---------------------------
Title: Iowa Consumer Data Protection Act (ICDPA): Overview of Rights, Requirements, and Compliance Actions
URL: https://www.cookiebot.com/en/iowa-consumer-data-protection-act-icdpa/
---------------------------

# Iowa Consumer Data Protection Act (ICDPA): Overview of Rights, Requirements, and Compliance Actions

Iowa's Consumer Data Protection Act (ICDPA) has applied since January 2025 to any organization processing the personal data of Iowa residents, wherever that organization is based. This guide explains the law in terms familiar to GDPR-experienced teams, covering where it's lighter (than the GPDR and many other U.S. state laws), where it isn't, and what changes if you're already compliant with EU and other U.S. rules.

## At a Glance

- The ICDPA has applied since January 1, 2025, and reaches any organization processing personal data of Iowa residents, regardless of where the business is located.
- It applies once you control or process the personal data of 100,000+ Iowa residents a year, or 25,000+ residents where over half your revenue comes from selling personal data.
- Unlike GDPR, the ICDPA is opt-out throughout, including for sensitive data, differing from the GDPR and various U.S. laws.
- Iowa grants no right to rectification and no right to object to profiling, rights available under GDPR, and, in a narrower form, under stricter U.S. state laws like California's CPRA.
- Enforcement sits solely with the Iowa Attorney General: no regulator-style audits, no data protection authority, no private right of action, and a permanent 90-day cure period before any fine.
- Global Privacy Control and similar universal opt-out signals are not legally required under the ICDPA, unlike under some other U.S. state laws.

## U.S State Laws Reach Farther than You May Think

It's easy to assume a state-level U.S. law is only relevant to companies based in each specific state, or, at most, U.S.-based companies, but the ICDPA — like most comprehensive state privacy laws — applies based on whose data you process, not where your organization sits. If your site or app processes the personal data of Iowa residents in sufficient volume, the law reaches you whether you're headquartered in Des Moines or Düsseldorf.

Iowa signed the Iowa Consumer Data Protection Act (Senate File 262) into law on March 28, 2023, becoming the sixth U.S. state with a comprehensive consumer privacy statute. It took effect, and became enforceable, on January 1, 2025. Among the 20-plus U.S. states that have passed comprehensive privacy legislation, Iowa's is consistently ranked among the more business-friendly, alongside Utah's.

## How the ICDPA Compares to Other Privacy Frameworks

Iowa's law doesn't exist in isolation, and it isn't only worth measuring against GDPR. For a business already navigating EU rules, California's stricter state law, or both, the ICDPA sits at the lighter end of everything on this table. But it's worth resisting the assumption that compliance with either of the other two automatically covers Iowa in every particular.

Rights, Requirements, and EnforcementGDPR (EU)CCPA (California)ICDPA (Iowa)Consent ModelOpt-in for most processing; explicit consent for special category dataOpt-out of sale/sharing; opt-in required for minors under 16Opt-out throughout, including sensitive dataRight to CorrectionYesYesNoRight to Limit/Object to ProfilingYesLimited, via opt-out and use-limitation rightsNoData PortabilityYesYesYesRegulatorDedicated data protection authority (each Member State)California Privacy Protection Agency and Attorney GeneralAttorney GeneralPrivate Right of ActionYes, in most Member StatesLimited to certain data breachesNo

In practice, this means an organization with a mature [GDPR](https://www.cookiebot.com/en/gdpr/) program, or one already built to [California's standard](https://www.cookiebot.com/en/what-is-ccpa/), is very likely already exceeding what Iowa requires. Where it's worth double-checking rather than assuming: Iowa's specific applicability thresholds, its narrower list of consumer rights, and its distinct penalty and cure-period mechanics.

