Iowa
For Iowa, law name and abbreviation is Iowa Consumer Data Protection Act (ICDPA); effective date is January 1, 2025; consumer volume threshold is Controls or processes personal data of at least one hundred thousand consumers; revenue-from-data-sales threshold is Controls or processes personal data of at least twenty-five thousand consumers and derives over fifty percent of gross revenue from the sale of personal data; threshold combination logic is OR — during a calendar year does either of the following, recorded from its source on 2026-08-12.
- State
- Iowa our reading
- Law name and abbreviation
- Iowa Consumer Data Protection Act (ICDPA)
- Effective date
- January 1, 2025
- Consumer volume threshold
- Controls or processes personal data of at least one hundred thousand consumers verified
- Revenue-from-data-sales threshold
- Controls or processes personal data of at least twenty-five thousand consumers and derives over fifty percent of gross revenue from the sale of personal data verified
- Threshold combination logic
- OR — during a calendar year does either of the following verified
- Key exemptions
- State and political subdivisions; GLBA-regulated financial institutions; HIPAA-covered entities and business associates; nonprofit organizations; institutions of higher education
- Enforcement mechanism
- Attorney General; 90-day cure period; no private right of action
- Statute citation
- Iowa Code ch. 715D
- Notes
- Iowa follows the Virginia model closely. Unique feature: 90-day cure period (the longest among state privacy laws). Iowa does not include a right to correction of inaccurate personal data.
Values marked our reading are our classification of what the source says — the source does not print them in those words. The quote below is the evidence for each one; judge it yourself.
What the source says
This chapter applies to a person conducting business in the state or producing products or services that are targeted to consumers who are residents of the state and that during a calendar year does either of the following: a. Controls or processes personal data of at least one hundred thousand consumers. b. Controls or processes personal data of at least twenty-five thousand consumers and derives over fifty percent of gross revenue from the sale of personal data.
— legis.iowa.gov, retrieved 2026-08-12
Source
- legis.iowa.govhttps://www.legis.iowa.gov/docs/code/715D.pdf