Iowa has the longest response deadline for consumer requests of all US state privacy laws.

The Iowa Consumer Data Protection Act (ICDPA), Iowa Code § 715D, took effect on January 1, 2025. It was signed by Governor Kim Reynolds in March 2023, giving businesses nearly two years to prepare. On a website, cookies are where this law is felt first, so it helps to know how a cookie banner works.

The most distinctive feature: 90 days to respond to a consumer request, with a possible 45-day extension. And a 90-day cure period guaranteed before any Attorney General action, the longest among current state laws.

The ICDPA is Iowa's state personal data protection law. It grants rights to state residents and creates obligations for businesses that process their data.

The law follows the model of other US state privacy laws, with a structure close to Virginia's VCDPA and Utah's UCPA. But it has considerably longer deadlines for businesses to respond.

Enforcement is the exclusive responsibility of the Iowa Attorney General. There is no private right of action (§ 715D.8(4)).

On January 1, 2025.

The law was signed in March 2023, giving businesses nearly two years to prepare.

Under Iowa Code § 715D.2(1), the law applies to persons that conduct business in Iowa or produce products or services targeted to state residents and that, during a calendar year:

Control or process personal data of at least 100,000 consumers; or

Control or process personal data of at least 25,000 consumers and derive more than 50% of gross revenue from the sale of personal data.

Key difference from Utah's UCPA: the ICDPA does not require a minimum revenue of US$ 25 million as an additional criterion. If a business controls or processes data of 100,000 Iowa consumers, it is in scope regardless of revenue. This may bring smaller businesses into scope under the ICDPA that would be outside the UCPA's scope.

Understanding the distinction between controller and processor is fundamental to defining each party's responsibilities.

Under § 715D.2(2) and (3), the following are exempt:

The State of Iowa and its political subdivisions.

Financial institutions, affiliates, and data subject to the Gramm-Leach-Bliley Act.

Entities subject to and compliant with HIPAA.

Nonprofit organizations.

Institutions of higher education.

HIPAA-protected health information and health records.

Regulated clinical research data.

Consumer credit data regulated by the Fair Credit Reporting Act.

Data regulated by the Driver's Privacy Protection Act.

Data regulated by FERPA.

Data regulated by the Farm Credit Act.

Employee, job applicant, and agent data in an employment context.

Data processed in accordance with COPPA.

Under § 715D.1(18), personal data is any information linked or reasonably linkable to an identified or identifiable natural person.

Not personal data: de-identified data, aggregate data, and publicly available information.

Under § 715D.1(26), sensitive data includes:

Racial or ethnic origin, religious beliefs, mental or physical health diagnosis, sexual orientation, or citizenship or immigration status (except when used to avoid discrimination under anti-discrimination law).

Genetic or biometric data processed for the purpose of uniquely identifying a natural person.

Personal data collected from a known child (under 13).

Precise geolocation data.

Sensitive data model: like the UCPA, the ICDPA uses an opt-out model for sensitive data. The controller cannot process sensitive data without first presenting a clear notice and offering an opt-out opportunity (§ 715D.4(2)). Prior consent is not required.

Under § 715D.1(19), precise geolocation data is information derived from technology, including GPS coordinates, that identifies the specific location of a natural person with precision within a radius of 1,750 feet.

Under § 715D.3(1), Iowa residents have four rights:

Confirm and access: confirm whether the controller processes personal data and access that data (§ 715D.3(1)(a)).

Deletion: request deletion of personal data the consumer provided to the controller (§ 715D.3(1)(b)). Like the UCPA, the scope is limited to data provided by the consumer.

Portability: obtain a copy of the data in a portable and, where technically practicable, readily usable format for transmission to another controller without impediment (§ 715D.3(1)(c)).

Opt-out from data sales: refuse the sale of personal data (§ 715D.3(1)(d)).

Note on targeted advertising: the ICDPA lists only opt-out from data sales as a formal right in § 715D.3(1)(d). However, § 715D.4(6) requires that if the controller engages in targeted advertising, it must clearly disclose this and describe how the consumer can exercise an opt-out. In practice, the controller must offer an opt-out from targeted advertising in the privacy notice, even though it is technically a transparency obligation rather than a formally listed right.

No right to correct inaccurate data (same as UCPA).

No formal opt-out of profiling.

Deletion limited to data provided by the consumer.

This is the ICDPA's most distinctive feature. Under § 715D.3(2)(a):

90 days to respond from receipt of the request.

Extension of +45 days when reasonably necessary due to complexity or volume, with notification within the initial period.

Comparison of response deadlines:

Free service: up to 2 times per year per consumer (§ 715D.3(2)(c)). From the third request in the same 12-month period, the controller may charge a reasonable fee or refuse if the request is manifestly unfounded, excessive, repetitive, technically infeasible, or if the primary purpose is not to exercise a right.

Under § 715D.3(3), the controller must establish an appeal process. It must be conspicuously available and similar to the original submission method. Within 60 days of receiving an appeal, the controller must inform the consumer in writing of any action taken or not taken, with explanation of the reasons.

