REGIONAL — A new consumer data privacy law in Minnesota promises to give residents far greater control over their personal information than ever before.
The Minnesota Consumer Data Privacy Act, or MCDPA, which took effect July 31, joins a growing list of laws in other states aimed at curbing the collection, sale, and use of consumer data by private companies. But supporters say Minnesota’s version goes further than most in giving individuals real power to question how their data is used, and to demand answers.
“We cannot and should not just think that violations and invasions of our privacy are just the way it is in this modern time,” Attorney General Keith Ellison said at a press conference last week. “We have a right to our privacy, and we have to protect it.”
Rising public concern about the way personal data is gathered and shared, often without people realizing it, prompted legislative action. According to a 2023 survey from the Pew Research Center, more than 80 percent of U.S. adults said they were concerned about how companies use their data.
Rep. Steve Elkins, DFL-Bloomington, who authored the bill, said it’s long overdue.
“There’s an old adage around these applications,” Elkins said. “If you’re getting the product for free, you are the product.”
That applies to everything from social media and streaming platforms to smartphone weather apps, many of which harvest precise location data and browsing histories that can then be sold to data brokers and used to target ads, determine insurance rates, and more.
“Each data point may not seem like much on its own,” Ellison said, “but when all that data comes together, it can become a significant invasion of our privacy and potentially even a threat to our safety.”
The impact goes beyond ads. Ellison described the amount of information being collected as “staggering,” noting that “our inability to control where it goes, how it’s used, who gets paid for it, who gets to invade our privacy, is a big deal.”
Under the new law, Minnesota consumers now have several key rights, represented by the memory aid LOCKED+. Data protections include:
• List: You can request a list of third parties to whom your data was sold.
• Opt-Out: You can decline to have a business sell your data or use it for profiling and targeted advertising.
• Copy: You have the right to obtain a copy of the personal data that a business has about you.
• Know: You have the right to know what information a business has collected about you.
• Edit: You have the right to edit, or make corrections, to the data that a business has collected about you.
• Delete: You have the right to delete personal information that has been collected.
• Plus: You have the right to question profiling and automated decisions that affect you, a key safeguard when those systems are used to evaluate eligibility for jobs, housing, or insurance.
Minnesotans under 16 receive added protection, too. The law prohibits companies from selling or targeting their data without parental or guardian consent.
The law applies only to certain companies, specifically those that either control or process the personal data of at least 100,000 Minnesota residents, or those that handle at least 25,000 residents’ data and earn more than 25 percent of their revenue from selling it. Government entities and federally recognized tribes are exempt. Small businesses are also exempt.
Some companies may already be prepared. Minnesota is now the 19th state to adopt such a law, and many businesses have already adjusted to similar requirements elsewhere. Others are playing catch-up.
The law requires companies to respond to consumer requests within 45 days. For the first six months, businesses will be given 30 days to correct any violations after being notified by the Attorney General’s Office. Consumers cannot sue companies for noncompliance, as enforcement lies solely with the Attorney General’s office, which is hiring additional staff, including attorneys and an investigator.
The AG’s office has also launched a new website, privacymn.com, to help both consumers and businesses navigate the law. Organized around the LOCKED+ mnemonic, it includes sample request letters, complaint forms, and instructions for opting out of systems.
The law also includes provisions to prevent companies from retaining data longer than necessary, a move aimed at reducing the risk of exposure in the event of a breach.
Ellison’s office hopes Minnesota’s law will help shift the balance of power back toward consumers.
“For years, this loss of privacy has felt inevitable, but it does not have to be,” Ellison said. “Our state’s new Consumer Data Privacy Act gives Minnesotans greater freedom to control their data.”