The Iowa Consumer Data Protection Act (ICDPA, Iowa Code § 715D) has privacy notice requirements very similar to Utah's UCPA, with one important operational difference: the response deadline for consumer requests is 90 days, not 45.

This page covers one piece of the picture. For the full scope of the ICDPA — who must comply, the thresholds, the consumer rights and the penalties — start with our complete guide to the ICDPA and cookies.

For the Privacy Policy, this means the process described in the document for exercising rights must reflect this longer deadline. Iowa consumers will have to wait up to three months to receive a response, and the notice must be clear about this.

This article focuses exclusively on what the ICDPA requires from the Privacy Policy.

The law uses the term "privacy notice." Under § 715D.4(5), the controller must provide a notice that is "reasonably accessible, clear, and meaningful."

The notice must list the categories of personal data the controller processes (§ 715D.4(5)(a)).

Personal data under the ICDPA is any information linked or reasonably linkable to an identified or identifiable natural person (§ 715D.1(18)). This includes identifiers such as name, email, IP address, browsing history, and data that allows tracking a person.

De-identified data, aggregate data, and publicly available information are excluded.

The notice must explain the purpose for which data is processed (§ 715D.4(5)(b)).

The law does not specify that purposes must be highly detailed, but the requirement that the notice be "clear and meaningful" implies that generalities like "improve services" are insufficient.

The notice must describe how consumers can exercise the rights guaranteed by the ICDPA, including how to appeal a controller decision (§ 715D.4(5)(c)).

The four rights under the ICDPA are:

Confirm and access: confirm whether the controller processes data and access that data (§ 715D.3(1)(a)).

Deletion: request deletion of data the consumer provided to the controller (§ 715D.3(1)(b)).

Portability: obtain a copy of the data in a portable format (§ 715D.3(1)(c)).

Opt-out from data sales: refuse the sale of personal data (§ 715D.3(1)(d)).

The deadline that must be described: 90 days to respond from receipt of the request, with a possible extension of 45 more days with notification within the initial period (§ 715D.3(2)(a)).

The appeal process: the notice must describe how the consumer can appeal a denial decision, with a 60-day response deadline for appeals (§ 715D.3(3)). If the appeal is denied, the consumer must be informed of how to contact the Attorney General online.

The notice must identify the categories of personal data the controller shares with third parties, if any (§ 715D.4(5)(d)).

The notice must identify the categories of third parties with whom data is shared, if any (§ 715D.4(5)(e)).

The ICDPA does not require the level of detail about how each third party may process data that the OCPA demands. Identifiable categories are sufficient.

If the business sells data or engages in targeted advertising, § 715D.4(6) requires clear and conspicuous disclosure of that activity, with description of the method by which the consumer can exercise the opt-out for each activity.

Targeted advertising, per § 715D.1(28), consists of ads selected based on data obtained from the consumer's activities over time and across non-affiliated websites or applications.

Although opt-out from targeted advertising is not listed as a formal right in § 715D.3, the disclosure obligation in § 715D.4(6) creates the practical requirement to offer this opt-out in the privacy notice.

Under § 715D.4(7), the controller must establish secure and reliable means for consumers to submit rights requests, and describe those means in the privacy notice.

These means must:

Consider how consumers normally interact with the controller.

Ensure secure and reliable communication.

Allow authentication of the consumer's identity.

The controller may not require the consumer to create a new account to exercise their rights. It may require use of an existing account (§ 715D.4(7)).

Under § 715D.4(2), the controller may not process sensitive data without first presenting the consumer with a clear notice and offering an opt-out opportunity.

Sensitive data includes: racial or ethnic origin, religious beliefs, mental or physical health diagnosis, sexual orientation, citizenship or immigration status, genetic or biometric data for unique identification, data of known children, and precise geolocation data.

This opt-out model for sensitive data is identical to the UCPA's. It is less restrictive than the opt-in required by the CPRA, OCPA, VCDPA, and CTDPA.

For data of known children, the business must comply with COPPA (§ 715D.2(2)(r) and 715D.4(2)).

The Privacy Policy must:

Identify whether the business processes sensitive data.

Describe how the sensitive data notice is presented to consumers.

Explain how the consumer can exercise the opt-out from sensitive data processing.

Comparing with other laws:

No mandatory retention periods. The CPRA requires specifying how long each data category is retained. The ICDPA has no such requirement.

No detail about third parties. The OCPA requires describing how each third party may process data. The ICDPA requires only categories.

