--------------------------- Title: Iowa Consumer Data Protection Act (ICDPA): Privacy Compliance Overview for U.S. Businesses URL: https://www.cookiebot.com/us/iowa-consumer-data-protection-act-icdpa/ --------------------------- # Iowa Consumer Data Protection Act (ICDPA): Privacy Compliance Overview for U.S. Businesses The Iowa Consumer Data Protection Act (ICDPA) has been enforceable since January 1, 2025. This guide covers who it applies to, the rights it gives Iowa consumers, and the compliance and penalty rules businesses need to plan around, including the state's unique 90-day cure period. ## At a Glance - The ICDPA has been enforceable since January 1, 2025. - It applies to businesses that control or process the personal data of 100,000+ Iowa consumers a year, or 25,000+ consumers where more than half of revenue comes from selling personal data. - Consumers can access, delete, and port their data, and opt out of its sale, but the ICDPA does not include a right to correction or a right to opt out of profiling. - Sensitive data follows an opt-out model rather than requiring opt-in consent, which sets Iowa apart from most other state privacy laws. - The Iowa Attorney General is the only enforcer, backed by a permanent 90-day cure period and civil penalties of up to $7,500 per violation. - The ICDPA does not require businesses to honor Global Privacy Control or any other universal opt-out signal. ## Where the ICDPA Stands Today Iowa became the sixth state to pass a comprehensive consumer privacy law when Governor Reynolds signed the Iowa Consumer Data Protection Act (Senate File 262) on March 28, 2023. The law took effect and became enforceable on January 1, 2025. Iowa's earlier attempt at a comprehensive privacy law failed in 2020, but the state came back with a statute widely regarded, alongside Utah's, as one of the more business-friendly privacy laws among the 20-plus states with comprehensive privacy regulations. That reputation holds up, with no right to correct data, no opt-out for profiling, and no private right of action for consumers. ## What Is the ICDPA, and Who Does It Protect? The ICDPA protects the privacy rights of Iowa's approximately three million residents and sets obligations for any company operating in the state, or offering goods and services to Iowa residents, that handles their personal data. Like California's laws, Iowa defines a "consumer" as a resident acting outside of a commercial or employment context, so B2B and employee data generally fall outside its scope. The law runs on an opt-out model, consistent with most other comprehensive U.S. state privacy laws. Businesses must tell consumers what data they collect, why, and who they share it with, and must let consumers decline that collection and processing. Controllers and any processors they work with are also required to implement reasonable security safeguards. ## How the ICDPA Defines Its Key Terms Iowa's law leans on the standard vocabulary used across most state privacy statutes. Getting these definitions right matters because they determine exactly what your compliance obligations cover. ### What Counts as Personal Data? The ICDPA defines personal data as "any information that is linked or reasonably linkable to an identified or identifiable natural person." Publicly available information, aggregated data, and de-identified data all fall outside that definition. ### What Counts as Sensitive Data? Sensitive data under the ICDPA includes information revealing: - Racial or ethnic origin - Religious beliefs - A mental or physical health diagnosis - Sexual orientation - Citizenship or immigration status - Genetic or biometric data processed to uniquely identify a person - Personal data collected from a known child - Precise geolocation data (accurate within a radius of 1,750 feet/533.5 meters) ### Who Counts as a Controller, and Who Counts as a Processor? A **controller** is "a person that, alone or jointly with others, determines the purpose and means of processing personal data." In practice, this is your business if you're deciding why and how consumer data gets used. A **processor** is "a person that processes personal data on behalf of a controller," typically a vendor or service provider acting on your instructions. ### What Counts as a "Sale" of Data? The ICDPA defines a sale as "the exchange of personal data for monetary consideration by the controller to a third party." Several categories are carved out of that