Is Minnesota's Data Privacy Law Cure Period Still Available in 2026?

No. The 30-day cure period under the Minnesota Consumer Data Privacy Act (MCDPA) expired January 31, 2026, and the state Attorney General's office confirmed on February 5, 2026 that the grace period is over. Any violation flagged after that date can now draw an enforcement action without a chance to fix it first.

What the Cure Period Used to Require

Before January 31, 2026, the MCDPA required Minnesota's Attorney General to send a business a warning letter and give it 30 days to correct a violation before pursuing penalties. That mandatory notice-and-cure step only applied through that date — the statute built in a sunset clause rather than making the cure period permanent, unlike Indiana's otherwise similar framework.

The AG Was Already Watching Closely

By the time the cure period lapsed, the Attorney General's office had logged more than 200 complaints and sent dozens of warning letters, many involving businesses that failed to honor browser-based opt-out signals for targeted advertising. That detail matters specifically for marketers: Minnesota's law lets residents opt out of targeted advertising, data sales, and certain profiling, and it requires businesses to honor universal opt-out preference signals sent through the browser rather than making users opt out site by site.

What Hasn't Changed

The MCDPA still has no private right of action — only the Attorney General can bring an enforcement case, and violations can still draw penalties of up to $7,500 per violation. What changed is the notice step before that: without a mandatory cure period, the AG can now move straight to enforcement rather than first giving a business 30 days to fix a flagged problem.

Who's Covered

The law took effect July 31, 2025, and applies to businesses that annually process personal data of at least 100,000 Minnesota consumers, or at least 25,000 consumers while deriving more than 25% of gross revenue from selling personal data. A later compliance date of July 31, 2029 applies to certain postsecondary institutions regulated by Minnesota's Office of Higher Education, but that carve-out doesn't extend to ordinary advertisers.

Required Risk Assessments Didn't Go Away Either

Separately from the cure period, the MCDPA requires controllers to conduct data protection assessments for processing activities that present a heightened risk to consumers, including targeted advertising, the sale of personal data, and certain profiling. Those assessment obligations were never tied to the cure period's sunset date, so they've applied continuously since the law's July 2025 effective date and remain a distinct compliance requirement from the opt-out mechanics discussed above.

Why This Matters More Than the Effective Date Alone

A law's effective date tells you when consumer rights start. The cure period's expiration tells you when the Attorney General actually starts treating violations as enforcement targets rather than warnings — and for Minnesota, that shift already happened in early 2026, with opt-out-signal compliance specifically named as a focus area in the AG's own complaint data.

Bottom Line

If you run targeted advertising reaching Minnesota consumers, confirm your site honors Global Privacy Control or an equivalent opt-out signal now — as of February 2026, Minnesota's Attorney General is enforcing MCDPA violations without issuing a warning first.

Sources: Minnesota Attorney General's Office, cure-period expiration announcement (February 5, 2026), as reported by Virima; Securiti.ai, Minnesota Consumer Data Privacy Act (MNCDPA) regulatory assessment; DWT State Privacy Law Tracker, Minnesota entry.