Laws
Iowa Consumer Data Protection Act (ICDPA): your rights and the 90-day clock
Quick answer
Iowa's Consumer Data Protection Act, in force since January 1, 2025, lets you see the personal data a covered company holds about you, get a copy, delete data you gave it and opt out of its sale. It's narrower than Virginia's or Colorado's law: there's no right to correct, deletion doesn't expressly reach data the company got from someone else, and companies get 90 days to answer, plus a possible 45-day extension. If a company refuses, appeal to it first, then complain to the Iowa Attorney General.
All privacy laws“A controller shall comply with an authenticated consumer request to exercise all of the following: ... delete personal data provided by the consumer”
- Applies in
- Iowa
- In force since
- Companies must answer within
- Without undue delay and within 90 days of receiving your request. The company can extend once by 45 days if it tells you why within the first 90 days (Iowa Code § 715D.3(2)(a)). Appeals get a written answer within 60 days (§ 715D.3(3)). Answers are free up to twice a year (§ 715D.3(2)(c)).
- Last updated
Head of Product & Co-Founder
Reviewed by Ludwig Sandgren
Head of Legal
Serus is a privacy company with paid tools to find and remove your personal data. This page is free and based on official sources.
Sources checked: legis.iowa.gov, iowaattorneygeneral.gov
Last verified against the official page:
Iowa residents. The law applies to companies that do business in Iowa or target Iowans and, in a calendar year, handle the personal data of at least 100,000 Iowans, or of at least 25,000 while making more than half their gross revenue from selling personal data. The state, nonprofits, colleges, HIPAA-regulated entities and financial institutions covered by the Gramm-Leach-Bliley Act are exempt, and so is data covered by HIPAA, the Fair Credit Reporting Act, FERPA, the Driver's Privacy Protection Act and employment data.
Your rights
-
Confirm and access
Ask a company whether it processes your personal data, and see that data (Iowa Code § 715D.3(1)(a)).
-
Delete
Have a company delete personal data you provided to it (Iowa Code § 715D.3(1)(b)).
-
Get a portable copy
Get a copy of the data you gave the company in a portable, readily usable format. Data that counts as "personal information" under Iowa's data breach law is left out of the copy (Iowa Code § 715D.3(1)(c)).
-
Opt out of sale
Stop the company selling your personal data (Iowa Code § 715D.3(1)(d)).
-
Appeal
Appeal a refusal. The company must answer in writing within 60 days and, if it still says no, give you an online way to complain to the Attorney General (Iowa Code § 715D.3(3)).
-
Notice before sensitive data is used
A company can't process sensitive data about you for a non-exempt purpose without first giving you clear notice and a chance to opt out (Iowa Code § 715D.4(2)).
-
Know about targeted ads
A company that sells personal data or uses it for targeted advertising must say so clearly and explain how to opt out (Iowa Code § 715D.4(6)).
General information, not legal advice.
How to use it
- 1
Find the request method in the privacy notice
Covered companies must describe in their privacy notice the secure ways to send a request and how to appeal. They can't make you create a new account.
- 2
Send your request
Say which right you're using: access, deletion, a copy or an opt-out of sale. A line like "Under Iowa Code chapter 715D, please delete the personal data I provided to you and stop selling my personal data" covers both rights that matter most for removal.
- 3
Wait up to 90 days
Iowa gives companies 90 days, twice the 45 days that Virginia, Colorado and Indiana allow, plus one 45-day extension if they tell you why. In the worst case that's 135 days. Answers are free up to twice a year.
- 4
Appeal if the company refuses
Use the company's appeal process. It must answer in writing within 60 days and, if it still says no, give you an online way to reach the Attorney General.
- 5
Complain to the Iowa Attorney General
File a complaint with the Attorney General's Consumer Protection Division on its consumer complaint page. Only the Attorney General enforces the law. You can't sue under it yourself.
No answer in time? Complain to Iowa Attorney General, Consumer Protection Division .
Who has to follow the ICDPA
The law covers companies that do business in Iowa or target Iowans and handle the personal data of at least 100,000 Iowans a year. A company with data on 25,000 or more is covered too if over half its gross revenue comes from selling personal data.
What's missing compared with other states
Iowa's law is one of the thinner ones, and it helps to know the gaps before you write.
- No right to correct. If a company has your details wrong, this law doesn't make it fix them.
- Deletion covers only data you provided. Virginia, Indiana and Montana extend it to data a company obtained about you. Iowa doesn't.
- Only one opt-out right. You can opt out of the sale of your data. There's no stand-alone right to opt out of targeted advertising or profiling, though companies doing targeted ads must disclose it and explain how to opt out.
- No browser signal. Companies don't have to honor Global Privacy Control.
- The longest clock. 90 days to answer, extendable to 135.
Enforcement
Only the Attorney General enforces the law. Before suing, it has to give the company written notice and 90 days to fix the problem. If the company doesn't, the Attorney General can seek civil penalties of up to $7,500 per violation.
Why a company can say no
The state, nonprofits, colleges, HIPAA-regulated entities and financial institutions covered by the Gramm-Leach-Bliley Act (GLBA) are exempt. Data covered by HIPAA (health), the Fair Credit Reporting Act (credit reports), FERPA (school records) and the Driver's Privacy Protection Act is exempt too.
If a company points to one of these, that's probably the reason. You can still appeal, then complain to the Attorney General. Our guide on what to do when a company won't delete your data has more options.
Where Serus fits
Because Iowa's deletion right stops at data you provided, data brokers that bought your details are mostly reached through their own opt-out processes. Serus finds the data brokers that operate where you live, sends those removal requests and keeps checking whether your data comes back. The same opt-outs are free if you do them by hand.
Data brokers that list people in United States
Each guide shows how to opt out of that site, step by step.
- Remove yourself from CourtRecords.us
- Remove yourself from TruePeopleSearch
- Remove yourself from Spokeo
- Remove yourself from LexisNexis
- Remove yourself from TruthFinder
- Remove yourself from FastPeopleSearch
- Remove yourself from BeenVerified
- Remove yourself from Intelius
Let Serus send the requests for you
Serus finds the data brokers that list you where you live and removes you from them.
Related
Frequently asked
How long does an Iowa business have to answer?
90 days from receiving your request, and it can extend once by 45 more days if it tells you why within the first 90.
Can I correct my data under Iowa law?
Not under this law. Chapter 715D doesn't include a right to correct. Its rights are access, deletion of data you provided, a portable copy and an opt-out of sale.
Can I make a company delete data it got from a data broker?
The Iowa deletion right covers personal data you provided. Data a company obtained from others isn't expressly covered, so ask it to stop selling your data instead.
Do Iowa businesses have to honor Global Privacy Control?
No. Chapter 715D doesn't require companies to honor browser opt-out signals such as Global Privacy Control.
Can I sue?
No. The Attorney General has exclusive enforcement authority and the law gives you no right to sue.
Sources
Something wrong or out of date? Tell us and we'll re-check it.