Quick answer
If you live in Minnesota, you can ask covered companies to delete the personal information they have about you, and they must respond within 45 days. Send your request through the company's privacy form or privacy email, and keep a record of when you sent it.
Your rights under the MCDPA
The Minnesota Consumer Data Privacy Act (MCDPA) gives Minnesota residents the right to:
- Find out what personal information a company has about you
- Get a list of the specific companies it shared your information with
- Have it deleted
- Correct information that's wrong
- Get a copy of your data in a usable format
- Opt out of targeted advertising, the sale of your data, and certain kinds of profiling
- Question the result of an automated decision about you, learn why it was made, and ask for it to be reviewed
What makes Minnesota's law stand out
Minnesota was the first state to give people the right to question automated decisions. If a company's system makes a significant decision about you, such as on housing, insurance, or employment, you can ask why, review the data it used, and ask for the decision to be reconsidered.
Like Oregon, Minnesota also lets you ask for the names of the specific companies your data was shared with, not just general categories.
Which companies have to comply
Companies doing business in Minnesota that handle the personal information of at least 100,000 Minnesota residents a year (not counting information used only to process a payment), or at least 25,000 residents if they make more than 25% of their revenue from selling personal information.
That covers most large retailers, streaming services, apps, and online platforms, but not every small business. Certain health, financial, credit-reporting, and other regulated information is exempt when it's covered by specified federal or state laws, and companies can keep data they're legally required to retain.
How to ask a company to delete your data
- Find the company's privacy policy, usually linked at the bottom of its website. Look for a privacy request form or a privacy email address.
- Ask the company to delete your personal information, and say that you're a Minnesota resident making the request under the MCDPA.
- Expect the company to verify your identity, often by email. That's normal, and it protects you from someone else deleting or requesting your data.
- Write down the date you sent the request. You'll need it if the company misses its deadline.
How long companies have to respond
Companies must respond within 45 days. They can take up to 45 more days when reasonably necessary, as long as they tell you.
If a company ignores or refuses your request
If a company refuses your request, it has to offer a way to appeal. If the appeal is denied too, you can file a complaint with the Minnesota Attorney General.
Make your requests in minutes, not evenings
The hard part isn't the law. It's knowing which companies have your data and writing to each one. DataTrail scans your inbox (read-only) to find every company that has your email address, writes a deletion request that cites the MCDPA, and tracks the 45-day deadline for you. You review each one and send it from your own email.
Join the waitlistEnforced by the Minnesota Attorney General. This page is general information, not legal advice, and laws change. For the official text, see Minnesota's state legislature or Attorney General website.