← ALL REGULATIONS
Minnesota Consumer Data Privacy Act cookie rules, and the GPC signal.
Minnesota lets sites set advertising cookies without opt-in consent, but consumers must be able to opt out of targeted advertising, the sale of their data and some profiling. Since the Act took effect on 31 July 2025, an opt-out preference signal such as Global Privacy Control (GPC) has to be honoured as an opt-out of targeted advertising and sale.
MCDPA at a glanceOpt-out, opt-in for some data
- Applies to
- Controllers handling data of 100,000+ Minnesota residents a year (not counting payment-only data), or 25,000+ while earning over 25% of revenue from selling it
- In force
- 31 July 2025, and for postsecondary institutions from July 2029
- Enforced by
- Minnesota Attorney General
- Penalties
- Up to $7,500 per violation, plus injunctions; the 30-day cure period ended on 31 January 2026
WHAT MCDPA REQUIRES
What Minnesota asks of a site that uses advertising cookies.
THE RULEHonour opt-out preference signalsControllers must let consumers opt out of targeted advertising and sale through an opt-out preference signal, and recognising signals approved under other states’ laws counts as compliance.
WITH KATLAKatla honours Global Privacy Control: a visitor whose browser sends it is recorded as opted out, unless they have already made a choice.
THE RULEA clear opt-out, outside the privacy noticeA controller that sells data or uses it for targeted advertising must offer a clear and conspicuous way to opt out outside the privacy notice, such as a link labelled "Your Opt-Out Rights" or "Your Privacy Rights".
WITH KATLAIn US State Laws (CCPA) mode, the banner’s main button is "Do Not Sell or Share My Personal Information", and the marketing category is labelled as the sale or sharing of personal information. The wording follows California’s law; there is no Minnesota-specific label.
THE RULEConsent for sensitive data and for teenagersProcessing sensitive data needs consent, and so does targeted advertising or selling the data of a consumer the controller knows is between 13 and 16.
WITH KATLAKatla has no age-specific flow, and its categories describe what cookies are for, not which data types they carry. A site that processes sensitive data or serves teenagers can run Katla in GDPR mode, so nothing non-essential is set before an opt-in.
THE RULEThe right to question profilingConsumers can question the result of profiling behind a significant decision and be told why it was reached, and if it rested on inaccurate data, have it reconsidered on corrected data. They can also ask for the specific third parties that received their data.
WITH KATLAProfiling decisions and consumer requests are outside what a consent tool does.
THE RULEDocumented policies and a data inventoryControllers must document their privacy policies and procedures, keep an inventory of the data they manage, and assess processing for targeted advertising, sale and sensitive data.
WITH KATLAKatla’s scan lists every cookie it finds with its domain and category. The inventory, the documentation and the assessments are outside what a consent tool does.
MCDPA questions, answered
A summary for website owners, not legal advice. Reviewed against the sources below.
- Is Global Privacy Control mandatory in Minnesota?
- Controllers must honour opt-out preference signals for targeted advertising and sale, and the Act treats recognising signals approved under other states’ laws, such as Global Privacy Control, as compliance.
- What is unusual about Minnesota’s law?
- Consumers can question a profiling decision and have it reconsidered if it rested on inaccurate data, and ask for the specific third parties that received their data. Controllers must keep a data inventory and documented privacy policies, and publish the privacy notice in each language in which they offer the product or service.
- Is there still a cure period?
- No. Until 31 January 2026 the Attorney General had to send a warning letter and allow 30 days to cure before suing; that provision has expired.
- Does it apply to small businesses?
- Small businesses as the US Small Business Administration defines them are exempt, except that they may not sell sensitive data without the consumer’s prior consent.
- How does Katla treat Minnesota visitors?
- Auto mode reads the visitor’s timezone, and US timezones get the CCPA banner with its opt-out and GPC handling. You can also set the site to US State Laws (CCPA) mode for everyone.
See what your site sets before anyone asks.
The free plan scans your site, classifies every cookie and generates the policy, without a card. The cookie checker needs no account at all.