Does Iowa have a comprehensive privacy law? Yes. Iowa’s consumer data protection law (SF 262), signed on March 28, 2023, has been in effect since January 1, 2025.
- Status: In Effect
- Law: Iowa consumer data protection law, often called the Iowa Consumer Data Protection Act (SF 262, 2023; 2023 Iowa Acts ch. 17; Iowa Code ch. 715D)
- Signed: March 28, 2023 · Effective: January 1, 2025
- Applies to: Persons that conduct business in Iowa or produce products or services targeted to Iowa residents and that, during a calendar year, control or process the personal data of at least 100,000 consumers, or of at least 25,000 consumers while deriving over 50% of gross revenue from the sale of personal data
- Cure period: Yes; 90 days after the Attorney General’s written notice; the law sets no end date
- Enforcement: Iowa Attorney General (exclusive); injunction and civil penalties of up to $7,500 per violation; no private right of action
- Last verified: November 4, 2026 · Official source: Iowa Code chapter 715D
- Related: Iowa Consumer Data Protection Act (ICDPA) guide; State privacy laws that took effect in 2025
Iowa’s law gives Iowa consumers the right to confirm whether their personal data is processed, to access and delete personal data they provided, to obtain a portable copy, and to opt out of the sale of their personal data. Controllers must give a privacy notice, secure personal data, and give consumers notice and a chance to opt out before processing sensitive data. The law exempts the state, financial institutions subject to the Gramm-Leach-Bliley Act, HIPAA-regulated entities, nonprofit organizations and institutions of higher education.
The Attorney General must give a controller or processor 90 days’ written notice and a chance to cure before bringing an action. For more detail, see our Iowa Consumer Data Protection Act guide.