ICDPA Compliance: The Iowa Consumer Data Protection Act, Handled
Iowa's law is among the most business-friendly, with a generous 90-day response and cure window. ConsentPixel makes compliance a one-pixel install.
The Iowa Consumer Data Protection Act (ICDPA) gives Iowa residents rights over their personal data under a notably business-friendly framework. ConsentPixel — Privacy · Verified handles opt-outs, privacy documents, and audit-ready logs so ICDPA compliance is one pixel away.
What is the ICDPA?
The Iowa Consumer Data Protection Act took effect on January 1, 2025. It grants Iowa residents rights over their personal data and imposes obligations on businesses that meet its thresholds. Along with Utah's UCPA, the ICDPA is among the most business-friendly state privacy laws: a longer response window, lighter sensitive-data obligations, and a generous cure period.
The ICDPA follows an opt-out model. For sensitive data, rather than requiring opt-in consent, it generally requires clear notice and an opportunity to opt out — similar to Utah's approach. There is no private right of action.
Who must comply
- Businesses that conduct business in Iowa or target Iowa residents and, during a calendar year, either:
- Control or process the personal data of at least 100,000 consumers; or
- Control or process the personal data of at least 25,000 consumers and derive over 50% of gross revenue from the sale of personal data.
- Standard exemptions apply (HIPAA, GLBA, nonprofits, higher education, government, and others).
What the ICDPA requires
- Privacy notice: Provide a clear, accessible privacy notice describing data practices and consumer rights.
- Consumer rights: Honor access, deletion, portability, and opt-out of the sale of personal data and targeted advertising. (The ICDPA notably does not include a standalone right to correct.)
- Opt-out mechanisms: Provide clear ways to opt out of sale and targeted advertising.
- Sensitive data — notice & opt-out: Provide notice and the opportunity to opt out of sensitive-data processing rather than requiring opt-in consent.
- Children's data: Process children's data in line with COPPA.
- Security: Maintain reasonable data security practices.
The Iowa Attorney General enforces the ICDPA. Businesses get a 90-day cure period — among the most generous of any state — civil penalties of up to $7,500 per violation, and there is no private right of action. Consumer requests generally must be answered within 90 days.
How ConsentPixel makes you ICDPA-compliant
ConsentPixel — Privacy · Verified sits between your visitors and your trackers. It detects what's running, presents a geo-aware consent banner, enforces the visitor's choice, and keeps an immutable record of every decision. Here's how that maps to your obligations:Geo-aware opt-out model. Iowa visitors get the opt-out experience the ICDPA requires, including notice-and-opt-out for sensitive data categories.
Auto-detecting scanner finds every cookie and tracker on your site, so your disclosures and consent categories are complete and accurate — not guesswork.
Signal passthrough drives Google Consent Mode v2, Microsoft UET, Meta Pixel, and IAB TCF 2.3 from a single consent event, so every platform respects the same choice.
GPC honoring recognizes Global Privacy Control opt-out signals and applies them automatically.
Document generator auto-creates Privacy Policy, Cookie Policy, Terms, and DPA documents to support your transparency obligations.
Immutable, tamper-evident logs record every consent decision — audit-ready proof of what each visitor saw and chose.
One pixel, under 5 minutes. Everything above ships from a single pixel install, with a public trust badge and verification page.
Why ConsentPixel
- Auto-detection ensures opt-outs actually suppress the right trackers.
- One pixel handles opt-outs, GPC, documents, and signals together.
- Audit-ready logs give defensible proof for AG enforcement.
- Multi-regulation: the same install covers stricter state laws your visitors may fall under.
Frequently asked questions
Does the ICDPA require opt-in consent for sensitive data?
No. Like Utah's UCPA, the ICDPA generally requires clear notice and an opportunity to opt out of sensitive-data processing rather than prior opt-in consent. ConsentPixel supports this approach.
How long do I have to respond to consumer requests under the ICDPA?
Generally 90 days, which is longer than most state laws. ConsentPixel's logs help you track and demonstrate timely handling.
Does the ICDPA include a right to correct data?
No standalone right to correct — one of the ways the ICDPA is more limited than stricter state laws.
What are the penalties under the ICDPA?
The Iowa Attorney General can seek civil penalties of up to $7,500 per violation after a 90-day cure period. There is no private right of action.
I comply with Utah's UCPA — am I close on Iowa?
Largely yes. The ICDPA and UCPA share a business-friendly, opt-out-centric model. ConsentPixel handles both from one install while also covering stricter states.
The bottom line
Iowa pairs a 90-day response window with a 90-day cure period and no right to correct — about as forgiving as state privacy law gets. As with Utah, if you're in scope here you're in scope for tougher states, so build to the higher bar and Iowa follows.
Make ICDPA compliance a one-pixel job
Install ConsentPixel to serve Iowa visitors the right opt-out model, generate your privacy documents, and keep audit-ready logs.
Scan your site free Start free trialThis page is informational and is not legal advice. The ICDPA is an Iowa state law; consult qualified counsel for advice on your specific obligations.