The Iowa Consumer Data Protection Act (ICDPA, Iowa Code § 715D) has a specific requirement for advertising cookies worth highlighting from the start.

This page covers one piece of the picture. For the full scope of the ICDPA — who must comply, the thresholds, the consumer rights and the penalties — start with our complete guide to the ICDPA and cookies.

The law formally lists only the opt-out from data sales as a consumer right (§ 715D.3(1)(d)). But § 715D.4(6) requires that, if the business engages in targeted advertising, it must clearly disclose this and describe how the consumer can exercise an opt-out from that activity.

In practice, any site with advertising pixels must offer an opt-out from targeted advertising, even though it is technically a transparency obligation rather than a formally listed right.

This article focuses exclusively on what the ICDPA requires from a Cookies Policy.

The cookie banner is the consent interface. It is what the visitor sees when they first access the site.

The Cookies Policy is the detailed document. It is where the user finds complete information about each technology: what it collects, what it is for, who receives the data.

Both need to exist. Both need to be aligned. And the Cookies Policy must be accessible from a clear link within the consent notice itself.

Under § 715D.4(5)(b), the privacy notice must include the purpose for processing personal data. For cookies, this translates into describing the purpose of each tracker category clearly.

What does not work: "cookies to improve your experience."

What works: "Analytics cookies: collect browsing behavior data to identify content improvement opportunities. Data is not sold to third parties."

"Advertising cookies: collect behavioral identifiers sent to advertising platforms for targeted advertising on non-affiliated websites. Consumers may opt out via the mechanism described in the privacy notice."

The Policy must list the tracker categories:

Necessary cookies: essential for basic functionality. Do not constitute targeted advertising or data sale. Must be documented.

Analytics cookies: measure browsing behavior. Depending on the tool, may constitute targeted advertising if data is sent to third parties for targeting on other sites.

Advertising cookies: feed ad pixels for targeted advertising on non-affiliated sites. Require disclosure and opt-out per § 715D.4(6).

Functional cookies: remember user preferences. Generally do not constitute targeted advertising or data sale.

Third-party cookies: fired by external services. Correct tag categorization is what makes accurate documentation possible.

Under § 715D.1(28), targeted advertising consists of ads selected based on data obtained from the consumer's activities over time and across non-affiliated websites or online applications.

What does not constitute targeted advertising:

Ads based on activities within the controller's own site or affiliated sites.

Ads based on the context of the current search query or current visit.

Ads in response to consumer information requests or feedback.

Processing solely to measure advertising performance, reach, or frequency.

Retargeting campaigns using consumer behavior data from other sites almost always constitute targeted advertising.

The ICDPA distinguishes:

Sale of data (§ 715D.1(25)): exchange for monetary consideration to third parties. Consumer has a formal opt-out right.

Targeted advertising (§ 715D.1(28)): use of behavior data from non-affiliated sites to select ads. Not a formally listed opt-out right in § 715D.3, but the controller is required to disclose and offer opt-out per § 715D.4(6).

This creates an operational distinction: the business must offer opt-out from targeted advertising as part of transparency obligations, even though the consumer cannot formally "invoke" this opt-out in the same way they can invoke opt-out from data sales.

Under § 715D.4(5)(d) and (e), the privacy notice must identify categories of data shared with third parties and categories of third parties with whom data is shared.

For cookies, this includes digital advertising platforms, analytics tools that send data to third parties, and any partner receiving behavioral data from site users.

The ICDPA does not require the Cookies Policy to specify data retention periods. This is a CPRA requirement, but not an ICDPA requirement.

Including retention information is a best practice for sites serving consumers in other jurisdictions, but it is not required by Iowa law.

Under § 715D.4(6), the controller must clearly describe how the consumer can opt out of both data sales and targeted advertising.

The format of the opt-out mechanism is not specified. It may be a footer link, a button in the cookie notice, or an online form described in the privacy notice.

The Cookies Policy must identify this mechanism and describe what happens when the consumer exercises the opt-out: which technologies are deactivated.

A well-configured consent management platform ensures that when the user exercises opt-out, all advertising pixels and trackers automatically stop firing.

Under § 715D.1(26), sensitive data includes precise geolocation data (within 1,750 feet) and biometric data for identification.

If the site collects precise geolocation data via cookies, that is sensitive data under the ICDPA.

For sensitive data, the ICDPA requires (§ 715D.4(2)):

Presenting the consumer with a clear notice before processing.

Offering an opt-out opportunity.

