# Iowa — US state consumer data privacy laws: applicability thresholds by state

For Iowa, law name and abbreviation is Iowa Consumer Data Protection Act (ICDPA); effective date is January 1, 2025; consumer volume threshold is Controls or processes personal data of at least one hundred thousand consumers; revenue-from-data-sales threshold is Controls or processes personal data of at least twenty-five thousand consumers and derives over fifty percent of gross revenue from the sale of personal data; threshold combination logic is OR — during a calendar year does either of the following, recorded from its source on 2026-08-12.

- **State:** Iowa _(our reading, not quoted from the source)_
- **Law name and abbreviation:** Iowa Consumer Data Protection Act (ICDPA)
- **Effective date:** January 1, 2025
- **Consumer volume threshold:** Controls or processes personal data of at least one hundred thousand consumers _(verified: appears in the quote below)_
- **Revenue-from-data-sales threshold:** Controls or processes personal data of at least twenty-five thousand consumers and derives over fifty percent of gross revenue from the sale of personal data _(verified: appears in the quote below)_
- **Threshold combination logic:** OR — during a calendar year does either of the following _(verified: appears in the quote below)_
- **Key exemptions:** State and political subdivisions; GLBA-regulated financial institutions; HIPAA-covered entities and business associates; nonprofit organizations; institutions of higher education
- **Enforcement mechanism:** Attorney General; 90-day cure period; no private right of action
- **Statute citation:** Iowa Code ch. 715D
- **Notes:** Iowa follows the Virginia model closely. Unique feature: 90-day cure period (the longest among state privacy laws). Iowa does not include a right to correction of inaccurate personal data.

## What the source says

> This chapter applies to a person conducting business in the state or producing products or services that are targeted to consumers who are residents of the state and that during a calendar year does either of the following: a. Controls or processes personal data of at least one hundred thousand consumers. b. Controls or processes personal data of at least twenty-five thousand consumers and derives over fifty percent of gross revenue from the sale of personal data.

## Source

- https://www.legis.iowa.gov/docs/code/715D.pdf

Last verified: 2026-08-12. Review by: 2026-11-10.
Part of [US state consumer data privacy laws: applicability thresholds by state](https://referencesource.org/state-data-privacy-applicability-thresholds/).