## Who Does the ICDPA Apply To?

The ICDPA protects the personal data of Iowa's roughly three million residents. It applies to any organization — regardless of location — that does business in Iowa or offers goods and services to Iowa residents, once it meets either of these thresholds in a calendar year:

- Processing the personal data of at least 100,000 Iowa consumers, **or**
- Processing the personal data of at least 25,000 Iowa consumers **and** deriving more than 50 percent of gross revenue from selling personal data

There's no separate company-wide revenue threshold, which is a departure from how some other frameworks scope applicability. A small business can be in scope purely on consumer-data volume, regardless of its total turnover.

As with the GDPR and most other comprehensive U.S. state laws, "consumer" here excludes people acting in an employment or B2B context. The ICDPA is aimed at Iowa residents in their capacity as private individuals.

## Key Terms, Mapped to Familiar Concepts

The ICDPA's vocabulary will feel familiar whether your reference point is the GDPR or [California's CPRA](https://www.cookiebot.com/en/cpra/), even where the underlying mechanics differ. Here's how the core terms line up.

### Personal Data Under the ICDPA

Defined much like GDPR's "personal data" and CPRA's "personal information": "any information that is linked or reasonably linkable to an identified or identifiable natural person." Publicly available, aggregated, and de-identified data are excluded, similar to how both frameworks treat anonymized data.

### Sensitive Data Under the ICDPA

The ICDPA's sensitive data category sits close to both GDPR's special category data and CPRA's "sensitive personal information," with a couple of additions:

- Racial or ethnic origin
- Religious beliefs
- Mental or physical health diagnosis
- Sexual orientation
- Citizenship or immigration status
- Genetic or biometric data processed to identify a person uniquely
- Any personal data of a known child
- Precise geolocation data (within a 1,750-foot/533.5-meter radius)

The key difference from the GDPR is that under the ICDPA, this data still follows an opt-out model rather than requiring the affirmative, opt-in consent that [Art. 9 GDPR](https://gdpr.eu/article-9-processing-special-categories-of-personal-data-prohibited/) demands for special category data. California splits the difference, where the CPRA gives consumers a right to limit use of sensitive personal information, which is closer to an opt-out mechanism than GDPR's opt-in, but still more protective than Iowa's plain notice-and-opt-out approach.

### Controllers and Processors Under the ICDPA

The ICDPA uses the same controller/processor split as GDPR, with near-identical definitions: a controller determines the purposes and means of processing, and a processor acts on a controller's instructions. CPRA uses different vocabulary — "business" and "service provider" — for broadly the same roles, so don't assume the terminology maps one-to-one across all three frameworks even where the underlying concept does.

### What Counts as a "Sale" Under the ICDPA

A sale is defined as exchanging personal data for monetary consideration. Notable carve-outs include data shared with processors, data shared to fulfil a consumer's own request, data shared with an affiliate, publicly self-disclosed data, and data transferred as part of a merger or acquisition. This concept has no GDPR equivalent at all, since GDPR doesn't distinguish "sale" from processing generally. It's inherited directly from the U.S. state-law tradition CCPA started, and CPRA's own "sale" definition (extended to cover "sharing" as well) will be the closer reference point if you're already working from a California compliance build.

## Exemptions to the ICDPA

Federal sectoral laws take Iowa data out of ICDPA scope where they already apply: [HIPAA](https://www.cookiebot.com/us/hipaa-compliance-healthcare-websites/), [COPPA](https://www.cookiebot.com/us/coppa-compliance-requirements-checklist/), the Family Educational Rights and Privacy Act, the Driver's Privacy Protection Act, and the Farm Credit Act, along with certain health and research records. Also exempt:

- State government entities
- Financial institutions and affiliates under the [Gramm-Leach-Bliley Act (GLBA)](https://www.cookiebot.com/us/gramm-leach-bliley-act-glba/)
- Higher education institutions
- Nonprofit organizations

## What Consumer Rights Does the ICDPA Grant?

Four rights, each narrower in scope than their GDPR or CPRA counterparts. A parent or guardian exercises these on behalf of a known child.

1. **Access** — confirm and access personal data a controller holds.
2. **Deletion** — request deletion of data the consumer provided.
3. **Portability** — obtain data in a usable, portable format.
4. **Opt-out of sale** — decline the sale of personal data.

