Minnesota (US)
Full entry AI-checked Checked 5 November 2026
Read this together with United States (federal), which also applies.
| Law | Citation | Status | In force from |
|---|---|---|---|
| Minnesota Consumer Data Privacy Act | Minn. Stat. 325M.10 to 325M.21 (Laws 2024, ch. 121, art. 5) | In force | 31 July 2025 |
| Data warehouses; notice required for certain disclosures (breach notice) | Minn. Stat. 325E.61 (Laws 2005, ch. 167) | In force | 1 January 2006 |
| Prohibiting Social Media Manipulation Act | Minn. Stat. 325M.30 to 325M.34 (Laws 2024, ch. 114, art. 3) | In force | 1 July 2025 |
| Stop harms from addictive social media | Minn. Stat. 325M.40 (Laws 2026, ch. 111, HF 4138) | Enacted, not yet in force | 1 July 2027 |
- Minnesota Consumer Data Privacy Act: Postsecondary institutions regulated by the Office of Higher Education must comply from 31 July 2029.
- Prohibiting Social Media Manipulation Act: Transparency duties for social media platforms with more than 10,000 monthly active Minnesota account holders. A mental health warning label duty (section 325M.335) was added from 1 July 2026. NetChoice challenged it in NetChoice v. Ellison (D. Minn., filed 29 April 2026), and news reports quote the Attorney General’s office as agreeing not to enforce it until the court rules on a motion to dismiss. We couldn’t open an official copy of the court record, so check it before relying on the duty.
- Stop harms from addictive social media: Signed on 26 May 2026. It applies to accounts created before, on or after 1 July 2027.
Regulators
Section titled “Regulators”What builders must do
Section titled “What builders must do”Who it covers
Section titled “Who it covers”Applies to legal entities doing business in Minnesota or targeting its residents that in a calendar year control or process data of 100,000+ consumers (excluding payment-only data), or 25,000+ while earning over 25% of gross revenue from selling data. Small businesses under the SBA standard are exempt, except that they can’t sell sensitive data without consent. Non-profits are covered. Banks, credit unions, insurers, government and HIPAA-protected data are exempt. Employees and B2B contacts aren’t consumers.
Sources: revisor.mn.gov/statutes/cite/325M.12 · revisor.mn.gov/statutes/cite/325M.17 · ag.state.mn.us/Data-Privacy/Business
Lawful bases
Section titled “Lawful bases”No GDPR-style lawful bases. Controllers give a privacy notice (including retention policies) and honour rights to access, correct, delete and port data, get a list of the specific third parties that received it, and opt out of targeted advertising, sale and profiling for significant decisions, within 45 days (extendable by 45). Sensitive data needs opt-in consent, and data no longer needed for its purpose must not be kept.
Sources: revisor.mn.gov/statutes/cite/325M.14 · revisor.mn.gov/statutes/cite/325M.16
Consent age for online services
Section titled “Consent age for online services”A child is under 13 (as in COPPA), and a known child’s data needs a parent’s consent under COPPA. Teens aged 13 to 16 must consent before their data is sold or used for targeted advertising, where the controller knows their age.
Sources: revisor.mn.gov/statutes/cite/325M.11 · revisor.mn.gov/statutes/cite/325M.16
Children
Section titled “Children”Since 1 July 2026, covered social media platforms must show a mental health warning label each time a user opens them, though that duty is challenged in court (see the law note). From 1 July 2027, platforms with 10,000+ account holders (or $1 billion revenue) must estimate users’ age, get verifiable parental consent for accounts of children aged 15 or under, keep those accounts at the most private settings, and show them no addictive features or targeted ads.
Sources: revisor.mn.gov/statutes/cite/325M.335 · revisor.mn.gov/statutes/cite/325M.40
Leads, not sources: kttc.com/2026/07/01/minnesota-will-not-yet-enforce-new-law-requiring-… · netchoice.org/netchoice-v-ellison-minnesota-censorship-labels
Cookies and similar technologies
Section titled “Cookies and similar technologies”No cookie-consent rule. Controllers must honour opt-out preference signals such as Global Privacy Control for targeted advertising and sale, and may use an IP address to judge Minnesota residence. Opt-out requests needn’t be authenticated. A clear opt-out method, such as a link labelled “Your Opt-Out Rights”, must also be offered outside the privacy notice.
Sources: revisor.mn.gov/statutes/cite/325M.14 · revisor.mn.gov/statutes/cite/325M.16
Electronic marketing
Section titled “Electronic marketing”Commercial email must not misrepresent its origin or carry a misleading subject line. State law also asks for an “ADV” subject label and an opt-out method, but federal CAN-SPAM overrides state email rules except those against falsity or deception, so those two rules likely don’t apply. Prerecorded or synthesised voice calls need the subscriber’s consent, or a live operator who gets consent first, unless an exception applies. Federal CAN-SPAM and the TCPA apply too.
Sources: revisor.mn.gov/statutes/cite/325F.694 · revisor.mn.gov/statutes/cite/325E.27 · govinfo.gov/content/pkg/USCODE-2024-title15/html/USCODE-2024-title15-…
Breach notification
Section titled “Breach notification”Notify affected Minnesota residents in the most expedient time possible and without unreasonable delay. If more than 500 people are notified at once, tell the national consumer reporting agencies within 48 hours. The statute has no Attorney General notice duty, and GLBA financial institutions are exempt.
Sources: revisor.mn.gov/statutes/cite/325E.61
Registration and fees
Section titled “Registration and fees”The privacy law has no registration or fee, and we found no Minnesota data broker registry.
Sources: revisor.mn.gov/statutes/cite/325M
Data protection officer
Section titled “Data protection officer”No formal DPO duty, but controllers must document their privacy policies and procedures, including the name and contact details of a chief privacy officer or other person primarily responsible for compliance.
Sources: revisor.mn.gov/statutes/cite/325M.18
International transfers
Section titled “International transfers”No cross-border transfer rules (federal rules are in us-federal). Processors must work under a binding contract, and may use subcontractors only after the controller has had a chance to object.
Sources: revisor.mn.gov/statutes/cite/325M.13
Impact assessments
Section titled “Impact assessments”Controllers must document a data privacy and protection assessment of targeted advertising, sale, sensitive data, risky profiling and other high-risk processing, including the written policies and procedures. They must also keep an inventory of the data they manage as part of their security practices. The Attorney General can request assessments in an investigation.
Sources: revisor.mn.gov/statutes/cite/325M.18 · revisor.mn.gov/statutes/cite/325M.16
Automated decisions and AI
Section titled “Automated decisions and AI”Consumers can opt out of profiling for significant automated decisions. If profiling leads to such a decision, they can question the result, learn the reason and, where feasible, what would change it, review the data used, and have inaccurate data corrected and the decision re-evaluated.
Sources: revisor.mn.gov/statutes/cite/325M.14
Penalties
Section titled “Penalties”The Attorney General enforces. The mandatory 30-day warning letter ended on 31 January 2026. Civil penalties are up to $7,500 per violation, plus injunctions and litigation costs. There’s no private right of action under the privacy law. From July 2027, children or parents can sue under the addictive social media law, with $10,000 statutory damages for reckless or knowing violations.
Sources: revisor.mn.gov/statutes/cite/325M.20 · revisor.mn.gov/statutes/cite/325M.40
History
Section titled “History”| Date | Change |
|---|---|
| 5 November 2026 | First entry. Checked against official sources with AI assistance, then corrected after an independent AI-assisted review. |
Report a change
Section titled “Report a change”If a law, a date or a figure here has changed, open an issue with the official source. The data lives in laws/full/us-mn.yaml.