If the appeal is denied, the controller must provide the consumer with an online mechanism to contact the Attorney General to submit a complaint.

Under § 715D.4, the controller must:

Adopt and implement reasonable administrative, technical, and physical data security practices, proportionate to the volume and nature of the data.

Not process sensitive data without presenting a clear notice and offering an opt-out opportunity first.

Not discriminate against consumers who exercise their rights.

Provide a reasonably accessible, clear, and meaningful privacy notice with the five required elements.

Clearly and conspicuously disclose if it sells data or engages in targeted advertising, with opt-out method for each activity.

Establish secure and reliable means for request submissions, described in the privacy notice.

Not require the consumer to create a new account to exercise rights.

Cookies that collect personal data or allow user identification fall within the ICDPA's scope.

The site must display a clear cookie notice, offer opt-out from data sales and targeted advertising, and describe in the privacy notice how consumers can exercise their rights.

Correct tag categorization is what makes it possible to identify which cookies constitute targeted advertising or data sales.

The ICDPA defines targeted advertising in § 715D.1(28) as ads selected based on data obtained from the consumer's activities over time and across non-affiliated websites or applications. Ads based on activities within the controller's own site or affiliated sites do not qualify.

The ICDPA uses "sale" as monetary consideration (§ 715D.1(25)), without including the concept of "sharing" for behavioral advertising without payment, as the CPRA does.

Under § 715D.8, the Iowa Attorney General has exclusive enforcement authority.

Cure period: 90 days guaranteed. Before initiating any action, the AG must notify the controller in writing identifying violations and granting 90 days to cure (§ 715D.8(2)). This is the longest cure period of all current US state privacy laws.

If the controller cures the violation within 90 days and provides an express written statement that violations have been cured and will not recur, no action is initiated.

If the violation continues or the controller breaches the provided statement, the AG may initiate action and seek:

Injunction to stop the violations.

Civil penalties of up to US$ 7,500 per violation (§ 715D.8(3)).

AdOpt records every consent and opt-out interaction, blocks trackers before acceptance, and generates the auditable log needed in an Iowa Attorney General investigation.

The automatic scan identifies all active trackers on the site, feeding the data inventory required for the privacy notice. And when the law changes, the platform updates automatically.

Over 60,000 websites already run with AdOpt.

Privacy is not a banner. It is a position.

Ready to bring your website into compliance with the Iowa ICDPA? Talk to our team.

Compliance with the ICDPA rests on three documents that have to agree with each other: the cookies policy, which declares every tracker and its purpose; the privacy policy, which explains what you do with the data; and the privacy portal, where the consumer exercises their rights and you keep the record of it.

1. What is the ICDPA and what is its key differentiator?
The Iowa Consumer Data Protection Act (Iowa Code § 715D) is Iowa's state personal data protection law. It took effect on January 1, 2025. Its key differentiator is the response deadline for consumer requests: 90 days, with a possible extension of 45 more. This is the longest deadline of all current US state privacy laws, compared to 45 days in Virginia, Oregon, Utah, Connecticut, and other states. The 90-day cure period guaranteed before any AG action is also the longest among state laws.

2. Why does the ICDPA have a 90-day deadline instead of 45 days like other laws?
The ICDPA was designed with longer deadlines to reduce operational burden on businesses. § 715D.3(2)(a) explicitly establishes 90 days, which is double the 45-day standard adopted by most US state laws. This means businesses have more time to organize their DSAR processes, authenticate requests, and prepare responses. But the longer deadline for businesses also means consumers wait longer to receive a response.

3. What distinguishes the ICDPA threshold from Utah's UCPA?
The UCPA requires businesses to satisfy both the US$ 25 million revenue requirement AND at least one volume threshold (dual requirement). The ICDPA has no minimum revenue requirement. If a business controls or processes data of 100,000 Iowa consumers, it is in scope regardless of revenue. This may bring smaller businesses into ICDPA scope that would be outside UCPA scope. The 25,000 consumer + 50% revenue from data sales threshold is identical in both laws.

4. Does the ICDPA have a formal opt-out right for targeted advertising?
The ICDPA lists opt-out from data sales as a formal right in § 715D.3(1)(d), but does not list opt-out from targeted advertising as a formal right in the same way. However, § 715D.4(6) requires that if the controller engages in targeted advertising, it must clearly disclose this and describe the opt-out method. In practice, the controller must offer and accept opt-out requests for targeted advertising in the privacy notice, even though the legal basis is a transparency obligation rather than a formally listed right.

5. What is the penalty for ICDPA non-compliance?
The Attorney General may seek an injunction and civil penalties of up to US$ 7,500 per violation (§ 715D.8(3)). Before initiating any action, the AG must notify the controller and grant 90 days to cure. If the controller cures the violation and provides a written statement, no action is initiated. If not cured or if the statement is breached, the AG may proceed. There is no private right of action for consumers (§ 715D.8(4)).

Ready to bring your website into compliance with the Iowa ICDPA? Talk to our team.