Open workspace

Guide · US state law

ICDPA: Iowa's privacy law, the leanest in the US

The Iowa Consumer Data Protection Act has applied since January 1, 2025 and is known for giving fewer rights than other state laws. In this guide you will understand who must comply, what the visitor can ask for, how targeted advertising works and what changes for a site with AdSense or Ad Manager.

Audit my site for the USRead the guide
  • ✓Based on Chapter 715D of the Iowa Code
  • ✓Practical examples for sites with ads
  • ✓Read-only scan, no changes to the site
100,000Iowa consumers per year: the main threshold of the law
90 daysto respond to requests, the longest period among state laws
90 daysto fix the violation after the attorney general's notice
$7,500maximum civil penalty per violation

What it is

A privacy law with the minimum of obligations

The Iowa Consumer Data Protection Act, or ICDPA, is Iowa's general privacy law. It was signed in 2023, is in Chapter 715D of the Iowa Code and took effect on January 1, 2025.

The law follows the Virginia model, but cut several pieces. There is no right to correct data. There is no data protection assessment requirement. There is no obligation to accept universal opt-out signals. And sensitive data works on the notice and opt-out model, not prior consent.

That does not mean the law is harmless for sites with ads. Those who exceed the thresholds must say, clearly and visibly, whether they sell data or do targeted advertising, and must explain how the visitor can opt out of these activities.

For those with visitors from several states, Iowa is rarely the strictest state. But it is good to know the differences so as not to promise on the privacy page rights your process does not deliver, nor forget what the law actually asks.

Checklist

What you need to meet

If the site exceeds the ICDPA thresholds, this is the basic list. Iowa asks for less than other states.

  1. Say that there is sale or targeted advertising

    Anyone who sells data or does targeted advertising must say so clearly and visibly and explain how the visitor opts out.

    Example

    Footer link: Do Not Sell or Share My Personal Information, leading to an opt-out screen.

  2. Publish a complete privacy notice

    The notice must be clear and easy to find. It lists the data processed, the purposes, the rights, how to appeal, the data shared and the categories of third parties.

    Example

    Include in the notice the channels for requests, such as a form and an email.

  3. Give notice before using sensitive data

    Iowa does not require consent for sensitive data. It requires a clear notice and a chance to opt out before use. A child's sensitive data follows COPPA.

    Example

    Before using precise location, show a notice with the option Do not use my location.

  4. Respond to requests within 90 days

    Respond within 90 days, with one extension of another 45 if you explain the reason. Do not require a new account for the request.

  5. Have an appeal process

    Anyone whose request was denied can appeal. Answer the appeal in writing within 60 days and, if you deny it, point to an online way to contact the attorney general.

  6. Keep the data secure

    The law requires reasonable administrative, technical and physical security practices for personal data.

  7. Pass the opt-out to Google

    Google does not require a CMP for US states. Use the US state regulations message, in Privacy & messaging, or turn on restricted data processing, RDP, in the tag for people who opted out. With GPP, Google reads the US National section for Iowa.

    Example

    AdSense or Ad Manager: Privacy & messaging, US state regulations card, Create. Then choose the sites and publish.

    // Só para o visitante que recusou
googletag.pubads().setPrivacySettings({
  restrictDataProcessing: true,
});

In practice

Right and wrong

Official tools

Certified CMPs and official links

Google does not require a certified CMP or GPP for US state laws. You can use Google's own message or turn on RDP in the tag.

Who must comply and definitions

The ICDPA thresholds and the law's key terms

The law applies to those who do business in Iowa or offer products and services directed to residents of the state and, in a calendar year, exceed one of the two thresholds below. A consumer is an Iowa resident acting as an individual, outside a commercial or employment context. The definitions are in section 715D.1.

100,000 consumers

Controls or processes personal data of at least 100,000 Iowa consumers.

25,000 and data sales

Controls or processes data of at least 25,000 consumers and gets more than 50% of gross revenue from the sale of personal data.

Personal data

Information linked, or reasonably linkable, to an identified or identifiable individual. De-identified, aggregated and public data are excluded.

Sensitive data

Racial or ethnic origin, religious belief, health diagnosis, sexual orientation, immigration status, genetic or biometric data that identify the person, data of a known child and precise geolocation.

