Regulations › US states › Iowa
ICDPA
Iowa Consumer Data Protection Act
WhenIn effect since 1 January 2025
Who enforces itState Attorney General
Who it applies toBusinesses that process personal data of the state's residents above the law's thresholds. Thresholds, exemptions and sensitive-data rules differ by state.
Thresholds100,000 Iowa consumers, or 25,000 consumers plus over 50% of gross revenue from selling person…
Universal opt-outNo universal opt-out requirement
Cure periodPermanent 90-day cure period after written AG notice
Request deadline90 days, extendable once by 45 days with notice
Maximum penaltyUp to $7,500 per violation plus injunction
Private actionNo private right of action
Recent developments
Nothing reported yet. Regulatory Watch lists new rules, enforcement and court decisions as they arrive.
Regulations library
Every US state privacy law, on one map
24 states have a comprehensive privacy law in the library, alongside the EU, UK, US federal and global laws: 102 in all, each explained in plain words with its sources. Select a state to see what applies there.
- In force
- Coming into force
- Sector laws