Minnesota Data Removal Guide (2026)
Minnesota's Consumer Data Privacy Act took effect July 2025. The law is notable for its data minimization obligations, profile-based decision transparency rights, and the most comprehensive opt-out of AI profiling in any state law.
At a glance
- Comprehensive state privacy law
- Yes, MCDPA
- Broker response deadline
- 45 days from verifiable request
- Enforcement
- Minnesota Attorney General
- Residents
- 5.7M (approx.)
Minnesota Consumer Data Privacy Act (MCDPA)
MCDPA applies to controllers processing data of 100,000+ Minnesota consumers or 25,000+ while selling data. Unique features include a right to question automated decisions, data minimization obligations (controllers must delete data no longer needed), and a privacy-impact-assessment requirement for high-risk processing. Enforcement is by the AG, with a 30-day cure period that sunsets in January 2026.
Read the full MCDPA explainer →Thresholds, penalties, cure period, private right of action, enforcement history.
What rights do Minnesota residents have?
- →Delete, access, correct, port, opt-out
- →Right to question automated decisions
- →Data-minimization obligations on controllers
- →Privacy impact assessment requirements
Where does your data leak from in Minnesota?
Data brokers don’t guess your address — they scrape specific public-record sources. The ones most relevant in Minnesota:
- Hennepin, Ramsey County property records
- Minnesota Judicial Branch case search (MNCIS)
- Minnesota DVS driver records
Ready to remove
Opt out of 500+ brokers for $7
OfflistMe drafts a legally compliant deletion email citing MCDPA for every broker. You send from your own inbox. No account, no ID upload.
Start for $7 →What if a broker ignores your request?
If a broker does not respond within 45 days, file a complaint with the Minnesota Attorney General. The enforcement authority can assess civil penalties and compel compliance.
File a complaint with Minnesota Attorney General ↗FAQ: Minnesota data removal
What makes MCDPA different from other state privacy laws?+
MCDPA has the strongest automated-decision transparency rights, you can demand a plain-language explanation of how a profile was built and request human review. It also imposes data-minimization obligations on controllers, requiring them to actively delete data they no longer need.