ICDPA requirements
Iowa's law took effect January 1, 2025 and sits with Utah at the lighter end of the state statutes. It applies to controllers handling data on 100,000 Iowa consumers, or 25,000 where more than half of revenue comes from selling personal data. Consumers may opt out of the sale of personal data and of targeted advertising, though the latter is framed as a notice obligation, and sensitive data may be processed after notice and an opportunity to opt out rather than opt-in consent. There is no universal opt-out requirement and no private right of action. The Attorney General enforces, with a permanent 90-day cure period, the longest of any state, and penalties of up to $7,500 per violation.
Other US State Privacy Laws
See what your sites and apps actually send
Get a free site analysis: every tracker, mapped to the laws that apply to it.