Iowa Consumer Data Protection Act

Iowa Consumer Data Protection Act (SF 262, 2023)
Iowa · Iowa SF 262 (2023), Iowa Code ch. 715D

Status
In effect
Took effect
January 1, 2025
Applies to
Controllers/processors meeting thresholds in Iowa
Enforced by
Iowa Attorney General (exclusive)

Iowa's privacy law gives consumers rights to access, delete, copy, and opt out of the sale of their personal data and targeted advertising. Notably it does NOT include a profiling opt-out, making it one of the more business-friendly state privacy laws.

Who is protected: Iowa consumers

Legal detail

Iowa SF 262 (2023), Iowa Code ch. 715D, eff. Jan. 1, 2025; 100,000-consumer or 25,000/50%-revenue thresholds; AG-exclusive enforcement; 90-day cure; up to $7,500 per violation.

Key facts

JurisdictionIowa
LevelState
StrengthLimited
EnactedMarch 28, 2023
CitationIowa SF 262 (2023), Iowa Code ch. 715D
Private right of actionNo, agency enforcement only
PenaltiesUp to $7,500 per continued violation after 90-day cure
Topicsconsumer data privacy · consumer protection · data retention
Bill textIowa SF 262 — Iowa Legislature (90th GA)

More AI rules in Iowa

Related consumer data privacy rules elsewhere

See something wrong or out of date? Submit a correction. Every entry must carry a verifiable source.