No right to correct to describe. Since the ICDPA does not provide this right, the policy does not need to describe it.

The 90-day deadline must be clearly described. Consumers familiar with VCDPA, OCPA, and CTDPA expect responses within 45 days. A notice that clearly states the ICDPA's 90-day deadline avoids unnecessary complaints.

Under § 715D.4(3), the business may not discriminate against consumers who exercise their rights. This includes denying goods or services, charging different prices, or offering different quality.

The exception is voluntary loyalty programs and situations where the consumer opted out of targeted advertising and the business adjusted prices accordingly.

Before initiating any action, the Iowa Attorney General must notify the controller and grant 90 days to cure (§ 715D.8(2)). This is the longest cure period of all US state privacy laws.

An outdated or incomplete Privacy Policy can be corrected within 90 days with the right processes. But structuring it correctly from the start is always more efficient.

AdOpt ensures that what is written in the Policy has real correspondence with what actually happens on the site.

The automatic scan identifies all active technologies, feeding the list of data categories and third parties. The consent management platform ensures the opt-out mechanism works as described.

Every interaction is logged. If the Attorney General requests evidence, the record is available.

Over 60,000 websites already run with AdOpt.

Privacy is not a banner. It is a position.

Want to build a Privacy Policy for your site that complies with the ICDPA? Talk to our team.

Visible and accessible link on all pages of the site.

Categories of personal data processed (§ 715D.4(5)(a)).

Purpose for processing each category (§ 715D.4(5)(b)).

How to exercise the 4 rights with channel and 90-day deadline (§ 715D.4(5)(c)).

Appeal process with 60-day response deadline (§ 715D.3(3)).

How to contact the Attorney General if appeal is denied (§ 715D.3(3)).

Categories of personal data shared with third parties (§ 715D.4(5)(d)).

Categories of third parties with whom data is shared (§ 715D.4(5)(e)).

Disclosure of data sales or targeted advertising with opt-out method (§ 715D.4(6)).

Request submission channel described, without requiring new account (§ 715D.4(7)).

Sensitive data treatment: clear notice and opt-out before processing (§ 715D.4(2)).

COPPA compliance for children's data (§ 715D.4(2)).

Non-discrimination policy (§ 715D.4(3)).

Free service for 2 requests per year per consumer (§ 715D.3(2)(c)).

1. Why must the ICDPA Privacy Policy clearly state the 90-day deadline?
Most consumers who have interacted with privacy notices from other jurisdictions expect responses within 45 days. The ICDPA establishes 90 days as the standard deadline (§ 715D.3(2)(a)), which is significantly different. A Policy that clearly describes this deadline helps manage expectations and avoids complaints from consumers expecting a faster response. Describing the correct deadline also demonstrates that the business knows its specific legal obligations.

2. Does the privacy notice need to mention the ICDPA's appeal process?
Yes. § 715D.4(5)(c) requires the notice to describe how consumers can exercise their rights "including how a consumer may appeal a controller's decision with regard to the consumer's request." This means the appeal process, with a 60-day response deadline (§ 715D.3(3)), must be described. If the appeal is denied, the notice should also indicate how the consumer can contact the Attorney General.

3. Does the ICDPA have the same free-service policy as the UCPA?
Not exactly. The ICDPA guarantees free service for 2 requests per consumer per 12-month period (§ 715D.3(2)(c)). The UCPA guarantees free service for only 1 request per 12-month period. The VCDPA also guarantees 2 free requests per year. The Privacy Policy must correctly reflect this number, as stating "free once per year" when the law guarantees 2 would be an inaccuracy that could generate complaints.

4. Does the ICDPA use the same opt-out model for sensitive data as the UCPA?
Yes. Both the ICDPA (§ 715D.4(2)) and the UCPA require only a clear notice and opt-out opportunity before processing sensitive data, without requiring active prior consent. This model differs from the opt-in required by the CPRA, OCPA, VCDPA, and CTDPA. A business already compliant with the UCPA on this point will be compliant with the ICDPA as well.

5. Does the ICDPA require the same level of detail about third parties as the OCPA?
No. The OCPA requires describing third parties at a level of detail that enables the consumer to understand what type of entity each third party is and how it may process data. The ICDPA (§ 715D.4(5)(d) and (e)) requires only the categories of data shared and the categories of third parties, without the additional detail the OCPA demands. Categories such as "digital advertising platforms" and "analytics tools" are sufficient under the ICDPA.

Ready to build a Privacy Policy for your site that complies with the ICDPA? Talk to our team.