This is the same opt-out model as the UCPA. It does not require prior consent, only notice and opt-out.

If Google Analytics sends user behavior data to Google and that data is used for advertising on other sites, this may constitute targeted advertising under the ICDPA.

The ANPD Cookie Guidance has documented how major analytics providers can cross-reference data for advertising purposes.

The safest approach: include Google Analytics in the category of cookies that may constitute targeted advertising, offer opt-out, and document this categorization in the Cookies Policy.

Situations requiring an update:

Adding a new advertising pixel or tracker.

A new analytics tool sending data to third parties for targeting.

A new partner receiving behavioral data from site users.

Change in the use of cookie data for new purposes.

Any modification to opt-out mechanisms.

Continuous data mapping is what keeps the cookie inventory synchronized with the document.

The AG must grant 90 guaranteed days to cure before initiating any action (§ 715D.8(2)). An inadequate Cookies Policy can be corrected within that period if the business has structured processes.

If the violation continues after 90 days, penalties can reach US$ 7,500 per violation.

AdOpt's automatic scan identifies all active technologies on the site, feeding the list of categories that must appear in the Cookies Policy.

The cookie notice configured through AdOpt blocks non-necessary trackers, presents categories with clear descriptions, offers opt-out from data sales and targeted advertising, and logs every interaction for audit purposes.

Over 60,000 websites already run with AdOpt.

Privacy is not a banner. It is a position.

Want to build a Cookies Policy for your site that complies with the ICDPA? Talk to our team.

Visible link in the footer and in the cookie banner.

Listing of cookie categories with a description of what each does.

Specific purpose for each category (§ 715D.4(5)(b)).

Identification of cookies constituting targeted advertising (§ 715D.1(28)).

Identification of cookies constituting data sales (§ 715D.1(25)).

Categories of third parties receiving data via cookies (§ 715D.4(5)(e)).

Opt-out mechanism for data sales, clear and accessible (§ 715D.3(1)(d) and 715D.4(6)).

Opt-out mechanism for targeted advertising, clear and accessible (§ 715D.4(6)).

Notice and opt-out for sensitive data collected via cookies (§ 715D.4(2)).

Accessible language, without legal jargon.

1. Does the ICDPA require a formal opt-out right from targeted advertising?
Not as a formally listed right in § 715D.3, but required in practice. § 715D.4(6) requires that if the controller engages in targeted advertising, it must clearly disclose this and describe the opt-out method. This creates a practical obligation equivalent to a right, even though it is technically a transparency obligation rather than a formally listed right. The Cookies Policy must offer this opt-out.

2. What is the difference between opt-out from "sales" and opt-out from "targeted advertising" under the ICDPA?
"Sale of data" (§ 715D.1(25)) is the exchange for monetary consideration, and opt-out is a formal consumer right in § 715D.3(1)(d). "Targeted advertising" (§ 715D.1(28)) is the use of behavior data from non-affiliated sites to select ads, and opt-out is a controller transparency obligation in § 715D.4(6), not a formally listed right. In practice, the Cookies Policy must offer opt-out for both activities, but the legal bases are different.

3. Do analytics cookies like Google Analytics constitute targeted advertising under the ICDPA?
It depends on the configuration. If Google Analytics only generates internal usage reports, it generally does not constitute targeted advertising. If data is used by Google for advertising on other sites, it may. The ICDPA defines targeted advertising as ads based on data obtained "from the consumer's activities over time and across non-affiliated websites or online applications" (§ 715D.1(28)). The specific GA4 configuration and privacy options activated determine whether targeted advertising is occurring.

4. Does the ICDPA use the same opt-out model for sensitive data as the UCPA?
Yes. Both the ICDPA (§ 715D.4(2)) and the UCPA use the opt-out model for sensitive data: clear notice and opt-out opportunity before processing, without requiring prior consent. This model differs from the opt-in required by the CPRA, OCPA, VCDPA, and CTDPA. For precise geolocation data collected via cookies, the Cookies Policy must inform and offer opt-out before activating those trackers.

5. What happens with opt-out from targeted advertising after the consumer exercises it?
The ICDPA does not specify a separate cessation deadline after opt-out from targeted advertising, beyond the general 90-day response deadline for requests (§ 715D.3(2)(a)). In practice, a well-configured consent management platform processes the opt-out from targeted advertising immediately, deactivating corresponding trackers at the moment the consumer exercises the option, without waiting 90 days.

Ready to build a Cookies Policy for your site that complies with the ICDPA? Talk to our team.