Consumer Data Privacy
Iowa Consumer Data Privacy Law: Thresholds, Consumer Rights & Deadlines
What Iowa’s consumer data privacy law requires, maintained by Stauss PLLC. Last reviewed July 2026.
What You Need to Know
Iowa's law rivals Utah's as the most business-friendly in the country. The law does not contain a right to correction or a right to opt out of profiling, and it is unclear whether there is a right to opt out of targeted advertising. It also uses a narrow definition of sale. It is one of two laws that relies on notice and an opportunity to object to process sensitive data instead of consent. The law does not require data protection assessments or recognition of universal opt-out mechanisms, and it does not contain a data minimization provision.
Official law text
Who the law applies to
| Threshold | Requirement |
|---|---|
| Annual gross revenue | N/A |
| Consumers whose data is processed | 100,000 consumers 3.125% of state's 3.2 million population |
| Revenue from sale of personal data | Derives more than 50% of gross revenue from sale of personal data and controls or processes personal data of 25,000 or more consumers. |
Consumer rights under Iowa's law15
| Right | Provided? |
|---|---|
| Know | Yes |
| Access | Yes |
| Obtain list of third parties to which personal data was disclosed | No |
Data portabilitynoteRight applies only to data provided by the consumer to the controller and excludes personal data that is defined as “personal information” pursuant to Iowa’s Personal Information Security Breach Protection law that is subject to security breach protection. | Partial |
DeletenoteRight applies only to data provided by the consumer to the controller. | Partial |
| Correct inaccuracies | No |
Not be discriminated against for exercising rightsnoteA controller may still offer a different price, rate, level, quality, or selection of goods or services to a consumer, including offering goods or services for no fee, if the consumer has exercised the consumer’s right to opt out of the sale of personal data, or the offer is related to a consumer’s voluntary participation in a bona fide loyalty, rewards, premium features, discounts, or club card program. | Partial |
Opt-out of salenoteContains pseudonymous data carve out. | Partial |
Opt-out of targeted advertising/sharingnoteRight is not listed in consumer rights provision, but controllers must provide means to opt out. | Unclear |
| Opt-out of certain types of profiling | No |
| Opt-out of ADMT | No |
| Recognize opt-out signals | No |
| Revoke consent | No |
| Not process data in discriminatory manner | No |
| Appeal | Yes |
Categories treated as sensitive data8
- Racial or ethnic origin
- Religious beliefs
- Mental or physical health diagnosis
- Sexual orientation
- Citizenship or immigration status
- Genetic or biometric data for purposes of uniquely identifying an individual
- Personal data of known child
- Precise geolocation
note
Connecticut, Maryland, Oregon, and Virginia ban the sale of precise geolocation data.
How sensitive data must be treated1
- Provide Notice and Opportunity to Opt Out
Requirements for minors' data1
- Process personal data of children under 13 in accordance with COPPA or parental/legal guardian consent
Other notable provisions6
- Opt-out Request Can Be Verified
- Data Processing Agreements
- Privacy Policy
- Implement Reasonable Data Security Measures
- Attorney General Enforcement
- Right to Cure
note
90 day right to cure that does not sunset.
Key dates1
| Date | What happens |
|---|---|
| January 1, 2025 | Iowa's consumer data privacy law takes effect |
Questions about Iowa’s privacy law?
Stauss PLLC advises companies on state privacy, AI, and data broker compliance.
Contact Stauss PLLCThis page is provided for general informational purposes only, is not legal advice, and does not create an attorney-client relationship. State laws change frequently; coverage reflects this tool’s most recent update. Contact Stauss PLLC to confirm how these requirements apply to your organization.