Privacy
Iowa Consumer Data Protection Act (Iowa Code chapter 715D, titled Consumer Data Protections)
The chapter applies to a person conducting business in Iowa or producing products or services targeted to Iowa residents that, during a calendar year, controls or processes personal data of at least 100,000 consumers, or controls or processes personal data of at least 25,000 consumers and derives over 50 percent of gross revenue from the sale of personal data (§ 715D.2(1)). A consumer is an Iowa resident acting in an individual or household context, not in a commercial or employment context (§ 715D.1(7)). The chapter does not apply to the state or its political subdivisions, Gramm-Leach-Bliley financial institutions and their affiliates, persons subject to and complying with HIPAA and HITECH rules, nonprofit organizations, or institutions of higher education (§ 715D.2(2)). Governor Reynolds approved S.F. 262 on March 28, 2023, and section 10 of the act made it effective January 1, 2025.
What the website needs
- A controller must provide a reasonably accessible, clear, and meaningful privacy notice that lists the categories of personal data processed, the purpose of processing, how consumers may exercise their rights and appeal a decision, the categories of personal data shared with third parties, and the categories of third parties with whom personal data is shared (§ 715D.4(5)).
- A controller that sells personal data to third parties or engages in targeted advertising must clearly and conspicuously disclose that activity and the manner in which a consumer may opt out of it (§ 715D.4(6)).
- A controller must establish secure and reliable means for consumers to submit rights requests, describe them in the privacy notice, and may not require a consumer to create a new account to make a request (§ 715D.4(7)).
- A controller may not process sensitive data for a nonexempt purpose without first presenting the consumer with clear notice and an opportunity to opt out, and sensitive data about a known child must be processed in accordance with the federal Children's Online Privacy Protection Act (§ 715D.4(2)).
