Iowa Consumer Data Protection Act (ICDPA)

The Iowa Consumer Data Protection Act (ICDPA) was signed into law on March 28, 2023, and takes effect on January 1, 2025. Iowa became one of the growing number of US states to enact comprehensive consumer data privacy legislation.

What Is the ICDPA?

The ICDPA grants Iowa residents rights over their personal data and places obligations on businesses that collect or process that data. Compared to many other state privacy laws, the ICDPA is relatively business-friendly, offering fewer consumer rights and broader exemptions.

Who Does the ICDPA Apply To?

The ICDPA applies to businesses that conduct business in Iowa or produce products or services targeted to Iowa residents, and during the prior calendar year either:

• Controlled or processed the personal data of at least 100,000 consumers; or
• Controlled or processed the personal data of at least 25,000 consumers and derived more than 50% of gross revenue from the sale of personal data.

Consumer Rights Under the ICDPA

Iowa residents are entitled to:

• Right to access: confirm whether a business processes their personal data and request a copy
• Right to deletion: request deletion of personal data provided by the consumer
• Right to data portability: obtain a portable copy of their personal data
• Right to opt out: opt out of the sale of personal data and targeted advertising

Note: Unlike most other state privacy laws, the ICDPA does not include a right to correction or a right to opt out of profiling for significant decisions. The ICDPA is one of the most business-friendly state privacy laws in the US.

Businesses must respond to verified consumer requests within 90 days.

Sensitive Data

Unlike most other state privacy laws, Iowa uses an opt-out model for sensitive data — businesses are not required to obtain prior opt-in consent before processing sensitive data. Instead, consumers may opt out of such processing. Sensitive data under the ICDPA includes racial or ethnic origin, religious beliefs, mental or physical health condition or diagnosis, sexual orientation, citizenship status, genetic or biometric data processed to uniquely identify an individual, precise geolocation data, and personal data of known children.

Enforcement

The Iowa Attorney General enforces the ICDPA. There is no private right of action. Businesses have a 90-day cure period upon receiving notice of a violation. Civil penalties of up to $7,500 per violation may be imposed for violations that are not cured.

How UniConsent Supports ICDPA Compliance

UniConsent provides the tools businesses need to meet ICDPA requirements:

• Opt-out and opt-in consent banners configurable by state
• Consumer rights request management
• Sensitive data consent workflows
• Integration with websites, mobile apps, and tag managers

Get started with UniConsent or explore our features.

Other US State Privacy Laws

• CCPA: California Consumer Privacy Act, learn more at CCPA
• CPRA: California Privacy Rights Act, learn more at CPRA
• CPA: Colorado Privacy Act, learn more at CPA
• VCDPA: Virginia Consumer Data Protection Act, learn more at VCDPA
• UCPA: Utah Consumer Privacy Act, learn more at UCPA
• CTDPA: Connecticut Data Protection Act, learn more at CTDPA
• TDPSA: Texas Data Privacy and Security Act, learn more at TDPSA
• DPDPA: Delaware Personal Data Privacy Act, learn more at DPDPA
• NHPA: New Hampshire Privacy Act, learn more at NHPA
• MTCDPA: Montana Consumer Data Privacy Act, learn more at MTCDPA
• FDBR: Florida Digital Bill of Rights, learn more at FDBR
• NJDPA: New Jersey Data Protection Act, learn more at NJDPA
• INCDPA: Indiana Consumer Data Protection Act, learn more at INCDPA

Compare different US State Privacy Laws