Iowa Privacy Law

The Iowa Consumer Data Protection Act (ICDPA) was signed into law on March 28, 2023, and became effective on January 1, 2025. Iowa's privacy law is widely considered the most business-friendly comprehensive state privacy law, providing fewer consumer rights and more flexibility for businesses than nearly all other state privacy laws. The ICDPA grants Iowa consumers limited rights, including the right to access, delete, and obtain a portable copy of their personal data, and the right to opt out of the sale of personal data and targeted advertising. Notably, the ICDPA does not include a right to correction, a right to opt out of profiling, or an appeals process for denied consumer requests, making it the most limited state privacy law in terms of consumer protections. The law applies to entities conducting business in Iowa or targeting Iowa consumers that control or process personal data of 100,000 or more consumers, or process personal data of 25,000 or more consumers while deriving over 50% of gross revenue from the sale of personal data. The ICDPA provides a generous 90-day cure period — the longest among state privacy laws — and penalties of up to $7,500 per violation, enforced exclusively by the Iowa Attorney General.