Sale

Only the exchange of personal data for money with a third party. Other valuable consideration does not count, and transfers to processors, companies in the same group or at the consumer's request are excluded.

Targeted advertising

An ad chosen with data from the visitor's activity over time on other companies' sites and apps. Contextual ads, first-party ads and performance measurement are excluded.

People's rights

What the Iowa resident can and cannot ask for

Iowa's list of rights is the shortest among the state laws. The response can take up to 90 days, with one 45-day extension if needed and notified within the initial period. Two requests a year are free.

Confirm and access

Find out whether the company processes their data and get access to that data.

Delete what they provided

Ask for deletion of the data the consumer provided themselves. Data obtained from other sources is not in the text of this right.

Portability

Receive a copy of the data they provided, in a portable format, when the processing is automated.

Opt out of sale

Ask that the data not be sold. It is the only opt-out right that appears in the law's list of rights.

No right to correct

Iowa does not give the consumer the right to ask for correction of wrong data, unlike most states.

Appeal

If the request is denied, the consumer can appeal. The company responds in writing within 60 days and, if it denies again, shows how to complain to the attorney general.

Targeted advertising

Not on the list of rights, but the opt-out must exist

A common question about Iowa is whether the visitor can opt out of targeted advertising. The list of rights in section 715D.3 includes only the opt-out of the sale of data. There is no separate right to opt out of targeted ads, as there is in Virginia or Colorado.

But section 715D.4 creates a duty for the company: those who sell personal data to third parties or do targeted advertising must disclose this clearly and visibly, and also the way the consumer can opt out of that activity. In practice, a covered site must show the opt-out path for targeted ads.

Sensitive data follows the same notice and opt-out logic. Before processing sensitive data for a non-exempt purpose, the company must give clear notice and the opportunity to opt out. Data of known children follows the federal COPPA law.

So the practical setup of a site with ads ends up similar to other states: a visible opt-out link, a privacy page explaining the use of data for ads and the opt-out actually turning off personalization.

Site obligations

What a covered business must have working

  1. Privacy noticeThe notice must include the categories of data processed, the purpose, how to exercise rights and appeal, the categories of data shared with third parties and the categories of those third parties.
  2. Disclose sale and targeted adsIf the site sells data or does targeted advertising, it must say so clearly and visibly and explain how the visitor can opt out.
  3. Secure channel for requestsThe company must offer one or more secure and reliable means for requests, without requiring the consumer to create a new account.
  4. Notice before sensitive dataProcessing sensitive data requires clear notice and an opportunity to opt out, and children's data follows COPPA.
  5. Security and non-discriminationThe company must maintain reasonable security practices and cannot treat worse those who exercise their rights.
  6. Contracts with processorsVendors that process data on the business's behalf follow its instructions, under a contract with the rules of processing.

Enforcement and fines

The longest cure period in the country

Only the Iowa attorney general can enforce the law. The consumer cannot sue the company under it.

90 days to cure

Before any action, the attorney general sends a written notice pointing out the violations. The company has 90 days to cure.

Written statement

To close the case, the company must cure and state in writing that it did so and that the failure will not be repeated.

Up to $7,500 per violation

If the failure continues, the attorney general can seek a court order and a civil penalty of up to $7,500 per violation.

Investigation

The attorney general can demand documents and information from the company during the investigation.

Timeline

The ICDPA dates

Iowa allowed almost two years of preparation between signing and taking effect.

  1. 2023

    Signing

    Iowa becomes one of the first states, after California, Virginia, Colorado, Utah and Connecticut, to pass a general privacy law.

  2. January 1, 2025

    Entry into force

    The law takes effect, with exclusive enforcement by the attorney general.

  3. September 2025

    Google updates the GPP

    Google starts accepting version 2 of the GPP US National section, the path it reads for the opt-out in states like Iowa.

Sites with AdSense and Ad Manager

How the Iowa opt-out reaches Google

Iowa does not require the site to recognize universal opt-out signals, such as Global Privacy Control, or GPC. Even so, honoring GPC for all US traffic is a good practice, because several states require it and because it simplifies the CMP setup.

