Iowa Consumer Data Protection Act (ICDPA): An Overview

Iowa was the sixth U.S. state to pass a comprehensive consumer privacy law. Governor Kim Reynolds signed Senate File 262 on March 28, 2023, and the law took effect on January 1, 2025. It is codified in Iowa Code chapter 715D.

The state’s first attempt at a comprehensive privacy law failed in 2020, but the topic of data privacy has gained momentum since. Iowa’s data privacy law can be seen as more business-friendly than some other state-level U.S. privacy laws to date, which has also been said about the UCPA in Utah.

What Is the Iowa Consumer Data Protection Act (ICDPA)?

The ICDPA protects the privacy rights of Iowa residents and establishes data privacy responsibilities for companies that do business in the state or offer products or services targeted to Iowa residents. In the course of doing business, these organizations process consumers’ personal data. Under the ICDPA, a consumer is an Iowa resident acting only in an individual or household context, which excludes people acting in a commercial or employment context.

The ICDPA is built on a notice-and-opt-out model, which is how most U.S. state privacy laws treat non-sensitive personal data. Businesses that must comply have to tell consumers what personal data they process, for what purposes, and with which categories of third parties they share it. They must also give consumers a way to exercise their rights, including opting out of the sale of personal data, and they must adopt reasonable data security practices.

Definitions in the Iowa Consumer Data Protection Act

The ICDPA relies on a handful of defined terms to set its scope and its obligations. The definitions below cover personal data, sensitive data, controllers and processors, sale, and targeted advertising.

Personal Data

The ICDPA uses a fairly standard definition of personal data: “any information that is linked or reasonably linkable to an identified or identifiable natural person”. It excludes publicly available information, aggregated data, or de-identified data.

Sensitive Data

Sensitive data is a category of personal data that includes the following:

• Racial or ethnic origin
• Religious beliefs
• Mental or physical health diagnosis
• Sexual orientation
• Citizenship or immigration status
• Genetic or biometric data that is processed for the purpose of uniquely identifying a natural person
• Personal data collected from a known child, meaning a child younger than 13
• Precise geolocation data, defined as information that identifies a person’s location within a radius of 1,750 feet (approximately 533 meters)

Controller

Businesses that collect and process personal data will likely qualify as controllers, which the ICDPA defines as “a person that, alone or jointly with others, determines the purpose and means of processing personal data”.

Processor

For businesses that share personal data for processing purposes, the business will be the controller and the third-party entity will be the processor, defined in the Iowa privacy act as “a person that processes personal data on behalf of a controller”.

Sale

Several notable exclusions to the definition of sale include the disclosure of personal data:

• To a processor that processes the personal data on behalf of the controller
• To a third party for purposes of providing a product or service requested by the consumer or the parent of a child
• To an affiliate of the controller
• That the consumer intentionally made available to the general public via a channel of mass media and did not restrict to a specific audience
• When a consumer uses or directs a controller to intentionally disclose personal data or interact with one or more third parties
• To a third party as an asset that is part of a proposed or actual merger, acquisition, bankruptcy, or other transaction in which the third party assumes control of all or part of the controller’s assets

Targeted Advertising

The ICDPA defines targeted advertising as displaying ads selected based on personal data obtained from a consumer’s activities over time and across nonaffiliated websites or applications to predict their preferences or interests. It does not include ads based on activity within a controller’s own or affiliated sites, contextual ads based on the current search query or site visit, ads sent in response to a consumer’s request, or processing used solely to measure ad performance, reach, or frequency.

The ICDPA does not give consumers a right to opt out of targeted advertising. It does require controllers that engage in it to disclose that activity clearly and conspicuously and to explain how consumers can opt out.

What Does the Iowa Consumer Data Protection Act Cover?

The ICDPA covers businesses that meet one of two consumer-count thresholds (during the calendar year), and it exempts specific entities and categories of data. The thresholds are:

• Control or process the personal data of at least 100,000 Iowa consumers, or
• Control or process the personal data of at least 25,000 Iowa consumers, and derive more than 50 percent of gross revenue from the sale of personal data

Unlike California, Iowa has no annual revenue threshold. Under the CCPA, annual gross revenue above an inflation-adjusted amount can bring a business into scope even when it processes the personal data of relatively few consumers. The ICDPA looks only at the number of Iowa consumers and, for the second threshold, the share of revenue that comes from selling personal data.

As a result, a business of any size that meets either threshold must meet the ICDPA’s requirements.

Exemptions to the Iowa Consumer Data Protection Act

The ICDPA’s exemptions are broadly consistent with other U.S. state privacy laws. Some exempt entire organizations, while others exempt specific categories of data that are regulated by federal law.

