DPO SchoolDPO School

Iowa Consumer Data Protection Act (Iowa Code chapter 715D)

Iowa privacy law (ICDPA): consumer rights

Law as of October 28, 2026 Reviewed by Sergio Maldonado Elvira on 29 October 2026

Summary (not the statute text)

Consumers may confirm and access, delete data they provided, obtain a portable copy, and opt out of sale. Iowa gives no right to correct and no opt-out of targeted advertising or profiling. Controllers have 90 days to respond, extendable once by 45 days, and must decide appeals within 60 days.

Key points

  1. Rights: confirm and access, delete data provided by the consumer, portable copy, and opt-out of sale.

    Section: § 715D.3(1)(a)-(d)

  2. No right to correct, and no opt-out of targeted advertising or profiling.

    Section: § 715D.3(1)

  3. The copy right excludes 'personal information' protected under the breach law (§ 715C.1).

    Section: § 715D.3(1)(c)

  4. Respond within 90 days; one 45-day extension when reasonably necessary, notified within the first 90 days with reasons.

    Section: § 715D.3(2)(a)

  5. Responses are free up to twice a year per consumer.

    Section: § 715D.3(2)(c)

  6. Appeals must be decided in writing within 60 days; if denied, the consumer must be given an online way to complain to the Attorney General.

    Section: § 715D.3(3)

Sources

Compare consumer rights across all states

Related GDPR articles

Related, not equivalent: the GDPR and the state laws differ in scope, terms and exceptions.

Law as of October 28, 2026.

Reviewed by Sergio Maldonado Elvira on 29 October 2026. Prepared from the official sources listed.

Official text of the Iowa statute

Reference material, not legal advice.