Law / United States / 
Minnesota
Minnesota Consumer Data Privacy Act, Attorney General enforcement
In force since .
An enforcement supervision rule binding private bodies.
- Private right of action
- No
- Audit expectation
- none
What it requires
- Expect MCDPA violations to be enforced exclusively by the Minnesota Attorney General, never by a private plaintiff, including under § 8.31's general private-attorney-general mechanism.
- Do not rely on a warning letter or cure opportunity before an enforcement action. Minnesota's discretionary 30-day cure mechanism expired .
These lines are LexLint's reading of the law's text. Also read by: Office of the Minnesota Attorney General (guidance, recorded ).
Who enforces it
Settledness
- As of
- Guidance link
- https://www.ag.state.mn.us/Data-Privacy/Business/Controller/Enforcement.asp
- Guidance body
- Office of the Minnesota Attorney General
- Open questions
- Does 'each violation' in Minn. Stat. 325M.20(c) count each affected consumer, each unanswered request or each unlawful processing practice when the Attorney General seeks a civil penalty of not more than $7,500?
What it makes you log
Logging duty
Section 325M.20 sets the Attorney General's enforcement powers (a civil action under section 8.31, an injunction, a civil penalty of up to $7,500 per violation, and no private right of action) and imposes no record duty. The Act's records sit in other sections this row does not cite: records of appeals kept 24 months (325M.14, subd. 5(d)) and the Attorney General's power to demand a data privacy and protection assessment by civil investigative demand (325M.18(f)). The section has no scope clause of its own.
- Kind
- None
- As of
What this law does
The Minnesota Attorney General may bring a civil action to enforce MCDPA under the general false-advertising and consumer-protection statute, Minn. Stat. § 8.31, with a civil penalty of up to $7,500 per violation plus litigation costs and injunctive relief. MCDPA expressly bars any private right of action, including one brought under § 8.31's own private-attorney-general provision.
A discretionary warning-letter and 30-day cure opportunity existed but has already sunset, expiring ; the Attorney General may now sue directly without first offering a cure window.
When LexLint raises it
When your app profile says your app processes personal data.
Back to the example · Lint your app
Page updated .