Last updated: January 2025

Please note this is a highlighted overview and not a complete overview of privacy laws for this state. If you would like a complete review of this state's privacy laws or a multi-state privacy compliance cheat sheet on specific topics, please contact Vivien Peaden at vpeaden@bakerdonelson.com.

Disclaimer: These materials do not constitute legal advice and should not be substituted for the advice of legal counsel.

The Iowa Consumer Data Protection Act (Iowa CDPA)

Effective Date: January 1, 2025

1. Applicability Thresholds:

Subject to certain entity-level and data-level exemptions, the Iowa CDPA applies to a legal or natural person doing business in Iowa or producing products/services that are targeted to residents of Iowa that during a calendar year, controls or processes personal data of:

• 100,000+ Iowa consumers; or
• 25,000+ Iowa consumers and derive more than 50 percent of revenue from the sale of personal data.

2. Key Definitions:

Sales of Personal Data: Narrowly defined as "the exchange of personal data for monetary consideration by the Controller to a third party" subject to a few exemptions.

3. Business Obligations:

Iowa CDPA imposes additional obligations on individuals or legal entities that determine the purpose and means of processing personal information (Controller):

• Data Processing Agreement (DPA): Processing activities by a supplier (known as Processor) shall be governed by a DPA between the Controller and Processor.
• Privacy Notice: Yes, a Controller must provide consumers with a privacy notice, including:
  • Disclosure of Data Sales and Targeted Advertising: Controllers must "clearly and conspicuously disclose" the fact that they sell personal data to third parties or engage in targeted advertising, as well as the manner through which a consumer may opt out of such activity. Notably, Iowa CDPA is one of those outliers that do not provide a definition for "profiling" or require a Controller to conduct any data protection assessment.

4. Consumer Rights:

Under the Iowa CDPA, Iowa consumers have the right to:

• Confirm whether a Controller is processing their personal data and provide access to that data;
• Notably, the Iowa CDPA does not provide consumers the right to correct inaccuracies in their personal data;
• Delete personal data subject to certain exceptions;
• Obtain a copy of or summary of their personal data provided to the Controller in a readily usable format; and
• Opt-out of the sale of personal data (but no right to opt out of target advertising or profiling).

5. Enforcement and Penalties:

Private Right of Action: None.

Penalties: The state attorney general has sole authority to enforce the statute, at a maximum of $7,500 per violation.

Cure Period: 90-day cure period, which is longer than the standard 30-day cure period seen in other state privacy laws; unlike some states, this is a permanent cure period that does not have a cutoff date.