exercise rights and appeal, the categories of data sold or shared and with whom, a contact with email or online means, the retention policy and the date of the last update.
  2. Link with the word privacyThe notice must be linked by a visible link with the word privacy on the home page and, in apps, also in the settings.
  3. Opt-out outside the noticeThose who sell data, do targeted advertising or profiling must offer the opt-out outside the policy text, for example in a link called Your Opt-Out Rights or Your Privacy Rights.
  4. Consent without tricksSensitive data only with consent, which does not count if obtained through a deceptive default or by acceptance of general terms. If the consumer withdraws consent, use must stop within 15 days.
  5. Protection for teenagersIf the company knows the consumer is between 13 and 16, it cannot use their data for targeted advertising or sell it without consent.
  6. Data protection assessmentTargeted advertising, sale, sensitive data and risky profiling require a recorded assessment, which the attorney general can request in an investigation.

Enforcement and fines

Who enforces it and what a mistake costs

Only the Minnesota attorney general enforces the law. A consumer whose appeal was denied can complain to the attorney general.

Cure period ended

In the first six months, the attorney general had to send a notice and give 30 days to cure. That rule expired on January 31, 2026.

Up to $7,500 per violation

The civil penalty can reach $7,500 per violation, plus a court order to stop the practice.

Costs of the case

If the state wins, the judge can order the company to pay part or all of the costs of the case.

Recorded appeal

The company decides the appeal within 45 days, extendable by another 60, and keeps the record of appeals for at least 24 months.

Timeline

The MCDPA dates

As of November 2026, the law has been in effect for over a year and the cure period has already ended.

  1. May 19, 2024

    Signing

    Minnesota passes the Consumer Data Privacy Act.

  2. July 31, 2025

    Entry into force

    The law takes effect, with mandatory GPC and a 30-day cure period.

  3. January 31, 2026

    End of the cure period

    The rule requiring the attorney general to give 30 days to cure before acting expires.

  4. July 31, 2029

    Higher education

    State-regulated higher education institutions must start complying with the law.

Sites with AdSense and Ad Manager

Required GPC and the opt-out path to Google

In Minnesota, a covered site must honor universal opt-out signals sent with the visitor's consent, such as Global Privacy Control, or GPC. The law says the IP address is enough to know whether the visitor lives in the state. If the signal conflicts with a loyalty program, the signal prevails, and the site may ask for confirmation.

Google offers in AdSense and Ad Manager a US state regulations message, under Privacy & messaging, and Minnesota is among the states covered. The message shows the Do Not Sell or Share link. The opt-out turns on restricted data processing, called RDP, and Google stops using previous behavior to choose ads.

On the GPC, Google says the partner that implemented the signal can choose to turn on RDP when it receives an opt-out GPC. The setup is up to the site or the CMP, and can be done in the tag, with the restrictDataProcessing parameter in GPT or the data-restrict-data-processing attribute in AdSense.

The IAB Tech Lab has already published a Minnesota-specific GPP section, but it is not on the list of sections accepted by Google. For Google, the path is the US National section, where an opt-out of sale, sharing or targeted advertising turns on RDP.

In practice

What is and is not allowed in Minnesota

Examples for a site with Minnesota traffic that monetizes with programmatic ads.

Allowed

  • Using the IP address to identify Minnesota visitors and apply GPC
  • Show contextual ads to people who opted out or arrived with GPC turned on
  • Putting a link called Your Privacy Rights in the footer for the opt-out
  • Giving the consumer the list of all third parties, if the site does not record it per person
  • Using assessments made for other states, if they cover the same processing

Not allowed

  • Asking for an ID document to accept an opt-out
  • Using deceptive buttons to extract consent for sensitive data
  • Use data of teenagers aged 13 to 16 for targeted ads without consent
  • Publishing a policy without a retention policy and without an update date
  • Taking more than 45 days to apply an opt-out request

Common errors

Where sites stumble with Minnesota's law

Minnesota asks for more items in the policy and more internal organization than most states.

Incomplete policy

The privacy page does not talk about data retention or show the date of the last update, items required in Minnesota.

No data inventory

Nobody can say which ad scripts run on the site and what each one receives. It becomes impossible to answer the list of third parties.

GPC only in California

The CMP applies GPC only for California and ignores the signal from Minnesota visitors.

Opt-out with red tape

The opt-out form requires login or a document. The law says the opt-out does not need authentication.

State section alone in the GPP

The CMP sends only the Minnesota section, which Google does not read. Without US National, the opt-out does not reach Google.

Opt-out that does not change the ads

The visitor opts out, but ad requests continue without RDP and without an opt-out in the GPP string.

In ConsentMode

What the audit checks for Minnesota

  • Opens the site as a visitor from the United States and looks for the opt-out link and the link with the word privacy on the home page.
  • Turns on the GPC signal in the audit browser and compares the page and the ad requests with and without the signal.
  • Reads the GPP string and checks that the US National section exists and records the opt-out.
  • Lists the scripts and ad partners that load on the page, a starting point for the data inventory.
  • Checks whether the privacy page includes categories, purposes, third parties, rights, appeal, contact, retention and update date.
Run an auditSee everything that is checked

Frequently asked questions

Does the right to question profiles affect a content site?

Little, in most cases. It applies to profiles that lead to decisions with legal or similar effects, such as credit, insurance, housing or employment. Choosing ads is not usually that kind of decision, but sites that do credit pre-screening or job screening need to prepare.

Am I required to honor GPC in Minnesota?

Yes, if the law applies to your site. The law requires honoring universal opt-out signals and accepts the IP address to know whether the visitor lives in the state.

What is the data inventory?

It is a list kept by the company of the data it processes. The law places the inventory as part of reasonable security practices.

My company is small. Am I off the hook?

Almost. Small businesses under the US federal definition are outside most of the law, but cannot sell sensitive data without prior consent.

Is there still a period to cure after a notice?

No. The 30-day period was in force until January 31, 2026. Since then, the attorney general can act without giving that period.

Does ConsentMode make my site compliant?

ConsentMode is not a CMP or a law firm. The audit shows what the site actually does with the opt-out, the GPC, the GPP and the privacy page, so you can fix it with your vendor and your lawyer.

Library

Official sources

This guide was written from these official pages. Read them directly at the source:

See whether your site serves Minnesota

The audit opens the site as a US visitor, with and without GPC, and shows what to fix, without changing anything.

Start the audit