The Iowa Consumer Data Protection Act (ICDPA, Iowa Code § 715D) has the longest DSAR deadlines of all US state privacy laws.

This page covers one piece of the picture. For the full scope of the ICDPA — who must comply, the thresholds, the consumer rights and the penalties — start with our complete guide to the ICDPA and cookies.

90 days to respond to a request. +45 days possible extension. 60 days to respond to an appeal. 90 days guaranteed cure period before any AG action.

For businesses that have already structured portals for the VCDPA, OCPA, or CTDPA with 45-day deadlines, the ICDPA requires a process with lower throughput capacity, which may seem operationally easier. But the covered rights are also more limited: no right to correct data, no opt-out of profiling, and deletion limited to data provided by the consumer.

This article covers everything you need to know.

DSAR stands for Data Subject Access Request. It is any formal request from an Iowa resident to exercise the rights the ICDPA guarantees over their own data.

Under § 715D.3(1), consumers exercise their rights by submitting a request to the controller, using the means specified by the controller in the privacy notice.

Under § 715D.3(1), Iowa residents have four rights:

The consumer may confirm whether the controller is processing their personal data and access that data (§ 715D.3(1)(a)).

The consumer may request deletion of personal data they provided to the controller (§ 715D.3(1)(b)).

Limited scope: like the UCPA, the ICDPA limits the deletion right to data the consumer provided. Data obtained from third parties, data brokers, external lists, and derived data do not need to be deleted under the ICDPA.

This differs from laws like the OCPA and CTDPA, which require deletion of data from any source.

The consumer may obtain a copy of the data in a portable and, where technically practicable, readily usable format, for transmission to another controller without impediment, where processing is carried out by automated means (§ 715D.3(1)(c)).

Scope is also limited to data the consumer provided to the controller.

The consumer may refuse the sale of personal data (§ 715D.3(1)(d)).

Important: although opt-out from targeted advertising is not listed as a formal right in § 715D.3, § 715D.4(6) requires the controller to offer an opt-out from targeted advertising as part of its transparency obligations. In practice, the Privacy Portal must accept opt-out requests for targeted advertising as well.

No right to correct inaccurate data (same as UCPA).

No formal opt-out of profiling.

Deletion limited to data provided by the consumer.

Under § 715D.3(2):

90 days to respond from receipt of the request (§ 715D.3(2)(a)).

Extension of +45 days when reasonably necessary due to complexity or volume, with notification within the initial period.

If the controller suspects fraud, it may simply state that it was unable to authenticate, without detailing the reason (§ 715D.3(2)(b)).

Free service: 2 times per year per consumer (§ 715D.3(2)(c)). From the third request in the same 12-month period, the controller may charge a reasonable fee or refuse if the request is manifestly unfounded, excessive, repetitive, technically infeasible, or if the primary purpose is not to exercise a right. The burden of demonstrating the excessive nature is on the controller.

Under § 715D.3(3), the controller must establish an appeal process. It must be conspicuously available and similar to the original submission process.

Within 60 days of receiving an appeal, the controller must inform the consumer in writing of any action taken or not taken, with a written explanation of the reasons.

If the appeal is denied, the controller must provide the consumer with an online mechanism to contact the Attorney General and submit a complaint (§ 715D.3(3)).

Under § 715D.3(2)(d), if the controller cannot authenticate the request using commercially reasonable efforts, it is not required to comply. It may request additional information reasonably necessary to authenticate.

In case of suspected fraud, the controller may simply inform that it was unable to authenticate, without needing to detail why it believes the request is fraudulent (§ 715D.3(2)(b)).

The ICDPA has no special authentication rule for opt-out requests, unlike the OCPA which prohibits requiring authentication for opt-out from targeted advertising.

Under § 715D.4(7), the controller must establish secure and reliable means for request submissions, and describe them in the privacy notice.

These means must:

Consider how consumers normally interact with the controller.

Ensure secure and reliable communication.

Allow authentication of the consumer's identity.

The controller may not require the consumer to create a new account to exercise rights. It may require use of an existing account.

A well-structured Privacy Portal for the ICDPA includes:

A form with the four rights (confirm/access, deletion, portability, opt-out from sales), plus opt-out from targeted advertising per § 715D.4(6).

A proportionate identity verification process.

Receipt confirmation.

Record of the request and the response.

An appeal channel for denied requests.

The site consent mechanism and the Privacy Portal must be integrated so that opt-out preferences are reflected in the business's operational systems.

Receive and authenticate with commercially reasonable efforts.

Confirm whether the consumer's data is being processed.

Locate relevant personal data in systems.

Respond within 90 days.

Receive and authenticate.

Identify which data the consumer directly provided.

Check for a legal exception.

Delete the identified data from systems.

Note: data the controller obtained from external sources does not need to be deleted under the ICDPA.

Receive and authenticate.

Identify data the consumer directly provided.

Prepare in portable, usable format.

