Regulations › US states › Iowa
ICDPA
Iowa Consumer Data Protection Act
WhenIn effect since 1 January 2025
Who enforces itState Attorney General
Who it applies toBusinesses that process personal data of the state's residents above the law's thresholds. Thresholds, exemptions and sensitive-data rules differ by state.
Thresholds100,000 Iowa consumers, or 25,000 consumers plus over 50% of gross revenue from selling person…
Universal opt-outNo universal opt-out requirement
Cure periodPermanent 90-day cure period after written AG notice
Request deadline90 days, extendable once by 45 days with notice
Maximum penaltyUp to $7,500 per violation plus injunction
Private actionNo private right of action
Every requirement we score, with the rule in plain words and the section it comes from. Darker means more demanding. See every law side by side →
Who it covers
Thresholds
1
100,000 Iowa consumers, or 25,000 consumers plus over 50% of gross revenue from selling personal data.Iowa Code § 715D.2(1) · source ↗
Exemptions
0
Entity-level exemptions for GLBA financial institutions, HIPAA covered entities, nonprofits, higher education and government, plus data-level carve-outs.Iowa Code § 715D.2(2)-(3) · source ↗
Sensitive data and minors
Sensitive data
0
Sensitive data may be processed after clear notice and an opportunity to opt out; no opt-in consent.Iowa Code §§ 715D.1(26), 715D.4(2) · source ↗
Children and teens
1
Child means under 13; known child's sensitive data must be processed per COPPA. No teen protections.Iowa Code §§ 715D.1(5), 715D.4(2) · source ↗
Data minimization
0
No general minimization standard; only exempt-purpose processing must be limited to what is necessary.Iowa Code § 715D.7(6)(b) · source ↗
Consumers' rights
Rights
0
Access, delete (data provided by consumer), portability, opt out of sale (4 rights). No correction or targeted ad opt-out.Iowa Code § 715D.3(1) · source ↗
Request deadline
1
90 days, extendable once by 45 days with notice.Iowa Code § 715D.3(2)(a) · source ↗
Appeals
2
Internal appeal decided within 60 days; denial must include online way to complain to the Attorney General.Iowa Code § 715D.3(3) · source ↗
Business duties
Processor contracts
1
Contract sets instructions, data, duration, confidentiality, deletion and compliance information; subcontractors bound in writing. No audit or assessment right.Iowa Code § 715D.5(2) · source ↗
Privacy notice
1
Notice of categories, purposes, rights and appeal, data shared and third-party categories; disclose sale and targeted ads with opt-out method.Iowa Code § 715D.4(5)-(6) · source ↗
Loyalty programs
1
Different prices allowed for bona fide loyalty, rewards, premium, discount or club card programs.Iowa Code § 715D.4(3) · source ↗
De-identified data
2
No duty to reidentify; pseudonymous data exempt from rights with separation; oversight of contracts on disclosed data. No public commitment duty.Iowa Code §§ 715D.1(10), (23), 715D.6 · source ↗
Enforcement
Who enforces
1
Attorney General has exclusive enforcement authority, including civil investigative demands.Iowa Code § 715D.8(1) · source ↗
Scores are our reading on the published rubric, checked 18 October 2026. Not legal advice.
Regulations library
Every US state privacy law, on one map
24 states have a comprehensive privacy law in the library, alongside the EU, UK, US federal and global laws: 102 in all, each explained in plain words with its sources. Select a state to see what applies there.
- In force
- Coming into force
- Sector laws