Key Facts
Overview
The ICDPA is notable for two unique features among US state privacy laws: a 90-day cure period (the longest) and requiring only notice-and-opt-out for sensitive data rather than opt-in consent. It also has narrower consumer rights than most other states.
What This Means for Your Website
- Sensitive data requires only notice and opt-out, NOT opt-in consent (unique among US states)
- A 90-day cure period applies before enforcement action (permanent)
- No right to correct data or opt out of profiling or targeted advertising
- Consumer requests must be fulfilled within 90 days
Key Requirements
The Iowa AG enforces the ICDPA with penalties up to $7,500 per violation. The 90-day cure period is permanent. The notice-and-opt-out model for sensitive data makes Iowa one of the most business-friendly state privacy laws alongside Utah.
How ConsentStack Handles This
ConsentStack detects Iowa visitors and applies the appropriate consent model, implementing notice-and-opt-out for sensitive data categories per Iowa's unique requirements.
Penalties
Up to $7,500 per violation.
Key Requirements
- Clear privacy disclosures
- Notice and opt-out for sensitive data, NOT opt-in
- Consumer rights: access, delete, portability, opt out of sale
- 90-day response window for consumer requests
- Reasonable data security practices
Notable Provisions
- 90-day cure period, longest among US states
- Sensitive data requires only notice and opt-out (not opt-in), unique
- No right to correct data, opt out of profiling, or opt out of targeted advertising
Data Subject Rights
Confirm whether a controller is processing your personal data and access that data.
Have a controller delete the personal data you provided to it.
Obtain a copy of the personal data you previously provided to a controller, in a portable and, where technically practicable, readily usable format you can transmit to another controller, where the processing is automated (personal information covered by Iowa's data breach law is excluded).
Opt out of the sale of your personal data, which Iowa defines as an exchange of personal data for monetary consideration by the controller to a third party.
Appeal a controller's refusal to act on your request through an appeal process that must be conspicuously available and similar to the process for submitting requests.
If your appeal is denied, the controller must give you an online mechanism through which you can contact the Iowa Attorney General to submit a complaint.
Receive clear notice and an opportunity to opt out before a controller processes your sensitive data for a nonexempt purpose; this is a controller duty outside the request process, so no statutory response deadline applies.
A controller may not discriminate against you for exercising your rights, such as by denying goods or services, charging different prices or giving lower quality, though it may vary price or selection after you opt out of sale or within a bona fide loyalty, rewards, premium features, discounts or club card program.
A controller that engages in targeted advertising must clearly disclose it and how you can opt out; Iowa's list of consumer rights names only the opt-out of sale, so this right rests on that disclosure duty and carries no statutory response deadline.
US State Specifics
Other North America Regulations
Frequently Asked Questions
Stay compliant with ICDPA
ConsentStack helps you implement Opt-out consent for Iowa, United States automatically.