Google offers in AdSense and Ad Manager a US state regulations message, under Privacy & messaging, and Iowa is among the states covered. The message shows the Do Not Sell or Share link. When the visitor opts out, Google turns on restricted data processing, called RDP, and stops using previous behavior to choose ads.

There is an Iowa-specific section in the IAB Tech Lab GPP, but it is not on the list of sections accepted by Google. For Google, the path is the US National section: an opt-out of sale, sharing or targeted advertising in that section turns on RDP.

Another option is to turn on RDP in the tag itself, with the restrictDataProcessing parameter in GPT or the data-restrict-data-processing attribute in AdSense, only for those who requested an opt-out. The final test is always the same: the ad request must change after the opt-out.

In practice

What is and is not allowed in Iowa

Examples for a company that exceeds the law's thresholds and monetizes with programmatic ads.

Allowed

  • Showing contextual ads to those who opted out of sale or targeted advertising
  • Use Google's state regulations message to offer the opt-out link
  • Responding to requests within 90 days, notifying in advance if you need 45 more
  • Charging for repetitive or clearly unfounded requests, proving they are abusive
  • Applying the same opt-out and GPC policy to all US traffic

Not allowed

  • Doing targeted advertising without saying so on the privacy page and without explaining how to opt out
  • Requiring account creation for the visitor to request access or deletion
  • Processing sensitive data without clear notice and without an opportunity to opt out
  • Ignore the appeal of a consumer whose request was denied
  • Promising in the policy rights that Iowa does not give and that your process does not meet

Common errors

Where sites stumble with Iowa's law

The leanest law also has traps, especially for those who read only the list of rights.

Thinking there is no ad opt-out

Since the right does not appear in the list, the site offers no targeted advertising opt-out. But the duty to disclose and explain how to opt out exists.

Policy without targeted ads

The privacy page talks about cookies in general, but does not say the data is used for targeted advertising.

Message only for California

Google's opt-out message was set up only for California, and Iowa traffic never sees the link.

Iowa section alone in the GPP

The CMP sends only Iowa's state section, which Google does not read. Without US National, the opt-out does not reach Google ads.

Opt-out link that changes nothing

The visitor clicks, but ad requests stay the same, without RDP and without an opt-out in the GPP.

Miscounting the volume

The site counts only registered users. Cookies and ad identifiers also identify people and count toward the total.

In ConsentMode

What the audit checks for Iowa

  • Opens the site as a visitor from the United States and looks for the opt-out link in the footer, the menu and the privacy message.
  • Identifies the CMP or Google's state regulations message from the page code.
  • Reads the GPP string and checks whether the US National section exists and records the opt-out after the click.
  • Turns on the GPC signal in the audit browser and shows whether the page and ad requests react.
  • Checks whether the privacy page says there is targeted advertising or sale of data and explains how to opt out.
Run an auditSee everything that is checked

Frequently asked questions

In Iowa, can the visitor opt out of targeted advertising?

Iowa's list of rights includes only the opt-out of sale. But the law requires those who do targeted advertising to disclose it clearly and explain how the consumer can opt out of that activity. In practice, a covered site must offer that path.

Does Iowa require me to honor GPC?

No. The law does not provide for universal opt-out signals. But other states do, and most CMPs handle GPC for all US traffic.

Do I need a data protection assessment for Iowa?

No. Iowa's law does not require data protection assessments. If you are in other states that do, the assessment made for them is still necessary.

How long do I have to respond to a request?

Up to 90 days, with one 45-day extension if needed and notified within the initial period. Two requests a year from each consumer must be free.

Does Iowa require a consent banner?

No. The law uses the opt-out model even for sensitive data, with notice and an opportunity to opt out. For children, the federal COPPA law applies.

Does ConsentMode solve compliance with Iowa?

ConsentMode is not a CMP or a law firm. The audit shows what the site actually does with the opt-out link, the GPP and the privacy page, so you can fix it with your provider and your lawyer.

Library

Official sources

This guide was written from these official pages. Read them directly at the source:

Check whether your site's opt-out works for Iowa

The audit opens the site as a US visitor and shows what to fix, without changing anything.

Start the audit