Minnesota's mandatory 30-day right-to-cure period under its Consumer Data Privacy Act expires January 31, 2026, according to the statute's enforcement provisions in Minnesota Statutes chapter 325O. Maryland's privacy law takes a different 2026 turn entirely: its Online Data Privacy Act does not lose a cure period this year, but a separate law, HB 711, adds a new government-data-sale restriction on July 1, 2026. Both states passed comprehensive privacy laws in 2024 and turned them on in 2025, and both now have a real, dated 2026 event that changes what a business needs to track.
What changes for Minnesota businesses in 2026?
Minnesota's Consumer Data Privacy Act, in effect since July 31, 2025, gave businesses a mandatory 30-day window to fix a flagged violation before the Attorney General could bring an enforcement action. That mandatory window expires January 31, 2026. Section 325O.10 requires the Attorney General to send a warning letter before filing a civil action, but once the 30-day cure provision sunsets, offering a business time to cure becomes discretionary rather than guaranteed.
Figure 1: Minnesota's standard threshold is nearly 3x Maryland's, though both laws add a lower small-business prong tied to a share of revenue from data sales. Source: Minnesota Senate Counsel, Research and Fiscal Analysis, S.F. 2915 Summary (2024); Maryland Code, Commercial Law Title 14, Subtitle 46, Section 14-4602.
Once the cure period sunsets, a violation can draw a civil penalty of up to $7,500, and the Attorney General holds exclusive enforcement authority. There is no private right of action under Minnesota's law, so consumers cannot sue directly over a violation. A business that has been relying on a guaranteed 30-day fix-it window should treat February 1, 2026, as the date that safety net disappears, not the date a new obligation begins. Keeping a privacy policy generator current on Minnesota's sensitive-data and opt-out disclosures matters more once the automatic cure period is gone, since there is no longer a guaranteed second chance before an enforcement letter turns into a filed action.
What changes for Maryland businesses in 2026?
Maryland's Online Data Privacy Act took effect October 1, 2025, but the state's next dated privacy change is not about that law's own cure period. HB 711, now Chapter 874 of the 2026 Regular Session, takes effect July 1, 2026, and bars a controller from knowingly selling personal data to a government unit that has engaged in or supported civil immigration enforcement in the preceding six months. For the full mechanics of that provision, see our breakdown of Maryland's data-sale ban.
Figure 2: Minnesota's cure-period change and Maryland's data-sale ban land in the same year, but they are unrelated mechanisms with different dates. Source: Minnesota Senate Counsel S.F. 2915 Summary (2024); Maryland General Assembly, HB 711 and SB 541 bill pages.
It is worth separating the two Maryland stories clearly, because they are easy to conflate. The Online Data Privacy Act's own discretionary 60-day cure period, granted at the Attorney General's option under Section 14-4614, is available for violations through April 1, 2027, not 2026. Nothing about that cure mechanism changes this year. What actually changes in 2026 is the narrower HB 711 restriction, which adds a new category of prohibited sale rather than touching the base law's enforcement timeline at all.
Minnesota's cure period, step by step
Figure 3: The mandatory cure step disappears from Minnesota's enforcement path after January 31, 2026, though a discretionary cure offer can still happen. Source: Minn. Stat. ch. 325O, Section 325O.10, as summarized in industry compliance trackers Usercentrics and Termageddon.
That structural change does not affect what Minnesota's law requires day to day, only what happens after a violation is caught. Businesses that already treat the 30-day letter as their real compliance deadline, rather than as a grace period, will not notice much difference. Businesses that have been quietly relying on getting a warning first will.
How do Minnesota's and Maryland's penalties compare?
Maryland's civil penalties run higher than Minnesota's on paper, though Maryland's cure period stays available for another year past Minnesota's sunset date, which changes how quickly either penalty structure is actually reached in practice.
Figure 4: Maryland's repeat-violation cap is more than 3x Minnesota's flat penalty. Source: Maryland Code, Commercial Law Title 14, Section 13-410; Minn. Stat. ch. 325O, Section 325O.10, per compliance trackers Usercentrics and Termageddon.
| Provision | Minnesota (MCDPA) | Maryland (MODPA) |
|---|---|---|
| Effective date | July 31, 2025 | October 1, 2025 |
| Standard threshold | 100,000 residents | 35,000 consumers |
| Small-business prong | 25,000 residents + over 25% of revenue from data sales | 10,000 consumers + over 20% of revenue from data sales |
| Mandatory cure period ends | January 31, 2026 | Not mandatory; discretionary cure available through April 1, 2027 |
| Maximum civil penalty | $7,500 per violation | $10,000 first violation, $25,000 per repeat violation |
Source: Minnesota Senate Counsel S.F. 2915 Summary (2024); Maryland General Assembly SB 541 (Chapter 455) bill page; Maryland Code Title 14, Subtitle 46.
How do the two laws protect minors differently?
Minnesota and Maryland both single out minors' data for extra protection, but they draw the line differently. Minnesota classifies all personal data belonging to a consumer under 13 as sensitive data outright, requiring explicit consent before it can be processed, and separately requires opt-in consent before a consumer aged 13 to 16 can be targeted with advertising or have their data sold. Maryland skips the two-tier age split and instead bars targeted advertising and data sale for any consumer a controller "knew or should have known" was under 18, per Section 14-4607(a) of its code, a standard that reaches broader than the "actual knowledge" test most other state privacy laws use.
Figure 5: Minnesota's law reaches more businesses by consumer count, while Maryland's minors rule reaches further by age. PrivacyTerms.io placement based on each law's own thresholds and age-cutoff language; not a published third-party index.
