| name | iowa-consumer-privacy |
| title | Iowa Consumer Data Protection Act (ICDPA) |
| description | Iowa Consumer Data Protection Act (ICDPA) compliance. Effective January 1, 2025. Covers consumer rights (access, delete, opt-out), controller thresholds at 100,000 consumers, sensitive data opt-in consent, 90-day cure period, and AG-only enforcement. Iowa Code Chapter 715D. |
| author | mukul975 |
| author_url | https://github.com/mukul975/Privacy-Data-Protection-Skills/tree/main/plugins/privacy-skills-complete/skills/iowa-consumer-privacy |
| license | Apache-2.0 |
| version | 0.1.0 |
| execution_mode | open |
| jurisdiction | us |
| practice | data-protection |
| language | en |
Iowa Consumer Data Protection Act (ICDPA)
Overview
The Iowa Consumer Data Protection Act (ICDPA), codified as Iowa Code Chapter 715D (SF 262), was signed into law on March 28, 2023, and became effective January 1, 2025. Iowa follows a business-friendly model with fewer consumer rights than most states (no right to correct or right to portability), a 90-day cure period (the longest among state privacy laws), and AG-only enforcement. The ICDPA is considered one of the least restrictive comprehensive state privacy laws.
Applicability (§715D.2)
The ICDPA applies to persons that conduct business in Iowa or produce products or services targeted to Iowa consumers AND during a calendar year:
- Control or process personal data of at least 100,000 Iowa consumers; OR
- Control or process personal data of at least 25,000 Iowa consumers AND derive more than 50% of gross revenue from the sale of personal data.
Exemptions (§715D.3):
- State and local government entities
- GLBA-covered financial institutions (entity-level)
- HIPAA covered entities and business associates (entity-level)
- Nonprofit organizations
- Institutions of higher education
- Data governed by GLBA, HIPAA, FERPA, FCRA, DPPA, COPPA, Farm Credit Act
Liberty Commerce Inc. Assessment:
Liberty Commerce Inc. processes personal data of approximately 52,000 Iowa consumers. It does not meet either threshold but maintains monitoring as part of its multi-state privacy compliance program.
Consumer Rights (§715D.4)
Three Consumer Rights
Iowa provides fewer rights than most comprehensive state privacy laws:
- Right to Access (§715D.4(1)(a)): Confirm whether controller is processing personal data and access that data
- Right to Delete (§715D.4(1)(b)): Delete personal data provided by or obtained about the consumer
- Right to Opt Out (§715D.4(1)(c)):
- Sale of personal data
- Targeted advertising
Notable omissions:
- No right to correct inaccuracies
- No right to data portability
- No right to opt out of profiling
Response Requirements (§715D.5)
- Respond within 90 days (longest response window among state privacy laws)
- No extension provision — the 90-day period is the full window
- At least one free response per 12 months
