Iowa
Iowa Consumer Data Protection Act
Iowa’s consumer privacy law. It gives Iowa residents rights over their personal data and sets rules for businesses that meet its size limits.
- Status
- In effect since January 1, 2025
- Citation
- Iowa Code ch. 715D
- Official text
- Read the law(opens in a new tab)
Who it covers
Businesses that handle data of 100,000+ Iowa residents a year, or 25,000+ if they earn revenue from selling data.
What it asks of your website
- A privacy notice explaining what you collect, why, who you share it with and how people use their rights.
- Let people access and delete their data, get a copy, and opt out of the sale of their data.
- Disclose targeted advertising clearly, and how to opt out of it.
- Give notice and a way to opt out before using sensitive data.
- Offer an appeal when you turn down a privacy request.
Who has to comply
The Iowa Consumer Data Protection Act took effect on January 1, 2025. It applies to businesses that handle the personal data of 100,000 or more Iowa consumers, or 25,000 or more while getting over 50% of gross revenue from selling personal data.
Nonprofits are exempt, as are colleges, government bodies, Gramm-Leach-Bliley financial institutions and HIPAA covered entities.
Fewer rights, longer deadlines
- Rights to confirm and access, delete the data they gave you, get a portable copy, and opt out of the sale of their data.
- There’s no right to correct.
- If you do targeted advertising, you must disclose it clearly and explain how to opt out.
- Respond within 90 days, extendable once by 45 more.
- Appeals: answer in writing within 60 days; a denial must give an online way to contact the Attorney General.
Opt-out signals and sensitive data
Iowa doesn’t require honoring universal opt-out signals such as Global Privacy Control.
Sensitive data needs clear notice and a chance to opt out, not opt-in consent. Data of a known child under 13 must be handled under COPPA.
Your privacy notice
Give a reasonably accessible, clear and meaningful privacy notice: the categories of data you process and why, how to use and appeal rights, and the categories of data and third parties you share with. Describe secure ways to send requests; you can’t require a new account to make one.
Enforcement
The Attorney General has exclusive authority; there’s no private right of action. Before acting, the Attorney General must give 90 days’ written notice, and if you cure and confirm in writing, no action follows. The statute sets no end date for this cure period. Penalties are up to $7,500 per violation.
Where GoConsent helps
Privacy Policy builder
A Privacy Policy with a Notice at Collection, written from your settings and your latest scan, drafted to cover the points privacy laws describe. Review it with your lawyer.
Opt-outs and requests
Your Privacy Choices with a Marketing switch, “Opt out using your email”, and a Requests tab with deadlines and reminders.
A plain-English summary, last reviewed October 26, 2026. It isn’t legal advice, and some duties depend on how your business handles data, such as security programs and answering access requests. Read the official text and talk to a lawyer about your situation.
FAQ
Questions, answered
Can Iowa consumers correct their data?
No. Iowa’s law has no right to correct.
How long do I have to answer a request in Iowa?
90 days, extendable once by 45 more.
Do I need consent for sensitive data in Iowa?
No. Iowa requires clear notice and a chance to opt out instead.
Check your site against this law
GoConsent scans your site, tells you which laws likely apply and what to fix. Free, with no visit limits.
