Iowa’s New Consumer Privacy Law Takes Effect in 2025: Here’s What to Know

An upcoming new year means a slew of new laws poised to take effect as soon as the calendar switches to January 1st. In Iowa specifically, a law Governor Kim Reynolds signed back in March 2023 will take effect, and it will make Iowa one of only six states to pass comprehensive consumer privacy legislature.

Governor Kim Reynolds signed Senate File 262 into law on March 28th, 2023. The law, known as the Iowa Consumer Data Protection Act (IACDPA), is predicated on business-friendly consumer privacy protection, but is also missing a couple key attributes, per Global Privacy Blog's website.

Get our free mobile app

First, let's breakdown what the law actually is. The IACDPA applies to any individual or entity who either conducts business in Iowa or produces products/services that are targeted to residents in the state. The guidelines are as follows:

• controls or processes personal data of at least 100,000 Iowa residents; or
• controls or processes personal data of at least 25,000 Iowa residents and derives over 50% of its gross revenue from the sale of personal data.

The IACDPA is strictly applicable to entities that target Iowa residents as opposed to those who provide services to the residents in the state. It applies to personal data collected from a natural person who is a resident of the state.

Iowa's law is very similar to that of other state privacy laws, like Utah and Colorado, in several different realms.

For data subject rights, the Iowa Privacy Law offers individuals the right to access, deletion, portability, and opt out of the sale of their data by entities. However, Iowa's new law doesn't grant individuals the right to correct their data upon sale (or "monetary consideration").

The IACDPA gives controllers 90 days to respond to rights requests, which is double the window of time offered by other state laws like Utah. The law also requires "that businesses provide notice and the ability to opt out of the processing of sensitive personal data," per Global Privacy Blog's website.

Furthermore, Global Privacy Blog's website analyzes the new Iowa Privacy Law as similar to various other states. It's worth noting that Iowa is a very early adopter in this realm. Over 15 other states are considering comprehensive privacy statues, which will undoubtedly vary in size and scope. Read more about the Iowa Consumer Data Protection Act (IACDPA) taking effect here.