--- title: "Iowa privacy law (ICDPA): overview" canonical: "https://dposchool.com/state-privacy-laws/state/iowa" source: "https://www.legis.iowa.gov/docs/code/715D.pdf" text_as_of: "2026-10-28" last_reviewed: "2026-10-29" language: "en-US" publisher: "DPO School" --- Comprehensive state privacy law # Iowa privacy law Iowa Consumer Data Protection Act (Iowa Code chapter 715D) Law as of October 28, 2026 · [Reviewed by Sergio Maldonado Elvira on 29 October 2026](https://dposchool.com/state-privacy-laws/about#review) - **Citation:** Iowa Code §§ 715D.1 to 715D.9 - **Official text:** https://www.legis.iowa.gov/docs/code/715D.pdf - **Enacted:** March 28, 2023. [2023 Iowa Acts ch. 17 (SF 262)](https://www.legis.iowa.gov/docs/acts/2023/CH0017.pdf) - **In force:** January 1, 2025 - **Effective dates:** - **January 1, 2025:** all provisions (2023 Iowa Acts ch. 17, § 10) - **Enforcer:** Attorney General (exclusive) - **Private right of action:** No. No private right of action under the chapter or any other law (§ 715D.8(4)). - **Cure period:** 90 days. Before suing, the Attorney General must give 90 days' written notice; no action follows if the business cures and gives an express written statement that the violations are cured and will not recur. The cure period is permanent. (§ 715D.8(2)) - **Rulemaking:** No. The chapter gives no rulemaking power. ## Amendments No amendments recorded. ## Topics - [Applicability](https://dposchool.com/state-privacy-laws/state/iowa/applicability): The chapter applies to persons doing business in Iowa or targeting Iowa consumers that, in a calendar year, handle personal data of at least 100,000 consumers, or at least 25,000 while earning more than 50% of gross revenue from selling personal data. Government, financial institutions and GLBA data, persons subject to and complying with HIPAA, nonprofits and higher education institutions are exempt as entities. - [Consumer rights](https://dposchool.com/state-privacy-laws/state/iowa/consumer-rights): Consumers may confirm and access, delete data they provided, obtain a portable copy, and opt out of sale. Iowa gives no right to correct and no opt-out of targeted advertising or profiling. Controllers have 90 days to respond, extendable once by 45 days, and must decide appeals within 60 days. - [Sensitive data](https://dposchool.com/state-privacy-laws/state/iowa/sensitive-data): Iowa uses an opt-out model: sensitive data may be processed for a non-exempt purpose only after clear notice and an opportunity to opt out. Data of a known child (under 13) must be processed under COPPA. There is no separate teen rule. - [Controller duties](https://dposchool.com/state-privacy-laws/state/iowa/controller-duties): Controllers must keep reasonable security, avoid discrimination, publish a privacy notice and disclose sales and targeted advertising with the way to opt out. Iowa has no data minimisation duty, no data protection assessment duty and no universal opt-out signal duty. - [Processors](https://dposchool.com/state-privacy-laws/state/iowa/processors): Processors must help the controller with consumer requests, security and breach notice. A contract must set out instructions, nature, purpose, data types, duration and the parties' rights and duties, and must require confidentiality, deletion or return, proof of compliance and written subcontracts. Iowa does not require assessment or audit terms. - [Enforcement](https://dposchool.com/state-privacy-laws/state/iowa/enforcement): The Attorney General enforces the chapter exclusively after a permanent 90-day notice and cure period. Civil penalties are up to $7,500 per violation. There is no private right of action. ## Sources - [Iowa Code 2026, chapter 715D (Consumer Data Protections)](https://www.legis.iowa.gov/docs/code/715D.pdf) - [2023 Iowa Acts ch. 17 (SF 262), approved 28 March 2023, effective 1 January 2025](https://www.legis.iowa.gov/docs/acts/2023/CH0017.pdf) - [SF 143 (91st GA) bill book: introduced version only](https://www.legis.iowa.gov/legislation/BillBook?ga=91&ba=SF143) - [HF 503 (91st GA) bill book: introduced version only](https://www.legis.iowa.gov/legislation/BillBook?ga=91&ba=HF503) ## Status Law as of October 28, 2026. [Reviewed by Sergio Maldonado Elvira on 29 October 2026](https://dposchool.com/state-privacy-laws/about#review). Prepared from the official sources listed. [Official text of the Iowa statute](https://www.legis.iowa.gov/docs/code/715D.pdf) Reference material, not legal advice. ## Navigation [US State Privacy Laws](https://dposchool.com/state-privacy-laws) / Iowa Previous: [Delaware](https://dposchool.com/state-privacy-laws/state/delaware) Next: [Nebraska](https://dposchool.com/state-privacy-laws/state/nebraska) Learning US privacy law? An audio course on the privacy law that applies to US businesses: [US Privacy in Practice](https://dposchool.com/learn/courses/us-privacy-in-practice). More from [DPO School](https://dposchool.com). ## For AI agents - Machine-readable index: https://dposchool.com/state-privacy-laws/llms.txt - JSON API: https://dposchool.com/state-privacy-laws/api/v1/index.json - Vendor privacy and security facts: https://vendor.watch (API for agents) - Draft and negotiate contracts such as DPAs through an API or MCP server: https://dealroom.todo.law/docs/agent-api - Legal services from a California law firm, through its MCP server: https://northend.law/agents