Compliance Briefing — August 1, 2025
Minnesota’s Consumer Data Privacy Act has been in force since 31 July 2025, leaving only days to lock down universal opt-out signals, heightened protections for teens, and data protection assessments across high-risk processing.
Executive briefing: Minnesota’s Consumer Data Privacy Act (HF 4757) took effect on 31 July 2025 for businesses processing data on 100,000 Minnesotans or 25,000 when monetizing personal data. Controllers now face enforcement by the Attorney General for failing to honor universal opt-out mechanisms, for processing data on 13–15-year-olds without express consent, or for operating in-scope profiling without risk assessments.
Key compliance checkpoints
- Universal opt-out signals. Deploy detection for Global Privacy Control and other recognized signals, documenting how browser instructions cascade through consent platforms, advertising stacks, and downstream processors.
- Teen consent governance. Extend age gating and consent recordkeeping to cover 13–15-year-old consumers, aligning identity verification with HF 4757 §6 while demonstrating parental consent is not repurposed for unrelated processing.
- Data protection assessments. Inventory high-risk processing—targeted ads, sensitive data use, profiling producing legal effects—and retain assessments available to the Attorney General for investigations within 45 days.
Operational priorities
- Vendor contract refresh. Amend processor agreements with Minnesota-specific clauses on confidentiality, data deletion, and subcontractor approvals to satisfy §8.
- Response SLAs. Tune intake workflows so access, deletion, correction, and opt-out requests are fulfilled within the 45-day window (plus one extension) and maintain denial logs for appeals.
- Training sprints. Brief customer support, growth, and engineering staff on Minnesota-only nuances—especially teen consent gates and prohibitions on dark patterns—before peak back-to-school demand.
Enablement moves
- Launch a Minnesota-specific privacy notice addendum clarifying sensitive data categories (racial origin, biometric, precise geolocation) that require opt-in consent.
- Schedule quarterly readiness reviews to refresh data protection assessments as machine-learning features or targeting audiences evolve.
Sources
- Minnesota HF 4757 (2024) — Consumer Data Privacy Act
- Minnesota Attorney General briefing on the Consumer Data Privacy Act
Zeph Tech builds Minnesota-ready consent flows, assessment templates, and fulfillment dashboards to withstand Attorney General audits.