Exempt entities include:

• The state of Iowa and its political subdivisions
• Financial institutions, their affiliates, and data subject to the Gramm-Leach-Bliley Act (GLBA)
• Organizations that are subject to and comply with Health Insurance Portability and Accountability Act (HIPAA) and HITECH Act regulations
• Nonprofit organizations, as the law defines them
• Institutions of higher education

Exempt data includes:

• Protected health information under HIPAA, health records, and certain other health care and research data
• Personal data regulated by the Family Educational Rights and Privacy Act
• Personal data handled in compliance with the Driver’s Privacy Protection Act or the Farm Credit Act
• Information regulated by the Fair Credit Reporting Act (FCRA), to the extent that law applies
• Personal data used in accordance with COPPA
• Data processed in an employment context, such as for job applicants, employees, agents, and contractors, along with emergency contact and benefits administration data

Consumers’ Rights Under the Iowa Consumer Data Protection Act

Consumers have four main rights under the new data protection law. Parents or legal guardians of known children can invoke a child’s rights regarding processing of personal data.

ICDPA Consumer Rights

Right to access

Confirmation if the controller is processing the consumer’s personal data and access to that data, with some exceptions

Right to delete

Any personal data the controller has that was provided by the consumer

Right to portability

Obtain a copy of the consumer’s personal data that the consumer previously provided to the controller, in a readily usable format, with some exceptions

Right to opt out

Of the sale of personal data

The most notable rights that the ICDPA does not include are:

• Right to correct inaccurate personal data
• Right to opt out of targeted advertising
• Right to opt out of profiling or automated decision-making
• Opt-in consent for processing sensitive data
• Private right of action (consumers’ ability to sue the controller in the event of a violation)

Controllers that sell personal data or engage in targeted advertising must still disclose that activity clearly and conspicuously and explain how consumers can opt out of it.

How Does the Iowa Consumer Data Protection Act Affect Businesses?

Notably, the ICDPA does not require controllers to perform data protection assessments.

Controllers must tell consumers about their rights and provide secure and reliable ways to submit requests. The privacy notice must explain how to exercise those rights, including how to appeal a decision. A controller can require a consumer to use an existing account, but cannot require a new account to be created in order to make a request.

Controllers must respond to an authenticated consumer request without undue delay and within 90 days. The controller can extend that period once, by 45 days, when reasonably necessary given the complexity and number of requests, provided it tells the consumer about the extension and the reason within the initial 90 days.

Controllers can decline a request in limited cases, such as when they cannot authenticate the consumer’s identity, and must tell the consumer why. Responses must be free of charge up to twice a year per consumer.

Appeals

Controllers must offer a conspicuous appeal process that is similar to the process for submitting requests. They must respond to an appeal in writing within 60 days and explain the decision. If the controller denies the appeal, it must give the consumer an online way to contact the Iowa Attorney General to submit a complaint.

Purpose Limitation and Data Minimization

Unlike many other state laws, the ICDPA does not impose a general data minimization or purpose limitation duty on controllers. The standard of “reasonably necessary and proportionate” applies only when a controller relies on one of the law’s listed exemptions, such as complying with legal obligations or preventing fraud.

Data Security

Controllers must adopt and implement reasonable administrative, technical, and physical data security practices to protect the confidentiality, integrity, and accessibility of personal data. These practices must be appropriate to the volume and nature of the personal data at issue.

Consent Requirements

The ICDPA relies on notice and opt-out rather than opt-in consent. A controller does not need consumer consent to collect and process personal data in most cases. For sensitive data, a controller must give the consumer clear notice and an opportunity to opt out before processing it for a nonexempt purpose, which differs from many other states that require opt-in consent. Consumers must also be able to opt out of the sale of personal data.

Where children are concerned, the ICDPA follows the Children’s Online Privacy Protection Act (COPPA). Personal data collected from a known child, meaning a child younger than 13, is sensitive data under the ICDPA, and a controller must process it in accordance with COPPA, the federal law that governs how online services handle the personal information of children under 13.

Nondiscrimination

Controllers may not process personal data in violation of state or federal anti-discrimination laws. They also may not discriminate against consumers for exercising their rights under the ICDPA, including by denying goods or services, charging different prices or rates, or providing a different level of quality. Any contract provision that purports to waive or limit consumer rights is void and unenforceable.

The law does not require a controller to provide a product or service that depends on personal data the controller does not collect or maintain. A controller may also offer a different price, level of quality, or selection to a consumer who has opted out of the sale of personal data, or as part of a bona fide loyalty, rewards, premium features, discounts, or club card program. Website features that rely on certain cookies may therefore not work as intended if a visitor opts out.

Transparency

Controllers must provide a reasonably accessible, clear, and meaningful privacy notice, typically on the company’s website. Under the ICDPA, the notice must include:

• The categories of personal data the controller processes
• The purposes for processing personal data
• The categories of personal data the controller shares with third parties, if any
• The categories of third parties with which the controller shares personal data, if any
• How consumers may exercise their rights and appeal a controller’s decision, for example if a request for access is denied

Controllers that sell personal data or engage in targeted advertising must also clearly and conspicuously disclose that activity and explain how consumers can opt out of it.

