Iowa Consumer Data Protection Act – Compliance Guide
The ICDPA takes effect on January 1, 2025. If your business collects personal data from Iowa residents, you may need to comply. This page explains the basics in plain English.
Covers controllers processing personal data of Iowa residents, subject to thresholds and exemptions.
🎯 Who Must Comply
- Businesses offering goods or services to Iowa residents
- Controllers/processors of personal data under contract
Common Exemptions:
- Public entities
- Data under federal sectoral regimes when in scope
📋 Key Requirements
- Privacy disclosures and contact method
- Consumer rights: access, deletion, portability (varies)
- Opt-out for targeted advertising and sale
- Sensitive data processing limitations/consent
- Processor agreements
⚠️ Penalties & Enforcement
- Enforcing Authority: Iowa Attorney General
- Penalty Range: Civil penalties per violation
- Cure Period: Cure periods may be available; check current AG policy.
✅ How to Prepare for Iowa Compliance
- Verify what data you collect and why
- Update privacy notice and rights instructions
- Implement consent/opt-out UX for ads/trackers
💡 Pro Tip: Start with steps 1-3 to cover 80% of compliance requirements quickly.
📅 Iowa Privacy Law Timeline
🚨 NOW - Before January 1, 2025
Implement privacy policy, cookie consent, and basic data handling procedures.
📋 January 1, 2025 - Law Goes Live
Full compliance required. Enforcement may begin immediately.
✅ Ongoing - Stay Compliant
Monitor for updates, handle user requests, maintain documentation.
❓ Common Iowa Privacy Law Questions
Do I need to comply if I don't have customers in Iowa?
If your website receives any visitors from Iowa, you may need to comply. This includes people who visit your site while traveling, working remotely, or just browsing online.
What counts as "personal data" under ICDPA?
Personal data typically includes email addresses, IP addresses, location data, cookies/tracking IDs, and any information that can identify a person directly or indirectly.
How much will compliance cost for a small business?
Basic compliance (privacy policy + cookie banner + user rights) typically costs $20-100/month using automated tools. Compare this to potential fines of Civil penalties per violation.
Check Your Iowa Privacy Compliance
Run a free scan to catch privacy gaps before enforcement.
Run Free Privacy Compliance Scan →