Privacy Law Library

Iowa Consumer Data Protection Act (Consumer Data Protections)

ICDPA

Comprehensive privacy · Children · Biometric · Genetic · Location · Data security

Iowa's comprehensive consumer privacy law gives Iowa residents the right to confirm and access their personal data, delete data they provided, obtain a portable copy, and opt out of the sale of personal data. It requires notice and an opportunity to opt out before processing sensitive data (and COPPA-compliant processing for a known child's data), rather than opt-in consent. It has no right to correct, no data protection assessments, and a 90-day cure period enforced only by the Attorney General.

Where

Iowa

Citation

Iowa Code ch. 715D (715D.1 to 715D.9)

Status

In force

In force since

2025-01-01

Enforced by

Iowa Attorney General (exclusive authority, 715D.8(1))

People can sue

No

Penalties

After a 90-day written notice and cure period (no sunset), the Attorney General may seek an injunction and civil penalties of up to $7,500 per violation (715D.8(2)-(3)). No private right of action (715D.8(4)).

Applies to

• Persons conducting business in Iowa or producing products or services targeted to Iowa residents that, in a calendar year, control or process personal data of at least 100,000 consumers, or of at least 25,000 consumers while deriving over 50% of gross revenue from the sale of personal data (715D.2(1))
• Processors acting on behalf of covered controllers (715D.5)
• Exempt entities: the state and political subdivisions, financial institutions and their affiliates and GLBA-covered data, HIPAA covered entities and business associates, nonprofit organizations, and institutions of higher education (715D.2(2))
• Exempt data includes PHI, FCRA-regulated activity, DPPA, FERPA and Farm Credit Act data, employment-context data, and data used in accordance with COPPA (715D.2(3))