Maryland's "knew or should have known" standard also pairs with an unusually strict sensitive-data rule: sensitive data cannot be sold under any circumstances, and can only be collected or processed when strictly necessary for the product or service a consumer actually requested, per Section 14-4607(a) and (b). Minnesota's sensitive-data consent requirement is closer to the more common state-law pattern, covering categories like racial or ethnic origin, health diagnoses, sexual orientation, and precise geolocation, with consent required rather than an outright sale ban.
Where do Minnesota and Maryland rank among US state privacy laws?
Minnesota and Maryland were the 16th and 17th states to reach an effective date among the states with a comprehensive consumer privacy law, arriving in the middle of a national wave that has continued into 2026. For the complete state-by-state list, see our US state privacy law tracker, and for the current national count, our breakdown of how many US states have a privacy law in 2026.
Figure 6: Minnesota and Maryland's 2025 effective dates landed inside the steepest stretch of national growth. Source: IAPP US State Privacy Legislation Tracker, as compiled in PrivacyTerms.io's US state privacy law tracker.
Neither state was first to pass a comprehensive privacy law, and neither is the strictest across every category. Maryland's sensitive-data sale ban and broader minors standard are stricter than most states' laws on those two points specifically, while Minnesota's higher 100,000-consumer threshold means it reaches fewer small and mid-size businesses than Maryland's lower 35,000-consumer floor does. For a wider view of which state laws might apply to a given business, our decision guide to state privacy law applicability walks through each threshold path state by state. Other states' laws have picked up their own 2026 amendments around the same period, including new minors' data rules in Connecticut, Arkansas, and Utah, so Minnesota's and Maryland's changes are part of a wider pattern rather than an isolated event.
The Bottom Line
Minnesota and Maryland both have a real, dated 2026 change, but they are different kinds of change happening for different reasons. Minnesota's is a built-in sunset clause: the 30-day mandatory cure period that has cushioned early enforcement disappears January 31, 2026, converting the state's warning-letter-first approach into a discretionary one. Maryland's is a new, narrower law layered on top of an already-active one: HB 711 does not touch the Online Data Privacy Act's own enforcement mechanics, which keep their cure period through April 1, 2027, but it does add a new prohibited category of data sale starting July 1, 2026. A business tracking both states needs two separate calendar entries, not one, and neither date is when either law's coverage of ordinary data practices changes; the underlying disclosure and consent requirements of both laws are already fully in force.
Frequently Asked Questions
What changes for Minnesota businesses in 2026? Minnesota's mandatory 30-day right-to-cure period under the Consumer Data Privacy Act expires January 31, 2026, per Minnesota Statutes chapter 325O. After that date, the Attorney General can decide case by case whether to offer a business a chance to fix a violation before seeking civil penalties of up to 7,500 dollars per violation.
What changes for Maryland businesses in 2026? Maryland's HB 711 takes effect July 1, 2026, barring controllers from knowingly selling personal data to a government unit that has supported civil immigration enforcement in the preceding six months. The Online Data Privacy Act's own 60-day discretionary cure period, separately, runs through April 1, 2027.
How do Minnesota's and Maryland's privacy law thresholds compare? Minnesota's Consumer Data Privacy Act applies to businesses controlling data on 100,000 Minnesota residents, or 25,000 residents combined with deriving over 25% of gross revenue from data sales. Maryland's Online Data Privacy Act applies at a lower 35,000-consumer threshold, or 10,000 consumers combined with over 20% of gross revenue from data sales.
Do Minnesota and Maryland protect minors' data the same way? No. Minnesota classifies all data from consumers under 13 as sensitive and requires opt-in consent for targeted advertising or sale to consumers aged 13 to 16. Maryland bars targeted advertising and data sales for any consumer a business knew or should have known was under 18, a broader age-based standard than most state privacy laws use.
Where the Numbers Come From
- Minnesota Office of the Revisor of Statutes. Minnesota Statutes, Chapter 325O, Consumer Data Privacy Act.
- Minnesota Senate Counsel, Research and Fiscal Analysis. (2024). "S.F. No. 2915, Minnesota Consumer Data Privacy Act, Bill Summary." Applicability thresholds at Section 4 [325O.03] and Attorney General enforcement at Section 12 [325O.10].
- Maryland General Assembly. SB 541, Chapter 455, Maryland Online Data Privacy Act of 2024. Effective October 1, 2025.
- Maryland General Assembly. HB 711, Chapter 874, 2026 Regular Session. Effective July 1, 2026.
- Warner Norcross + Judd. (2025). "A Reminder: Maryland Online Data Privacy Act Has Become Effective This Week." Applicability thresholds, minors "knew or should have known" standard, and 60-day discretionary cure period through 2027.
- RecordingLaw.com. "What Is MODPA? Maryland Online Data Privacy Act." Statute citations for thresholds (Section 14-4602), minors and sensitive-data rules (Section 14-4607), cure period through April 1, 2027 (Section 14-4614), and civil penalties (Section 13-410).
- Usercentrics. "Minnesota Consumer Data Privacy Act (MCDPA)." 30-day cure period sunset date and $7,500 civil penalty.
- Termageddon. "Minnesota Consumer Data Privacy Act: Key Dates and Thresholds." Cure period expiration date of January 31, 2026, cross-confirming Usercentrics.
Note: All figures verified as of August 2026. Minnesota's cure-period sunset date and civil penalty figure are drawn from two independent compliance trackers rather than the underlying session-law text directly; the base statute (Minn. Stat. ch. 325O) and its 2024 Senate Counsel summary confirm the applicability thresholds and general enforcement structure but do not themselves state the exact cure-period sunset date in the summary document reviewed for this post. These figures are refreshed at least twice a year and re-checked against any statutory amendment.
