Iowa Consumer Data Protection Act
Data last verified: March 23, 2026
- Effective Date
- January 1, 2025
- Enforcement Date
- Not specified in statute
Summary
Iowa Consumer Data Protection Act provides consumers the right to opt out of data sales and targeted advertising. Iowa does NOT provide a profiling opt-out right — it is the only US state privacy law without one. Iowa also does not require data protection assessments. Sensitive data requires notice + opt-out (not consent). Preempts local laws (§ 715D.9).
Who It Applies To
100K consumers OR 25K consumers + 50% revenue from data sales
- Min Consumers:
- 100,000
Any threshold triggers applicability
Penalties
- Penalty Range
- $0 – $7,500per violation
- Cure Period
- 90-day cure period
- Private Right of Action
- No private right of action
- Enforcement Body
- Iowa Attorney General
Requirements (3)
- Opt-Out§ 715D.3(1)(d)
This law provides consumers the right to opt out of the sale of their personal data.
- Opt-Out§ 715D.4(6)
This law provides consumers the right to opt out of targeted advertising.
- Opt-Out§ 715D.4(2)
This law requires controllers to provide clear notice and an opportunity to opt out before processing sensitive data.
Claire tracks 31 state and local AI laws across 23 US states. No prescriptive federal AI compliance statutes have been enacted. EU AI Act and sector-specific regulations are not covered.
Check if this law applies to your business