Processor Contracts

A contract between a controller and a processor must clearly set out:

• Instructions for processing personal data
• The nature and purpose of the processing
• The type of data being processed
• The duration of the processing
• The rights and duties of both parties

The contract must also require the processor to:

• Ensure that each person processing the data is subject to a duty of confidentiality
• Delete or return all personal data at the controller’s direction when services end, unless the law requires retention
• Make available, on reasonable request, the information needed to demonstrate its compliance with the law
• Engage any subcontractor under a written contract that requires it to meet the processor’s duties

Universal Opt-Out Signal

Like with the Virginia Consumer Data Protection Act (VCDPA), the Iowa Consumer Data Protection Act does not make any reference to the Global Privacy Control (GPC) or other opt-out mechanism. A growing number of other states, including California, do require businesses to recognize GPC or similar universal opt-out signals.

These signals let consumers set their privacy preferences once and communicate them automatically to every website they visit, so visitors do not have to set preferences on each site. Even though Iowa does not require it, honoring these signals can help businesses that operate in several states apply a consistent approach to opt-out requests.

What Happens If a Business Violates the Iowa Consumer Data Protection Act?

The Iowa Attorney General alone enforces the ICDPA, and businesses have 90 days to cure an alleged violation before any action begins.

Enforcement

The Iowa Attorney General has exclusive authority to enforce the ICDPA and can issue civil investigative demands. The law does not provide a basis for a private right of action, so consumers cannot sue businesses for violations. If a controller denies a consumer’s appeal, it must give the consumer an online way to contact the Attorney General to submit a complaint. Before taking any action, the Attorney General must give the controller or processor 90 days’ written notice that identifies the specific provisions allegedly violated.

Cure Period and Controller Actions

The ICDPA gives businesses 90 days to cure an alleged violation before any enforcement action begins. The process works as follows:

1. The Attorney General sends the controller or processor written notice identifying the specific provisions allegedly violated.
2. The business has 90 days from that notice to cure the violation.
3. Within that period, the business gives the Attorney General an express written statement that the violation has been cured and that no further violations will occur.
4. If the business does both, no action can be initiated.

This cure period is longer than the cure periods in many other states, and the ICDPA does not set an expiration date for it.

Fines and Penalties

If a controller or processor continues to violate the ICDPA after the cure period, or breaches its written statement to the Attorney General, the Attorney General may bring an action in the name of the state, seek an injunction, and pursue civil penalties.

Civil penalties can reach up to USD 7,500 per violation. The ICDPA sets a single maximum and does not distinguish between intentional and unintentional violations, unlike the tiered penalties under the California Privacy Rights Act (CPRA). Any money the state collects, including penalties, costs, and attorney fees, goes into the consumer education and litigation fund.

How a Consent Management Platform Supports ICDPA Requirements

Iowa generally asks businesses for transparency and a working opt-out, not opt-in consent. A consent management platform (CMP) can help deliver both.

Under the ICDPA, controllers can usually collect and process personal data without prior consent, including sensitive data, as long as consumers receive clear notice and a chance to opt out. The exception is sensitive data about a known child, which must be processed in accordance with COPPA.

Three requirements matter most to visitors:

• A clear privacy notice
• A way to opt out of the sale of personal data
• Disclosure of any sale or targeted advertising, with instructions for opting out

A CMP can help on each front. It can detect the cookies and other tracking technologies on websites and apps, present the opt-out as a banner link or button, and show visitors which data categories, services, processors, and third parties are involved.

Few businesses answer to one law. With no single federal privacy law, a company operating across the U.S. or abroad may face several at once. Geotargeting helps here by presenting the right notice and choices based on each visitor’s location, in the visitor’s preferred language. That can support compliance efforts under the ICDPA, other U.S. state laws, and regulations such as the EU’s GDPR, which sets stricter consent requirements than U.S. state privacy laws.

How to Prepare for the Iowa Consumer Data Protection Act

The ICDPA has applied since January 1, 2025, so any business that meets its thresholds is already covered. If you have prepared for other U.S. state privacy laws, much of the work is done.

Start with four checks:

• Privacy notice: Does it cover the data you process, your purposes, who receives it, and how consumers exercise their rights and appeal?
• Sale and targeted advertising: Do you disclose both and offer an opt-out?
• Requests and appeals: Can you respond within 90 days and run an appeal process?
• Processor contracts: Do they include the terms the law requires?

Usercentrics Web CMP and App CMP can help with the notices and opt-outs.

Expect the law to evolve. Iowa lawmakers have introduced bills on profiling, minors’ data, and health data, and state privacy laws are often amended over time. A privacy by design approach helps you adapt.

Strong privacy practices can also build trust and support higher-quality data for marketing and measurement. Qualified legal counsel or your privacy expert can help confirm your obligations, even under a lighter-touch law like Iowa’s.

Usercentrics does not provide legal advice, and information is provided for educational purposes only. We always recommend engaging qualified legal counsel or privacy specialists regarding data privacy and protection issues and operations.