Minnesota Joins Growing Privacy Law Movement as CPPA Continues Data Broker Crackdown

Want to receive these privacy recaps in your inbox each week? Subscribe here.

United States

Minnesota Comprehensive Privacy Law Takes Force

On July 31, 2025, Minnesota became the 16th state with a comprehensive privacy law (the Minnesota Consumer Data Privacy Act ) in effect. Maryland will be the 17th state in October 2025, and three more states (Indiana, Kentucky and Rhode Island) will follow suit January 1, 2026, bringing the total to 20.

TAKEAWAY

The Minnesota Consumer Data Privacy Act primarily borrows various elements from other state laws. Minnesota is the second state (after Oregon) to give customers the right to request from controllers a list of specific third parties (as opposed to categories of third parties) to which personal data has been disclosed. The law also adopts several requirements from California, Colorado and Connecticut laws. However, in addition to provisions adopted from other states, the  Minnesota  law also creates some new requirements, including, most notably, requirements to maintain “an inventory of the data” that is processed and a “description of the policies and procedures” that the controller has adopted to comply with the law. 

CPPA Fines Another Data Broker for Failing to Register

The California Privacy Protection Agency (CPPA) announced its issuance of a $55,400 fine, plus attorneys’ fees and costs, against Accurate Append, Inc., a company that aids its business customers in building contact lists and enriching consumer profiles. The fine was part of an investigative sweep of unregistered data brokers that has led to several other enforcement actions in 2024 and 2025.

TAKEAWAY

The Delete Act currently only requires that data brokers (businesses that collect or sell the data of consumers with whom the business does not have a direct relationship) register with the CPPA, pay an annual fee, and comply with certain reporting requirements. However, beginning in August 2026, data brokers will also be required to process consumer deletion requests submitted to a central mechanism maintained by the CPPA. Although not yet finalized, a second public comment period for draft regulations governing such mechanism was opened by the CPPA July 31 2025 and will accept comments through August 18, 2025. 

A LITTLE MORE PRIVACY, IF YOU PLEASE

• ICO Publishes Draft Guide for Profiling Tools

A Little Privacy, Please weekly recaps are provided for general, informational purposes only, do not constitute legal advice, and should not be relied upon for legal decision-making. Please consult an attorney to determine how legal updates may impact you or your business.