HomeLegal DirectoryIowa Consumer Data Protection Act

In effect Limited protection

Iowa Consumer Data Protection Act (SF 262, 2023)

Iowa · Iowa SF 262 (2023), Iowa Code ch. 715D

Iowa's privacy law gives consumers rights to access, delete, copy, and opt out of the sale of their personal data and targeted advertising. Notably it does NOT include a profiling opt-out, making it one of the more business-friendly state privacy laws.

Technical detail

Iowa SF 262 (2023), Iowa Code ch. 715D, eff. Jan. 1, 2025; 100,000-consumer or 25,000/50%-revenue thresholds; AG-exclusive enforcement; 90-day cure; up to $7,500 per violation.

Who is protected: Iowa consumers

Who must comply: Controllers/processors meeting thresholds in Iowa

Key facts

JurisdictionIowa
LevelState
StatusIn effect
Protection strengthLimited protection
Effective date2025-01-01
Enacted2023-03-28
CitationIowa SF 262 (2023), Iowa Code ch. 715D
Enforced byIowa Attorney General (exclusive)
Private right of actionNo — agency enforcement only
PenaltiesUp to $7,500 per continued violation after 90-day cure
Topicsconsumer data privacy · consumer protection · data retention
Last verified2026-06-12
Official sourceIowa SF 262 — Iowa Legislature (90th GA) ↗

More AI rules in Iowa

Related consumer data privacy rules elsewhere

See something wrong or out of date? Submit a correction — every entry must carry a verifiable official source.