Minnesota Data Removal Guide (2026)
Minnesota's Consumer Data Privacy Act took effect July 2025. The law is notable for its data minimization obligations, profile-based decision transparency rights, and the most comprehensive opt-out of AI profiling in any state law.
At a glance
- Comprehensive state privacy law
- Yes — MCDPA
- Broker response deadline
- 45 days from verifiable request
- Enforcement
- Minnesota Attorney General
- Residents
- 5.7M (approx.)
Minnesota Consumer Data Privacy Act (MCDPA)
MCDPA applies to controllers processing data of 100,000+ Minnesota consumers or 25,000+ while selling data. Unique features include a right to question automated decisions, data minimization obligations (controllers must delete data no longer needed), and a privacy-impact-assessment requirement for high-risk processing. Enforcement is by the AG, with a 30-day cure period that sunsets in January 2026.
Your rights
- →Delete, access, correct, port, opt-out
- →Right to question automated decisions
- →Data-minimization obligations on controllers
- →Privacy impact assessment requirements
Where your data leaks from in Minnesota
Data brokers don\u2019t guess your address \u2014 they scrape specific public-record sources. The ones most relevant in Minnesota:
- Hennepin, Ramsey County property records
- Minnesota Judicial Branch case search (MNCIS)
- Minnesota DVS driver records
Ready to remove
Opt out of 200+ brokers for $2
OfflistMe drafts a legally compliant deletion email citing MCDPA for every broker. You send from your own inbox. No account, no ID upload.
Start for $2 \u2192If a broker ignores your request
If a broker does not respond within 45 days, file a complaint with the Minnesota Attorney General. The enforcement authority can assess civil penalties and compel compliance.
File a complaint with Minnesota Attorney General \u2197FAQ: Minnesota data removal
What makes MCDPA different from other state privacy laws?+
MCDPA has the strongest automated-decision transparency rights — you can demand a plain-language explanation of how a profile was built and request human review. It also imposes data-minimization obligations on controllers, requiring them to actively delete data they no longer need.