The Minnesota Consumer Data Privacy Act, in force since July 31, 2025, reaches a site or platform that controls or processes the personal data of 100,000 or more Minnesota consumers in a year (not counting data handled only to complete a payment), or 25,000 or more while taking over 25% of its gross revenue from selling personal data. It is the first state law to require, outright, an inventory of the data a business manages. The cure period ended January 31, 2026; penalties reach $7,500 a violation.

One line for each kind of personal data the site holds: what it is, why it is held, where it is kept, who receives it, and how long it is kept. On an adult site much of it is sensitive data under the Act - a person's sex life or sexual orientation among it - and is processed only with the consumer's consent. A line no longer true is retired, with the day, not erased. The inventory is reviewed on a set cadence so it stays current.