What stands out is the absence, not the presence: no right to correction, no right to object to profiling or automated decision-making, and no requirement for opt-in consent or a use-limitation mechanism for sensitive data. There's also no private right of action, so individual Iowa consumers can't bring their own claims, unlike data subjects under GDPR in most EU member states, and unlike California consumers in the narrow set of circumstances (data breaches) where the CPRA allows it.

## Operational Requirements Under the ICDPA

Several distinct obligations follow from that scope, starting with how quickly a business has to act once a consumer actually makes a request.

### Responding to ICDPA Requests Under the ICDPA

Controllers must give consumers a clear way to exercise their rights, generally through a privacy notice, and must respond to verified requests within 90 days, which is a longer window than GDPR's one-month default, and double CPRA's standard 45 days (itself extendable to 90). There's no equivalent to GDPR's mandatory data protection impact assessments or a required data protection officer function, and nothing resembling California's CPPA rulemaking apparatus either.

### Purpose Limitation and Data Minimization Under the ICDPA

Processing must stay within the purposes disclosed to the consumer and be "reasonably necessary" for them. This is a concept that will feel familiar from GDPR's purpose limitation and data minimization principles, and echoes similar language in most other comprehensive U.S. state laws, even though the ICDPA doesn't use identical terminology to either.

### ICDPA Security

Controllers must apply reasonable administrative, technical, and physical safeguards appropriate to the volume and sensitivity of the data. This is conceptually close to GDPR's "appropriate technical and organisational measures" and to the "reasonable security" standard most U.S. state laws, including CPRA, also use, if less prescriptive in the statutory text than either.

### ICDPA Consent, in Practice

Because Iowa runs on opt-out, most processing — including of sensitive data — doesn't need prior consumer consent. A clear notice and a working opt-out mechanism will generally suffice. The one place affirmative consent is required is children's data. Personal data known to belong to a child under 13 needs parental or guardian consent under COPPA, since the ICDPA classifies all of a known child's data as sensitive automatically.

### Nondiscrimination Under the ICDPA

Controllers can't penalize a consumer for exercising ICDPA rights, such as by denying site access solely for opting out. Declining to offer a feature that genuinely depends on the data in question isn't itself discriminatory, and reasonable incentive programs (loyalty schemes, for instance) remain permitted provided they're not disproportionate.

### Transparency Under the ICDPA

Privacy notices need to cover the purposes of processing, the categories of data processed, any categories of data or third parties involved in sharing, and how a consumer exercises or appeals a rights decision. This is broadly consistent with [Art. 13 GDPR](https://gdpr.eu/article-13-personal-data-collected/) and [Art. 14 GDPR](https://gdpr.eu/article-14-personal-data-not-obtained-from-data-subject/), and with the disclosure requirements CPRA and most other U.S. state laws impose, though with a shorter list of mandatory disclosures than either.

### Vendor Contracts Under the ICDPA

Processor contracts must specify processing instructions, data types and purposes, duration, retention and deletion terms, and each party's obligations, including subcontractor accountability, which is functionally similar to what [Art. 28 GDPR](https://gdpr.eu/article-28-processor/) requires of a GDPR data processing agreement, and to the service-provider contract terms CPRA requires of California businesses.

### Universal Opt-Out Signals and the ICDPA

The ICDPA doesn't reference [Global Privacy Control (GPC)](https://www.cookiebot.com/us/global-privacy-control-gpc/) or any other universal opt-out mechanism, unlike the law in Calfornia and a growing number of other states. If your consent setup already recognizes GPC for other jurisdictions, nothing in Iowa's law obliges you to extend that recognition to Iowa consumers specifically, though many organizations do so anyway for operational simplicity.

