ICDPA

Iowa Consumer Data Protection Act

In force privacy consumer rights

WhenIn effect since 1 January 2025

Who enforces itState Attorney General

Who it applies toBusinesses that process personal data of the state's residents above the law's thresholds. Thresholds, exemptions and sensitive-data rules differ by state.

Thresholds100,000 Iowa consumers, or 25,000 consumers plus over 50% of gross revenue from selling person… Universal opt-outNo universal opt-out requirement Cure periodPermanent 90-day cure period after written AG notice Request deadline90 days, extendable once by 45 days with notice Maximum penaltyUp to $7,500 per violation plus injunction Private actionNo private right of action

89%

of Iowa's 19 requirements are already met by California (CA). Here is what ICDPA adds, biggest gaps first.

AppealsConsumers' rightsBig gap

CA0 No statutory appeal process for denied requests.

ICDPA adds2 Internal appeal decided within 60 days; denial must include online way to complain to the Attorney General. Iowa Code § 715D.3(3) · source ↗

ThresholdsWho it coversGap

CA0 For-profit businesses with gross revenue over $26,625,000 (2025 adjusted), or buying/selling/sharing data of 100,000+ consumers or households, or 50%+ revenue from selling/sharing.

ICDPA adds1 100,000 Iowa consumers, or 25,000 consumers plus over 50% of gross revenue from selling personal data. Iowa Code § 715D.2(1) · source ↗

Already covered by CA: Exemptions, Sensitive data, Children and teens, Data minimization, Rights, Request deadline, Universal opt-out, Assessments, Processor contracts, Privacy notice, Loyalty programs, De-identified data, Who enforces, Cure period, Maximum penalty, Private action, Rulemaking.

A gap means ICDPA is more demanding than CA on that requirement, on our 0 to 3 scale (how we score). Read the cited section before acting. Not legal advice.

Regulations library

Every US state privacy law, on one map

24 states have a comprehensive privacy law in the library, alongside the EU, UK, US federal and global laws: 102 in all, each explained in plain words with its sources. Select a state to see what applies there.

Explore the map Follow Regulatory Watch

In force
Coming into force
Sector laws

AK ME VT NH WA ID MT ND MN IL WI MI NY RI MA OR NV WY SD IA IN OH PA NJ CT CA UT CO NE MO KY WV VA MD DE AZ NM KS AR TN NC SC DC OK LA MS AL GA HI TX FL