Comprehensive state privacy law
Iowa privacy law
Iowa Consumer Data Protection Act (Iowa Code chapter 715D)
Law as of October 28, 2026 Reviewed by Sergio Maldonado Elvira on 29 October 2026
- Citation
- Iowa Code §§ 715D.1 to 715D.9
- Official text
- https://www.legis.iowa.gov/docs/code/715D.pdf
- Enacted
- March 28, 2023. 2023 Iowa Acts ch. 17 (SF 262)
- In force
- January 1, 2025
- Effective dates
- January 1, 2025: all provisions (2023 Iowa Acts ch. 17, § 10)
- Enforcer
- Attorney General (exclusive)
- Private right of action
- No. No private right of action under the chapter or any other law (§ 715D.8(4)).
- Cure period
- 90 days. Before suing, the Attorney General must give 90 days' written notice; no action follows if the business cures and gives an express written statement that the violations are cured and will not recur. The cure period is permanent. (§ 715D.8(2))
- Rulemaking
- No. The chapter gives no rulemaking power.
Amendments
No amendments recorded.
Topics
- ApplicabilityThe chapter applies to persons doing business in Iowa or targeting Iowa consumers that, in a calendar year, handle personal data of at least 100,000 consumers, or at least 25,000 while earning more than 50% of gross revenue from selling personal data. Government, financial institutions and GLBA data, persons subject to and complying with HIPAA, nonprofits and higher education institutions are exempt as entities.
- Consumer rightsConsumers may confirm and access, delete data they provided, obtain a portable copy, and opt out of sale. Iowa gives no right to correct and no opt-out of targeted advertising or profiling. Controllers have 90 days to respond, extendable once by 45 days, and must decide appeals within 60 days.
- Sensitive dataIowa uses an opt-out model: sensitive data may be processed for a non-exempt purpose only after clear notice and an opportunity to opt out. Data of a known child (under 13) must be processed under COPPA. There is no separate teen rule.
- Controller dutiesControllers must keep reasonable security, avoid discrimination, publish a privacy notice and disclose sales and targeted advertising with the way to opt out. Iowa has no data minimisation duty, no data protection assessment duty and no universal opt-out signal duty.
- ProcessorsProcessors must help the controller with consumer requests, security and breach notice. A contract must set out instructions, nature, purpose, data types, duration and the parties' rights and duties, and must require confidentiality, deletion or return, proof of compliance and written subcontracts. Iowa does not require assessment or audit terms.
- EnforcementThe Attorney General enforces the chapter exclusively after a permanent 90-day notice and cure period. Civil penalties are up to $7,500 per violation. There is no private right of action.
Sources
Law as of October 28, 2026.
Reviewed by Sergio Maldonado Elvira on 29 October 2026. Prepared from the official sources listed.
Official text of the Iowa statute
Reference material, not legal advice.