Deliver to consumer within 90 days.

Receive via the designated channel.

Authenticate.

Cease selling the consumer's data.

Inform consumer within 90 days.

Receive via the designated channel (obligation per § 715D.4(6)).

Authenticate.

Update tracking systems to cease targeted advertising.

Inform the consumer.

Under § 715D.3(2)(b), the controller that decides not to act must inform the consumer without undue delay with:

Justification for not taking action (except in case of suspected fraud, where it may simply state it was unable to authenticate).

Instructions on how to appeal the decision.

The appeal process must result in a written response within 60 days. If the appeal is denied, the consumer must be informed of how to contact the Attorney General online.

Under § 715D.3(1), the parents or legal guardians of known children (under 13) may exercise rights on the child's behalf.

For children's data, the business must comply with COPPA (§ 715D.2(2)(r) and 715D.4(2)), including verifiable parental consent.

Under § 715D.4(3), the business may not discriminate against consumers who exercise their rights. This includes denying goods or services, charging different prices, or offering different quality.

The exception is voluntary loyalty programs and situations where opt-out from targeted advertising justifies price adjustment.

Before initiating any action, the AG must notify the controller and grant 90 days to cure (§ 715D.8(2)).

Businesses without a structured DSAR process have more time to correct under the ICDPA than under other laws (VCDPA: 30 days, UCPA: 30 days, OCPA: eliminated). But the cure period is a guarantee, not a compliance strategy.

AdOpt records every consent and opt-out interaction with a timestamp and unique identifier. When the consumer exercises opt-out from sales or targeted advertising, the system automatically updates the corresponding trackers.

AdOpt's auditable log serves as evidence of compliance for the Iowa Attorney General.

Over 60,000 websites already run with AdOpt.

Privacy is not a banner. It is a position.

Want to build a Privacy Portal for your site that complies with the ICDPA? Talk to our team.

Request submission channel described in the privacy notice (§ 715D.4(7)).

Coverage of the 4 rights: confirm/access, deletion (data provided by consumer), portability, opt-out from data sales.

Opt-out from targeted advertising (transparency obligation, § 715D.4(6)).

No requirement to create a new account to exercise rights.

90-day deadline to respond (+45 ext. with notification) (§ 715D.3(2)(a)).

Authentication with commercially reasonable efforts (§ 715D.3(2)(d)).

Free service for 2 requests per year per consumer (§ 715D.3(2)(c)).

Appeal process conspicuously available (§ 715D.3(3)).

60-day deadline for appeal responses (§ 715D.3(3)).

Online mechanism to contact AG if appeal is denied (§ 715D.3(3)).

Documented record of each request, action taken, and response sent.

Parents/guardians may exercise rights for known children (§ 715D.3(1)).

Protection against discrimination (§ 715D.4(3)).

1. Why is the ICDPA's 90-day deadline the longest of all US state privacy laws?
The ICDPA was passed by Iowa's legislature with a focus on reducing operational burden for businesses. § 715D.3(2)(a) explicitly establishes 90 days as the standard deadline. Businesses operating across multiple jurisdictions will still need to process requests within the shorter deadlines of other laws, which makes the ICDPA's 90-day period more of a legal ceiling than an operational target.

2. Can consumers formally invoke opt-out from targeted advertising as a right under the ICDPA?
Not as a formally listed right in § 715D.3. Formal opt-out rights cover only data sales in § 715D.3(1)(d). However, § 715D.4(6) requires that if the controller engages in targeted advertising, it must disclose this and describe the opt-out method. In practice, the Privacy Portal must accept and process these requests as part of transparency obligations, even though the legal basis differs from the opt-out from data sales.

3. Why is the ICDPA deletion right more limited than the OCPA's?
§ 715D.3(1)(b) limits deletion to data "personal data provided by the consumer to the controller." This excludes third-party data, inferred data, and derived data. The OCPA requires deletion of data provided by the consumer, obtained from other sources, and derived data. Under the ICDPA, a business that purchased data from a data broker does not need to delete that data upon the consumer's deletion request.

4. How does the ICDPA appeal timeline compare to other state laws?
The ICDPA's 60-day appeal deadline (§ 715D.3(3)) matches Virginia's VCDPA and Connecticut's CTDPA, both with 60 days. Oregon's OCPA sets 45 days for appeals. Utah's UCPA has no formal structured appeal process. In terms of timeline, the ICDPA is aligned with the more traditional eastern US state laws.

5. What happens if the controller has no structured DSAR process when the Attorney General investigates?
The AG notifies the controller and grants 90 days to cure (§ 715D.8(2)). If the controller cures the violation and provides an express written statement, no action is initiated. If not cured or if the statement is breached, the AG may seek penalties of up to US$ 7,500 per violation (§ 715D.8(3)). There is no private right of action (§ 715D.8(4)).

Ready to build a Privacy Portal for your site that complies with the ICDPA? Talk to our team.