Overview
The Iowa Consumer Data Protection Act (ICDPA) is a comprehensive state privacy law designed to give Iowa residents greater control over their personal data while setting compliance requirements for businesses. Signed into law on March 29, 2023, the ICDPA takes effect on January 1, 2025.
The law is business-friendly compared to privacy laws in California (CPRA) and Colorado (CPA), but still grants core privacy rights to consumers.
Who Must Comply?
The ICDPA applies to businesses operating in Iowa or targeting Iowa residents and meet one of the following criteria:
✔ Process personal data of at least 100,000 Iowa consumers annually
✔ Process personal data of at least 25,000 Iowa consumers and derive 50%+ of revenue from selling personal data
Exemptions:
The law does not apply to:
🚫 Government agencies
🚫 Nonprofits
🚫 Financial institutions subject to GLBA
🚫 HIPAA-covered entities
🚫 Higher education institutions
Key Consumer Rights Under ICDPA
✔ Right to Access – Consumers can request a copy of their personal data.
✔ Right to Delete – Consumers can request the deletion of personal data they provided.
✔ Right to Data Portability – Consumers can receive their data in a portable format.
✔ Right to Opt-Out – Consumers can opt out of:
- Targeted advertising
- Sale of personal data
📌 No Right to Correct Data – Unlike CPRA and CPA, the ICDPA does not include a right to correct inaccurate data.
📌 No Right to Opt-Out of Profiling – The ICDPA does not include opt-outs for profiling-based decision-making.
Business Compliance Requirements
✔ Opt-In Consent for Sensitive Data – Businesses must obtain explicit consent before processing:
📌 Racial/ethnic origin
📌 Religious beliefs
📌 Biometric data
📌 Health conditions
📌 Children’s data
✔ Clear Privacy Policy – Companies must publish transparent privacy policies detailing data collection and use.
✔ Data Security Measures – Businesses must implement reasonable security safeguards to protect personal data.
✔ No Universal Opt-Out Requirement – Unlike California (CPRA) and Colorado (CPA), businesses do not need to recognize Global Privacy Control (GPC) signals.
Real-World Enforcement Cases
The Iowa Attorney General is responsible for enforcing the ICDPA, with penalties of up to $7,500 per violation.
📌 90-Day Cure Period for Violations – Businesses have 90 days to fix violations before fines are imposed, which is longer than most state privacy laws.
Since the ICDPA does not take effect until January 1, 2025, major enforcement cases have not yet occurred, but companies failing to provide opt-out options are likely to face early penalties.
📌 Comparison with Other State Privacy Laws
The Iowa ICDPA is less restrictive than laws in California, Colorado, and Virginia because:
✅ No Universal Opt-Out Mechanism Required – Businesses are not required to honor global privacy requests.
✅ No Right to Correct Data – Consumers cannot request corrections to personal information.
✅ Longer Compliance Grace Period (90 days) – Businesses have more time to fix violations.
Future of ICDPA Regulation
📌 Potential expansion of consumer rights in future amendments.
📌 Stronger enforcement actions expected in 2025.
📌 Possible updates to align with federal privacy laws if enacted.
Iowa’s ICDPA is a moderate privacy law that balances consumer rights with business flexibility, making it one of the least restrictive state privacy laws.
