iowa-consumer-privacy

name	iowa-consumer-privacy
title	Iowa Consumer Data Protection Act (ICDPA)
description	Iowa Consumer Data Protection Act (ICDPA) compliance. Effective January 1, 2025. Covers consumer rights (access, delete, opt-out), controller thresholds at 100,000 consumers, sensitive data opt-in consent, 90-day cure period, and AG-only enforcement. Iowa Code Chapter 715D.
author	mukul975
author_url	https://github.com/mukul975/Privacy-Data-Protection-Skills/tree/main/plugins/privacy-skills-complete/skills/iowa-consumer-privacy
license	Apache-2.0
version	0.1.0
execution_mode	open
jurisdiction	us
practice	data-protection
language	en

Iowa Consumer Data Protection Act (ICDPA)

Overview

The Iowa Consumer Data Protection Act (ICDPA), codified as Iowa Code Chapter 715D (SF 262), was signed into law on March 28, 2023, and became effective January 1, 2025. Iowa follows a business-friendly model with fewer consumer rights than most states (no right to correct or right to portability), a 90-day cure period (the longest among state privacy laws), and AG-only enforcement. The ICDPA is considered one of the least restrictive comprehensive state privacy laws.

Applicability (§715D.2)

The ICDPA applies to persons that conduct business in Iowa or produce products or services targeted to Iowa consumers AND during a calendar year:

1. Control or process personal data of at least 100,000 Iowa consumers; OR
2. Control or process personal data of at least 25,000 Iowa consumers AND derive more than 50% of gross revenue from the sale of personal data.

Exemptions (§715D.3):

• State and local government entities
• GLBA-covered financial institutions (entity-level)
• HIPAA covered entities and business associates (entity-level)
• Nonprofit organizations
• Institutions of higher education
• Data governed by GLBA, HIPAA, FERPA, FCRA, DPPA, COPPA, Farm Credit Act

Liberty Commerce Inc. Assessment: Liberty Commerce Inc. processes personal data of approximately 52,000 Iowa consumers. It does not meet either threshold but maintains monitoring as part of its multi-state privacy compliance program.

Consumer Rights (§715D.4)

Three Consumer Rights

Iowa provides fewer rights than most comprehensive state privacy laws:

1. Right to Access (§715D.4(1)(a)): Confirm whether controller is processing personal data and access that data
2. Right to Delete (§715D.4(1)(b)): Delete personal data provided by or obtained about the consumer
3. Right to Opt Out (§715D.4(1)(c)):
   • Sale of personal data
   • Targeted advertising

Notable omissions:

• No right to correct inaccuracies
• No right to data portability
• No right to opt out of profiling

Response Requirements (§715D.5)

• Respond within 90 days (longest response window among state privacy laws)
• No extension provision — the 90-day period is the full window
• At least one free response per 12 months