## ICDPA Enforcement: No Regulator, No Fines Without Warning

There is no Iowa data protection authority. Enforcement runs solely through the Attorney General's office, which is the model most U.S. states use. California is the exception, with its dedicated [CPPA](https://www.cookiebot.com/en/escalating-cppa-enforcement/) (publicly known as CalPrivacy) alongside the state AG. There's also no equivalent to the supervisory-authority complaint process GDPR data subjects can use. Iowa consumers can report suspected violations to the AG, but can't initiate their own legal action.

### The ICDPA Cure Period

Before any enforcement action, businesses get written notice and a 90-day window to fix the issue, longer than the 30 days typical of most other U.S. states, and Connecticut's 60 days. Unlike some states where this cure right has since expired, Iowa's is permanent. Once fixed and confirmed in writing, no further action follows.

### ICDPA Penalties

Civil penalties, brought only after the cure period lapses, cap at USD 7,500 per violation. This is a fixed figure under Iowa's statute, not adjusted for inflation. GDPR fines can reach the higher of EUR 20 million or 4 percent of global annual turnover, while CPRA's own penalties, unlike Iowa's, do adjust for inflation (next adjustment is due in 2027) and currently stand at USD 2,663 (unintentional) or USD 7,988 (intentional) per violation. Per-violation, Iowa's exposure is modest next to either.

## Where This Leaves You, Whatever You're Already Compliant With

If your organization runs a mature GDPR consent program, extending it to cover Iowa mainly means confirming a few gaps rather than building from scratch: check that your privacy notice covers the ICDPA's specific disclosure list, that your opt-out mechanism for data sales actually works for Iowa traffic, and that your rights-request process can accommodate Iowa's 90-day (plus 45) timeline alongside GDPR's stricter one-month default.

If your starting point is California instead — a CPRA-compliant build, say, rather than a GDPR one — the gap is narrower still, since CPRA already covers most of what Iowa asks for and more. The main things worth confirming: that Iowa consumers get the plain opt-out your ICDPA notice promises even though your CPRA build may lean on "limit the use" language instead, and that your request-handling workflow recognizes Iowa's 90-day (plus 45) window as distinct from CPRA's own timelines rather than assuming one covers the other by default.

Either way, a [consent management platform (CMP)](https://www.cookiebot.com/us/cookie-consent-solution/) that supports geotargeting can apply the right rules automatically based on where a visitor is located. An Iowa resident sees Iowa-appropriate choices, an EU visitor gets the full GDPR-standard experience, and a Californian gets the CPRA-specific mechanics, all without maintaining separate compliance builds side by side. That's particularly useful if Iowa isn't the only U.S. state on your radar. The same setup can extend to California, [Virginia](https://www.cookiebot.com/us/virginia-vcdpa/), [Colorado](https://www.cookiebot.com/us/cpa-colorado-privacy-act/), [Connecticut](https://www.cookiebot.com/us/ctdpa-connecticut-data-privacy-act/), and the rest of the growing list of state laws in force.

For anything specific to your organization's exposure, particularly where U.S. and EU obligations interact, qualified legal counsel remains the right call. A business-friendly law is still a legal obligation.

## One state, across the U.S., or global requirements?

Whether you do business locally or around the world, Cookiebot™ CMP is flexible and scalable to grow with you. Customized banners, geolocation functionality, automatic updates when laws change, and more. Try it free for 14 days.

[Start Free Trial](https://admin.cookiebot.com/signup?lang=en)

*Usercentrics A/S (Cookiebot™) does not provide legal advice, and information is provided for educational purposes only. We always recommend engaging qualified legal counsel or privacy specialists regarding data privacy and protection issues and operations.*

## The most used solution for compliant use of cookies and online tracking

- Used on **2.4M** — websites and apps
- Manages **8.8B** — monthly user consents
- Supports **47+** — languages
- Powers **600,000+** — customers

[Dynamic listing — customer logos loaded at runtime]

## Summary

Iowa's Consumer Data Protection Act (ICDPA) has applied since January 2025 to any organization processing the personal data of Iowa residents, wherever that organization is based. This guide explains the law in terms familiar to GDPR-experienced teams, covering where it's lighter (than the GPDR and many other U.S. state laws), where it isn't, and what changes if you're already compliant with EU and other U.S. rules.

