Iowa (US)
Full entry AI-checked Checked 5 November 2026
Read this together with United States (federal), which also applies.
| Law | Citation | Status | In force from |
|---|---|---|---|
| Iowa Consumer Data Protection Act | Iowa Code ch. 715D (2023 Iowa Acts ch. 17, SF 262) | In force | 1 January 2025 |
| Personal Information Security Breach Protection | Iowa Code ch. 715C | In force | 1 July 2008 |
| Conversational AI services Act | 2026 Iowa Acts ch. 1068 (SF 2417) | Enacted, not yet in force | 1 July 2027 |
| Age verification for sites with content pornographic for minors | 2026 Iowa Acts ch. 1143 (HF 864) | In force | 1 July 2026 |
- Iowa Consumer Data Protection Act: Unchanged in the Iowa Code 2026. Bills to amend it in 2025 (SF 143 and HF 503) did not pass.
- Conversational AI services Act: Signed on 2 May 2026. The Act took effect on 1 July 2026, but its duties apply from 1 July 2027.
- Age verification for sites with content pornographic for minors: Signed on 1 June 2026. It names no start date, so it took effect on 1 July 2026 under Iowa Code section 3.7.
Regulators
Section titled “Regulators”What builders must do
Section titled “What builders must do”Who it covers
Section titled “Who it covers”Applies to businesses that operate in Iowa or target Iowa residents and, in a calendar year, control or process personal data of at least 100,000 Iowa consumers, or at least 25,000 while earning over half their gross revenue from selling personal data. Non-profits, colleges, the state, GLBA financial institutions and HIPAA-regulated bodies are exempt. Employees, job applicants and people acting in a business role aren’t covered.
Sources: legis.iowa.gov/docs/code/715D.2.pdf · legis.iowa.gov/docs/code/715D.1.pdf
Lawful bases
Section titled “Lawful bases”No GDPR-style lawful bases. Controllers give a privacy notice and honour rights to confirm and access data, delete data the consumer provided, get a portable copy and opt out of sale, within 90 days (extendable once by 45). There’s no right to correct data and no right to opt out of profiling. Sensitive data needs clear notice and a chance to opt out, rather than opt-in consent.
Sources: legis.iowa.gov/docs/code/715D.3.pdf · legis.iowa.gov/docs/code/715D.pdf
Consent age for online services
Section titled “Consent age for online services”A child is anyone under 13. A known child’s parent or guardian exercises the child’s rights, and sensitive data about a known child must be processed as COPPA requires. The privacy law has no separate teen rule for targeted advertising or sale.
Sources: legis.iowa.gov/docs/code/715D.1.pdf · legis.iowa.gov/docs/code/715D.3.pdf
Children
Section titled “Children”Data from a known child is sensitive data, handled under COPPA. From 1 July 2027, public chatbots built mainly to simulate conversation (not customer-service, built-in, narrow-topic, internal or voice-assistant bots) must tell users known or reasonably certain to be under 18 that they’re AI, take reasonable measures against sexual content and human-like claims, avoid unpredictable rewards and offer privacy tools. Since 1 July 2026, sites where 33% or more of content is pornographic for minors must verify age and not keep the identifying data.
Sources: legis.iowa.gov/docs/code/715D.pdf · legis.iowa.gov/docs/publications/iactc/91.2/CH1068.pdf · legis.iowa.gov/docs/publications/iactc/91.2/CH1143.pdf
Cookies and similar technologies
Section titled “Cookies and similar technologies”No cookie-consent rule. A controller that sells personal data or uses it for targeted advertising must say so clearly and explain how to opt out, but the listed rights cover opting out of sale only. The law doesn’t require honouring a universal opt-out signal such as Global Privacy Control.
Sources: legis.iowa.gov/docs/code/715D.pdf · legis.iowa.gov/docs/code/715D.3.pdf
Electronic marketing
Section titled “Electronic marketing”Iowa adds no consent rule for marketing emails, texts or calls, so federal CAN-SPAM and the TCPA apply. Its own law makes it a crime to falsify routing or header information when sending unsolicited bulk email.
Sources: legis.iowa.gov/docs/code/716A.2.pdf
Breach notification
Section titled “Breach notification”Tell affected Iowa residents in the most expeditious manner possible and without unreasonable delay. If more than 500 Iowans must be told, notify the Attorney General’s Consumer Protection Division in writing within 5 business days of telling them. Notice isn’t needed if a documented investigation finds no reasonable likelihood of financial harm; keep that record for 5 years. A business holding data for another must tell the owner immediately. Businesses subject to and complying with GLBA or HIPAA rules are exempt.
Sources: legis.iowa.gov/docs/code/715C.2.pdf · iowaattorneygeneral.gov/for-consumers/security-breach-notifications
Registration and fees
Section titled “Registration and fees”The privacy law has no registration or fee, and we found no Iowa data broker registry.
Sources: legis.iowa.gov/docs/code/715D.pdf
Data protection officer
Section titled “Data protection officer”No duty to appoint a data protection officer.
Sources: legis.iowa.gov/docs/code/715D.pdf
International transfers
Section titled “International transfers”Iowa law has no cross-border transfer rules (federal rules are in us-federal). Processors must work under a contract that sets instructions, confidentiality, deletion or return of data, and terms for subcontractors.
Sources: legis.iowa.gov/docs/code/715D.5.pdf
Impact assessments
Section titled “Impact assessments”Iowa doesn’t require data protection assessments.
Sources: legis.iowa.gov/docs/code/715D.pdf
Automated decisions and AI
Section titled “Automated decisions and AI”There’s no right to opt out of profiling or automated decisions. From 1 July 2027, operators of public chatbots built mainly to simulate conversation (see children for exclusions) must adopt a suicide and self-harm protocol that points users to crisis services, must not present the chatbot as a licensed mental health provider, and must disclose that it’s AI where a reasonable person could think it’s human.
Sources: legis.iowa.gov/docs/publications/iactc/91.2/CH1068.pdf
Penalties
Section titled “Penalties”Only the Attorney General enforces. Before suing, the AG must give 90 days’ written notice to cure, and this right to cure doesn’t expire. After that, civil penalties are up to $7,500 per violation, plus injunctions. There’s no private right of action. From 2027, chatbot violations cost $1,000 each, up to $500,000 per operator. Age-verification violations cost up to $1,000 each (each access counts), capped at $10,000 a day.
Sources: legis.iowa.gov/docs/code/715D.8.pdf · legis.iowa.gov/docs/publications/iactc/91.2/CH1068.pdf · legis.iowa.gov/docs/publications/iactc/91.2/CH1143.pdf
History
Section titled “History”| Date | Change |
|---|---|
| 5 November 2026 | First entry. Checked against official sources with AI assistance, then corrected after an independent AI-assisted review. |
Report a change
Section titled “Report a change”If a law, a date or a figure here has changed, open an issue with the official source. The data lives in laws/full/us-ia.yaml.