Businesses and Nonprofits: Get Ready for the New Minnesota Consumer Privacy Act

With the Minnesota Consumer Privacy Act (MCPA), which takes effect July 31, 2025, Minnesota now joins the many other states, like California, that have passed laws granting enhanced data privacy rights to individuals. I first reported on this new law last year.

Who Is Covered?

The MCPA covers legal entities that conduct business in Minnesota or produce products or services targeted to state residents, and that satisfy one or more of the following:

• During a calendar year, control or process the personal data of at least 100,000 consumers (excluding payment transactions).
• Derive over 25% of gross revenue from the sale of personal data and process or control the personal data of at least 25,000 consumers.

Unlike the California Consumer Privacy Act and other state data privacy laws, there is no broad exemption in the MCPA for nonprofits. Businesses and nonprofit organizations must review their privacy policies and practices to assure compliance and avoid enforcement actions by the Minnesota Attorney General’s office.