Your Iowa consumer data rights
In effect
Iowa's consumer data protection law gives Iowa residents some rights over the personal data that covered businesses collect about them. It has been in effect since January 1, 2025.
- Who or what it protects
- Iowa residents acting as individuals or households, not in a business or job context, in their dealings with businesses that process the personal data of at least 100,000 Iowa consumers a year, or of at least 25,000 while earning more than half of their gross revenue from selling personal data. Government bodies and financial institutions covered by federal banking privacy law are among those exempt.
- What you can do
- You can confirm whether a business processes your personal data and see it. You can delete the personal data you gave the business, and get a copy of the data you gave it in a form you can take elsewhere. You can opt out of the sale of your data. A business must give you clear notice and a chance to opt out before it processes your sensitive data. Use the method in the company's privacy notice. It must respond within 90 days, which it can extend once by 45 days, and you get two free responses a year. If it declines, you can appeal; it has 60 days to answer, and if it denies the appeal it must give you an online way to contact the Iowa Attorney General to submit a complaint.
- Limits and eligibility
- Iowa's law has no right to correct your data. Deletion covers only data you gave the business, not data it obtained elsewhere. The opt-out covers the sale of your data only. Only the Iowa Attorney General enforces the law, after giving the business 90 days to fix a violation; it gives you no right to sue.
- Who oversees it
- Iowa Attorney General
- The law
- Iowa Consumer Data Protection Act
Checked against the official sources on October 6, 2026. Links last checked November 1, 2026.