definition, including data shared with a processor, data shared to fulfill a consumer's own request, data shared with an affiliate, data the consumer made public themselves, and data transferred as part of a merger or acquisition. ## Who Has to Comply, and Who's Exempt Two separate questions decide whether the ICDPA touches your business: whether you meet its processing thresholds, and whether your organization or data falls under one of its exemptions regardless. ### Applicability Thresholds You need to comply with the ICDPA if, during a calendar year, your business: - Controls or processes the personal data of at least 100,000 Iowa consumers, **or** - Controls or processes the personal data of at least 25,000 Iowa consumers **and** derives more than 50 percent of gross revenue from selling personal data Notably, Iowa doesn't set a revenue-only threshold the way some states do. A company's total annual revenue doesn't exempt it from the law on its own. What matters is the volume (and, in the second bucket, the source) of the personal data it processes. ### Exemptions The ICDPA exempts data already governed by federal law, including [HIPAA](https://www.cookiebot.com/us/hipaa-compliance-healthcare-websites/), [COPPA](https://www.cookiebot.com/us/coppa-compliance-requirements-checklist/), the Family Educational Rights and Privacy Act, the Driver's Privacy Protection Act, and the Farm Credit Act, along with health records and human-subjects research data covered elsewhere. It also exempts: - State government entities - Financial institutions and their affiliates under the [Gramm-Leach-Bliley Act (GLBA)](https://www.cookiebot.com/us/gramm-leach-bliley-act-glba/) - Institutions of higher education - Nonprofit organizations ## Consumer Rights Under the ICDPA Iowa consumers get four rights. Where a child is involved, a parent or legal guardian exercises these on the child's behalf. 1. **Right to access**: confirm whether a controller is processing their data, and access it, subject to some exceptions 2. **Right to deletion**: request deletion of data they provided to the controller 3. **Right to data portability:** get a copy of their data in a usable, portable format 4. **Right to opt out**: decline the sale of their personal data What's conspicuously missing, compared to most other state laws: a right to correct inaccurate data, a right to opt out of profiling or automated decision-making, opt-in consent for sensitive data, and, for California residents, a private right of action. When did you last update your privacy policy? Data privacy regulations require your privacy policy to be clear, accessible, and up to date. That includes changes to your data processing, technologies in use, a regulatory requirements. With our free Privacy Policy Generator, create a comprehensive and customized policy for your website in minutes. [Generate Privacy Policy](https://www.cookiebot.com/us/free-privacy-policy-generator/) ## What Consumers Exercising ICDPA Rights Means Operationally Controllers must tell consumers how to exercise their rights, typically through the privacy notice on their website, and must respond to a verified consumer request within 90 days. That's extendable by another 45 days in cases with a valid reason. The ICDPA doesn't require a formal data protection function or privacy risk assessments, which is a meaningfully lighter operational lift than states like Colorado or Connecticut impose. ### ICDPA Purpose Limitation Controllers may process data only for purposes they've disclosed, and only where that processing is "reasonably necessary," i.e., relevant, adequate, and proportionate to the stated purpose. ### ICDPA Data Security Controllers must protect the confidentiality, integrity, and availability of personal data through reasonable administrative, technical, and physical safeguards, scaled to the nature and volume of data involved. ### ICDPA Consent Because Iowa uses an opt-out model, businesses generally don't need consumer consent before collecting or processing data, including sensitive data — consumers instead need clear notice and a working opt-out. The one exception is children's data: before processing personal data known to belong to a child under 13, a controller needs consent from a parent or guardian under COPPA, since the ICDPA automatically treats all of a known child's data as sensitive. ### ICDPA Nondiscrimination Controllers can't discriminate against a consumer for exercising ICDPA