Iowa Consumer Data Protection Act (ICDPA)
In force Iowa · In force Jan 1, 2025 · no upcoming deadlines
Deadlines
Summaries for reference, not legal advice. Check the official text.
What it does
Business-friendly comprehensive privacy law giving rights to confirm, access, delete, obtain a copy of, and opt out of sale and targeted advertising (no correction right, no profiling opt-out). Sensitive data requires notice and an opt-out opportunity rather than opt-in consent.
- Who it applies to
- Persons conducting business in Iowa or targeting Iowa residents that during a calendar year control or process personal data of 100,000+ consumers, or 25,000+ consumers and derive over 50% of gross revenue from the sale of personal data.
- Penalties
- Civil penalties up to $7,500 per violation plus injunctive relief. Permanent 90-day cure period (no sunset): AG must give 90 days' written notice and may not sue if cured with a written statement.
- Enforced by
- Iowa Attorney General (exclusive)
- Official name
- Iowa Consumer Data Protection Act (SF 262, 2023), Iowa Code ch. 715D
- Citation
- SF 262 (2023 Iowa Acts ch. 17); Iowa Code 715D.1-715D.9
- Topics
- privacy
Verified 2026-09-22
Research notes
90-day cure period is permanent, so no cure-expiry deadline. No 2025-2026 amendments found.
Related
Alabama Personal Data Protection Act (APDPA)
CCPA / CPRA
Colorado AI Act
Connecticut Data Privacy Act (CTDPA)
Delaware Personal Data Privacy Act (DPDPA)Questions about Iowa Consumer Data Protection Act (ICDPA)
- What are the Iowa Consumer Data Protection Act (ICDPA) compliance deadlines?
- Jan 1, 2025: ICDPA takes effect.
- When does Iowa Consumer Data Protection Act (ICDPA) take effect?
- Iowa Consumer Data Protection Act (ICDPA) took effect on Jan 1, 2025.
- Who does Iowa Consumer Data Protection Act (ICDPA) apply to?
- Persons conducting business in Iowa or targeting Iowa residents that during a calendar year control or process personal data of 100,000+ consumers, or 25,000+ consumers and derive over 50% of gross revenue from the sale of personal data.
- What are the penalties under Iowa Consumer Data Protection Act (ICDPA)?
- Civil penalties up to $7,500 per violation plus injunctive relief. Permanent 90-day cure period (no sunset): AG must give 90 days' written notice and may not sue if cured with a written statement.