Iowa Consumer Data Protection Act (ICDPA)

The Iowa Consumer Data Protection Act (ICDPA) provides consumers with rights over their personal data, including the right to access, correct, and delete personal data, as well as opt out of data processing for targeted advertising and sales.

JurisdictionIowa
CategoryPrivacy & Data Protection
StatusActive
Effective date
Latest development

Analysis

Key Requirements

The Iowa Consumer Data Protection Act (ICDPA) imposes several key requirements on businesses:

  • Scope: Applies to businesses that control or process personal data of at least 100,000 Iowa consumers annually, or 25,000 consumers if over 50% of gross revenue comes from selling personal data Iowa Legislature
  • Consumer Rights: Businesses must allow Iowa residents to:
  • Access their personal data
  • Delete personal data they provided
  • Obtain a portable copy of their data
  • Opt out of personal data sales and targeted advertising

Iowa Attorney General

  • Response Time: Controllers must respond to consumer requests within 90 days, with a possible 45-day extension Termly
  • Privacy Notice: Businesses must provide a clear privacy notice detailing data collection practices, purposes, and consumer rights CookieYes
  • Data Security: Implement reasonable security practices to protect personal data confidentiality BigID
  • Processor Contracts: Controllers must have contracts with processors ensuring compliance with ICDPA requirements DataGuidance

Compliance Challenges

Organizations face several challenges in complying with the ICDPA:

  • Data Mapping: Identifying and categorizing all personal data collected on Iowa residents IAPP
  • Consumer Request Management: Establishing efficient processes to handle access, deletion, and opt-out requests within required timeframes Didomi
  • Consent Management: Implementing systems to obtain and manage consumer consent, especially for sensitive data processing CookieBot
  • Third-Party Risk Management: Ensuring processors and vendors comply with ICDPA requirements through contracts and oversight Hoggo

Implementation Best Practices

To implement ICDPA compliance effectively:

Recent Updates

As of February 2025, there have been no significant updates to the ICDPA since its passage. The law is set to take effect on January 1, 2025 Iowa Legislature Bill History

Organizations should monitor the Iowa Attorney General's website for any future guidance or amendments.

Related Regulations

The ICDPA shares similarities with other state privacy laws:

  • General Data Protection Regulation (GDPR): While more comprehensive, GDPR shares principles of data protection and consumer rights EU GDPR Portal

Organizations complying with these regulations may find overlap in ICDPA compliance efforts.

Industry Impact

The ICDPA will significantly impact various industries:

  • E-commerce: Online retailers will need to adjust data collection and targeted advertising practices National Law Review
  • Healthcare: While HIPAA-regulated entities are exempt, non-covered entities handling health data will face new requirements HealthITSecurity
  • Technology Companies: Firms collecting large amounts of consumer data will need to overhaul data management practices TechCrunch

Sources

Recent developments

  • — Privacy Rights Clearinghouse publishes an updated ICDPA overview noting the law has been in effect since 2025-01-01, emphasizing its relatively narrow scope versus other state laws (no right to correct data, opt-out rather than opt-in for sensitive data) and outlining key consumer rights to access, delete, copy, and opt out of sale.[5] (source)
  • — Iowa law firm Nyemaster Good details ICDPA’s operational impact as it remains in force, focusing on business thresholds, excluded entities (financial institutions, nonprofits, higher education, HIPAA-covered entities), and emphasizing practical compliance steps and response timelines for consumer requests.[2] (source)
  • — Didomi analyzes ICDPA’s ongoing requirements for businesses as the law continues to apply, highlighting obligations around transparent privacy notices, handling access and deletion requests, and opt-out mechanisms for data sales, and comparing Iowa’s framework to EU and California regimes from an implementation standpoint.[3] (source)
  • — McDonald Hopkins revisits Iowa’s consumer data privacy law post-effective date, reiterating scope thresholds (100,000 consumers or 25,000 with >50% revenue from data sales) and advising businesses on enforcement risk and preparation for investigations or cure periods under the Attorney General’s exclusive authority.[6] (source)
  • — Mintz updates its Iowa ICDPA client alert to reflect the law now being in force, stressing that Iowa remains less consumer-friendly than other states (no correction right, opt-out for sensitive data) and discussing how multi-state privacy programs are adapting to Iowa’s comparatively light requirements.[7] (source)
  • — OneTrust’s ongoing commentary on Iowa’s comprehensive privacy bill, now operative as ICDPA, focuses on how organizations are incorporating Iowa into broader U.S. state privacy compliance strategies, particularly around consumer opt-out of sale, data portability, and the 90‑day cure period with no sunset.[8] (source)
  • — Iubenda discusses business reactions to the ICDPA’s enforcement-era, noting that many companies view Iowa as a “baseline” state privacy law due to its limited rights and absence of a correction right, and are leveraging existing Colorado/Virginia-style programs to meet Iowa’s requirements with minimal incremental changes.[9] (source)
  • — IAPP updates its coverage to mark ICDPA’s first year in effect, highlighting enforcement architecture (exclusive Attorney General authority, 90‑day cure) and industry feedback that the law is relatively business-friendly compared with California and Colorado, influencing how national privacy programs prioritize Iowa compliance.[1] (source)
  • — White & Case issues a refreshed insight alert as ICDPA approaches its first anniversary, examining legal risk under the $7,500-per-violation penalty regime and noting that, despite limited consumer rights, national and regional companies must still update notices and request-handling workflows to avoid enforcement.[4] (source)
  • — Privacy Rights Clearinghouse earlier summarized early impacts of ICDPA after it took effect, reporting that consumer advocates are concerned about the lack of correction rights and opt‑in for sensitive data, while industry groups generally welcome Iowa’s lighter compliance burden compared to more stringent state privacy laws.[5] (source)
  • — Overview noting that the Iowa Consumer Data Protection Act (ICDPA) took effect on 2025-01-01, detailing consumer rights to access, delete, obtain a copy, and opt out of sale of data, and emphasizing that the law is narrower than many other state privacy laws, with no right to correct data and only opt-out (not opt-in) for sensitive data processing[5]. (source)
  • — Analysis of Iowa’s Consumer Data Protection Act ahead of its 2025 effective date, summarizing applicability thresholds, enumerating consumer rights, and highlighting gaps versus more expansive state laws (e.g., no right to correction and opt-out rather than opt-in for sensitive data), which has driven industry assessment that Iowa’s regime is comparatively business-friendly[6]. (source)

Read the full guide to Iowa Consumer Data Protection Act (ICDPA)

Related regulations

Put it into practice

Browse all regulations · Compliance deadlines · Latest updates