rights, for example, denying site access solely because someone opted out of data collection. That said, a site can decline gracefully if certain features genuinely depend on cookies or data the consumer has opted out of; that's not itself discriminatory. Voluntary incentive programs, such as loyalty discounts, are permitted, provided the incentive is reasonable rather than a disguised penalty for not participating. ### ICDPA Transparency Privacy notices must disclose the purposes of processing, the categories of personal data processed, the categories of personal data (and third parties) involved in any sharing, and how consumers can exercise or appeal decisions about their rights. ### ICDPA Third-Party Contracts Contracts with processors need to spell out processing instructions, the type and purpose of the data involved, its duration, retention and deletion terms, and each party's responsibilities, including for subcontractors. ### No Universal Opt-Out Requirement Under the ICDPA Unlike California, the ICDPA doesn't reference [Global Privacy Control (GPC)](https://www.cookiebot.com/us/global-privacy-control-gpc/) or any other universal opt-out signal. If your compliance program already honors GPC for California users, nothing in Iowa's law requires you to extend that same recognition to Iowa consumers, though many U.S. businesses do so anyway to keep a single, simpler compliance posture across states, particularly as GPC requirements expand with states' new legislation. ## ICDPA Enforcement and Penalties Only the Iowa Attorney General can enforce the ICDPA. There's no private right of action, so individual consumers can't sue over a violation directly, though they can report suspected violations to the AG's office. ### ICDPA Cure Period Businesses get a 90-day cure period after written notice of an alleged violation, which is longer than the 30 days typical elsewhere, and Connecticut's 60 days. This cure right is permanent under Iowa's statute, so it hasn't sunset the way some other states' cure periods have. Once a business fixes the issue and confirms in writing that it won't recur, the AG takes no further action. ### ICDPA Penalties If a controller or processor doesn't cure a violation, the AG can bring a civil action, with penalties of up to USD 7,500 per violation, directed to Iowa's consumer education and litigation fund. That figure is a fixed statutory cap, and doesn't adjust for inflation the way [California's CPRA](https://www.cookiebot.com/us/cpra/) penalties do (which have since risen to USD 2,663 and USD 7,988 per violation under CPI adjustment, and are due for adjustment again in 2027). ## Getting Compliant with the ICDPA Since the ICDPA is opt-out by default, most of the operational lift is about notice and choice rather than consent collection: a clear privacy notice, a working opt-out mechanism for data sales and targeted advertising, and a process for handling access, deletion, and portability requests within the 90-day window. A [consent management platform (CMP)](https://www.cookiebot.com/us/cookie-consent-solution/) helps by automatically detecting cookies and tracking technologies on your site, presenting the required disclosures, and enabling you to configure banners by geography so Iowa consumers see Iowa-relevant choices while consumers elsewhere see what applies to them. If your business also serves [California](https://www.cookiebot.com/us/what-is-ccpa/), [Virginia](https://www.cookiebot.com/us/virginia-vcdpa/), [Colorado](https://www.cookiebot.com/us/cpa-colorado-privacy-act/), [Connecticut](https://www.cookiebot.com/us/ctdpa-connecticut-data-privacy-act/), or any of the other states with comprehensive privacy laws now in force, that same geotargeting capability lets you manage all of them from a single setup rather than maintaining separate systems per state. ## Is Your Organization Actually Ready for the ICDPA? If you're already compliant with a stricter state law, such as California's CPRA, you're very likely meeting Iowa's requirements without extra work. If Iowa is the first comprehensive privacy law your business needs to address, start with the applicability thresholds above, then work through the notice, opt-out, and rights-request pieces in order. Data privacy advocates have pushed for Iowa to strengthen the ICDPA over time, and further amendments are plausible as the law matures. But because Iowa has no private right of action, that pressure won't come from consumer