---

## Footer

### Products
- [Cookiebot™ Consent Solution](https://www.cookiebot.com/en/cookie-consent-solution/)
- [Audience Survey](https://www.cookiebot.com/en/audience-survey-add-on/)
- [Usercentrics for Wix](https://www.cookiebot.com/en/cookiebot-for-wix-by-usercentrics-app/)
- [Usercentrics Cookiebot plugin for WordPress](https://www.cookiebot.com/en/new-wp-cookie-plugin/)
- [Cookiebot CMP for Shopify](https://www.cookiebot.com/en/cookiebot-cmp-for-shopify/)
- [Cookie checker](https://www.cookiebot.com/en/cookie-checker/)
- [Usercentrics products](https://usercentrics.com/)
- [Pricing](https://www.cookiebot.com/en/pricing/)

### Regulations
- [DMA (EU)](https://www.cookiebot.com/en/digital-markets-act-dma/)
- [GDPR (EU)](https://www.cookiebot.com/en/gdpr/)
- [CCPA (California)](https://www.cookiebot.com/en/what-is-ccpa/)
- [VCDPA (Virginia)](https://www.cookiebot.com/en/virginia-vcdpa/)
- [LGPD (Brazil)](https://www.cookiebot.com/en/lgpd/)
- [TCF v2.4 (IAB)](https://www.cookiebot.com/en/tcf/)
- [Google Consent Mode (EU)](https://www.cookiebot.com/en/cookiebot-cmp-google-consent-mode/)
- [Microsoft UET Consent Mode](https://www.cookiebot.com/en/microsoft-consent-mode-cmp/)
- [View all regulations](https://www.cookiebot.com/en/regulations-and-frameworks/)

### Partners
- [Become an affiliate](https://www.cookiebot.com/en/affiliates/)
- [Affiliate Login](https://app.impact.com/login.user)
- [Become a partner](https://www.cookiebot.com/en/resellers/)
- [Find a partner](https://www.cookiebot.com/en/cookiebot-reseller/)

### Resources
- [Blog](https://www.cookiebot.com/en/blog/)
- [Customer stories](https://www.cookiebot.com/en/customer-stories/)
- [Customer directory](https://www.cookiebot.com/en/cookiebot-customer-directory/)
- [Digital Markets Act Hub](https://www.cookiebot.com/en/digital-markets-act-dma-resources/)
- [Google Consent Mode Hub](https://www.cookiebot.com/en/google-consent-mode-resources/)
- [Google Consent Mode V2 certification](https://courses.usercentrics.com/course/google-consent-mode-v2)
- [Google Consent Audit Fixes](https://www.cookiebot.com/en/google-consent-audit-fixes/)
- [Cookie Banner Cost Calculator](https://www.cookiebot.com/en/cookie-banner-pricing-calculator/)

### Company
- [About us](https://www.cookiebot.com/en/about/)
- [Careers](https://usercentrics.com/career/)
- [Support](https://support.cookiebot.com/hc/en-us/)
- [Developer documentation](https://www.cookiebot.com/en/developer/)

©2026 Cookiebot. All rights reserved. Cookiebot is a trademark of     Usercentrics     A/S. Usercentrics A/S is registered in Denmark. Company reg. no.: 34624607. Do Not Sell or Share My Personal InformationData Subject RequestsManage Your Preferences

[Privacy Policy](https://www.cookiebot.com/en/privacy-policy/) · [Terms of Service](/en/terms-of-service/) · [Cookie Declaration](https://www.cookiebot.com/en/cookie-declaration/) · [Data Processing Agreement](https://www.cookiebot.com/en/data-processing-agreement/) · [Legal Notice](https://www.cookiebot.com/en/legal-notice/) · [Accessibility Statement](https://www.cookiebot.com/en/accessibility-statement-wcag-compliance/)