Minnesota Consumer Data Privacy Act - ADM and profiling provisions
Effective date
Penalty
$7,500 per civil violation. Cure period expired January 31, 2026. AG no longer required to provide warning or opportunity to cure before enforcement. AG-only…
Obligations mapped
10 obligations
Overview
Minnesota is the first state privacy law to require controllers to create and maintain a data inventory. The right to question and challenge profiling decisions applies to any decisions with legal or significant effects (broader than the opt-out right, which only applies to automated decisions). Small business exemption (SBA-defined). Separate from this privacy act, Minnesota HF 1370 (election and NCII deepfake criminal and civil provisions) faces an active First Amendment challenge from X (formerly Twitter) over its election deepfake rules; that litigation does not govern CDPA compliance but is relevant context for Minnesota AI and elections risk.
This is a privacy law with automated decision-making provisions.
See if this regulation applies to your company with the free exposure scan.
Who this applies to
This regulation applies to the following roles:
- Deployers and users of covered AI systems and tools
- Organizations operating in Minnesota
This regulation applies to companies that use or deploy AI tools and systems built by other vendors. If your company uses AI-powered products in the areas listed below, this regulation may apply to you.
325M.14, subd. 1(f) · 325M.14, subd. 1(g) and related sections
AI categories covered
- Consumer-facing AI
- Automated decision-making
- Algorithmic profiling
Specific AI use cases:
- Customer profiling and segmentation
- Credit scoring and risk assessment
What this requires you to do
10 obligations identified from statutory analysis.
325M.18
325M.15
325M.14, subd. 1(f)
325M.14, subd. 3
325M.16, subd. 2
Regulation summaries are simplified for readability and may not capture every nuance of the underlying statute. Verify important details against primary sources linked on this page.
Enforcement and penalties
$7,500 per civil violation. Cure period expired January 31, 2026. AG no longer required to provide warning or opportunity to cure before enforcement. AG-only enforcement. No private right of action.
Penalty amounts are based on statutory text and may be subject to adjustment, judicial interpretation, or enforcement discretion.
Related regulations
Minnesota AI regulation guide lists every tracked rule for this jurisdiction with timelines and obligation tallies.
Regulation summaries are simplified for readability and may not capture every nuance of the underlying statute. Verify important details against primary sources linked on this page.