litigation the way it has elsewhere. Any changes will move at the pace of the state legislature. For anything specific to your organization's risk profile, qualified legal counsel is the right call, even for a law with Iowa's business-friendly reputation. ## Manage Delaware's data collection, notice, and opt-out requirements with Cookiebot™ And 20+ other state privacy laws. Customize your consent banner in 5 minutes for your brand, ICDPA requirements, and other relevant privacy laws. Try it free for 14 days. [Start trial](https://manage.cookiebot.com/en/signup) *Usercentrics A/S (Cookiebot™) does not provide legal advice, and information is provided for educational purposes only. We always recommend engaging qualified legal counsel or privacy specialists regarding data privacy and protection issues and operations.* ## The most used solution for compliant use of cookies and online tracking - Used on **2.4M** — websites and apps - Manages **8.8B** — monthly user consents - Supports **47+** — languages - Powers **600,000+** — customers [Dynamic listing — customer logos loaded at runtime] ## Summary The Iowa Consumer Data Protection Act (ICDPA) has been enforceable since January 1, 2025. This guide covers who it applies to, the rights it gives Iowa consumers, and the compliance and penalty rules businesses need to plan around, including the state's unique 90-day cure period. --- ## Footer ### Products - [Cookiebot™ Consent Solution](https://www.cookiebot.com/us/cookie-consent-solution/) - [Audience Survey](https://www.cookiebot.com/us/audience-survey-add-on/) - [Usercentrics for Wix](https://www.cookiebot.com/us/cookiebot-for-wix-by-usercentrics-app/) - [Usercentrics Cookiebot plugin for WordPress](https://www.cookiebot.com/us/new-wp-cookie-plugin/) - [Cookiebot CMP for Shopify](https://www.cookiebot.com/us/cookiebot-cmp-for-shopify/) - [Cookie checker](https://www.cookiebot.com/us/cookie-checker/) - [Usercentrics products](https://usercentrics.com/us/) - [Pricing](https://www.cookiebot.com/us/pricing/) ### Regulations - [DMA (EU)](https://www.cookiebot.com/us/digital-markets-act-dma/) - [GDPR (EU)](https://www.cookiebot.com/us/gdpr/) - [CCPA (California)](https://www.cookiebot.com/us/what-is-ccpa/) - [VCDPA (Virginia)](https://www.cookiebot.com/us/virginia-vcdpa/) - [LGPD (Brazil)](https://www.cookiebot.com/us/lgpd/) - [TCF v2.4 (IAB)](https://www.cookiebot.com/us/tcf/) - [Google Consent Mode (EU)](https://www.cookiebot.com/us/cookiebot-cmp-google-consent-mode/) - [Microsoft UET Consent Mode](https://www.cookiebot.com/us/microsoft-consent-mode-cmp/) - [View all regulations](/us/regulations-and-frameworks/#united-states-state&united-states-federal) ### Partners - [Become an affiliate](https://www.cookiebot.com/us/affiliates/) - [Affiliate Login](https://app.impact.com/login.user) - [Become a partner](https://www.cookiebot.com/us/resellers/) - [Find a partner](https://www.cookiebot.com/us/cookiebot-reseller/) ### Resources - [Blog](https://www.cookiebot.com/us/blog/) - [Customer stories](https://www.cookiebot.com/us/customer-stories/) - [Customer directory](https://www.cookiebot.com/us/cookiebot-customer-directory/) - [Digital Markets Act Hub](https://www.cookiebot.com/us/digital-markets-act-dma-resources/) - [Google Consent Mode Hub](https://www.cookiebot.com/us/google-consent-mode-resources/) - [Google Consent Mode V2 certification](https://courses.usercentrics.com/course/google-consent-mode-v2) - [Google Consent Audit Fixes](https://www.cookiebot.com/us/google-consent-audit-fixes/) - [Cookie Banner Cost Calculator](https://www.cookiebot.com/us/cookie-banner-pricing-calculator/) ### Company - [About us](https://www.cookiebot.com/us/about/) - [Careers](https://usercentrics.com/career/) - [Support](https://support.cookiebot.com/hc/en-us/) - [Developer documentation](https://www.cookiebot.com/us/developer/) ©2026 Cookiebot. All rights reserved. Cookiebot is a trademark of Usercentrics A/S. Usercentrics A/S is registered in Denmark. Company reg. no.: 34624607. Do Not Sell or Share My Personal InformationData Subject RequestsManage Your Preferences [Privacy Policy](https://www.cookiebot.com/us/privacy-policy/) · [Terms of Service](/en/terms-of-service/) · [Cookie Declaration](https://www.cookiebot.com/us/cookie-declaration/) · [Data Processing Agreement](/us/data-processing-agreement/) · [Legal Notice](https://www.cookiebot.com/us/legal-notice/) · [Accessibility Statement](/en/accessibility-statement-wcag-compliance/)