Iowa Consumer Data Protection Act (Iowa Code Chapter 715D) Reference Guide

A person doing business in Iowa or offering products or services targeted to its residents is within chapter 715D when, in a calendar year, it processes data of at least 100,000 consumers. An alternative covers at least 25,000 consumers plus more than 50% of gross revenue from selling personal data. The second path needs both conditions. Iowa Code: § 715D.2

The law excludes certain entities and categories of information, including specified government, financial, health, nonprofit and higher-education contexts. The legal team must decide how these apply to the organization and each relevant data flow. Iowa Code: scope and exemptions

Use the business’s calendar-year consumer count and sale-derived revenue. Website traffic by itself does not establish either threshold.

A qualifying Iowa resident may confirm and access personal data, delete data the resident provided, obtain a portable copy of certain provided data, and opt out of the sale of personal data. The law does not enumerate a general right to correct data or to opt out of targeted advertising and profiling in its rights section. A controller ordinarily has 90 days to respond, with one 45-day extension when justified and timely explained. Iowa Code: § 715D.3

Before nonexempt sensitive-data processing, Iowa requires clear notice and an opportunity to opt out. Known children’s sensitive data is handled under COPPA. Controllers also need reasonable security, a clear privacy notice, a secure request route and disclosures about sale or targeted advertising. Iowa Code: § 715D.4

Iowa defines a sale as an exchange of personal data to a third party for monetary consideration, with listed exclusions for processors, affiliates, requested services and other circumstances. A continuing ad request after an opt-out is something to examine, but it is not automatically an Iowa statutory sale. Iowa Code: § 715D.1

The statute defines targeted advertising and requires a conspicuous disclosure when a controller engages in it. Its consumer-rights section, however, expressly names a sale opt-out, not a general advertising opt-out. Counsel should examine recipients, payments, contracts and the purpose of each flow before assigning an Iowa violation. Iowa Code: § 715D.4(6) Iowa Code: § 715D.3(1)(d)

Chapter 715D requires a secure and reliable route for consumer rights, including the sale opt-out. It does not expressly require every controller to recognize a universal Global Privacy Control browser signal. A multistate business may choose to honor GPC across jurisdictions; that is a separate architectural choice. Iowa Code: § 715D.4(7) Iowa Code: § 715D.3

Test consent rejection and GPC in separate browser sessions, then compare the results. For Iowa-specific proof, also test the site’s actual direct sale opt-out and document what happened to flows classified as sales.

The Iowa Attorney General has exclusive enforcement authority. Before filing an action, the Attorney General must provide 90 days’ written notice identifying the alleged violation. If the business cures and gives the required written assurance, no action is initiated for that violation. A continued or renewed violation can lead to an injunction and a civil penalty of up to $7,500 per violation. Iowa Code: § 715D.8

Your legal team decides whether the company is covered, which transfers count as monetary sales, and what other duties apply. The technical team implements that classification across direct scripts, tag manager and downstream vendors.

Use separate browser sessions to compare the site’s initial behavior, its response to a direct opt-out, and its response to Global Privacy Control where relevant to your review. Record the page URL, test time, browser settings and exact choice made so the result can be reproduced.

Inspect cookies and network requests before and after each choice. Record which requests continue, their destinations and the controls involved. Browser evidence can help diagnose an implementation; it cannot establish statutory applicability, the legal purpose of every transfer or organization-wide compliance.

Legal interpretation, applicability, exemptions, notices, vendor contracts, rights procedures and organizational governance belong with qualified privacy counsel.

This guide uses the Iowa Legislature’s 2026 codified chapter and the enrolled bill for its effective date. It distinguishes the expressly stated sale opt-out from targeted-advertising disclosure.

Prepared by Etalon Editorial Team. Last reviewed September 27, 2026. Material corrections may be sent to contact@etalondata.com.

Etalon is not a law firm and does not provide legal advice. A passing scan or certificate does not guarantee that an organization satisfies every legal obligation.

Technical testing records website behavior. Your legal and privacy team remains responsible for thresholds, exemptions, transfer classification, disclosures, rights requests, contracts and governance.