The Iowa Consumer Data Protection Act (ICDPA) is a U.S. state privacy law that came into effect on January 1, 2025. It is part of the broader development of state-level privacy laws in the United States regulating how organizations collect and use personal data.
Compared to other U.S. privacy laws, the ICDPA is considered more business friendly, with a narrower set of consumer rights and compliance requirements.
Who does the ICDPA apply to?
The ICDPA applies to organizations that conduct business in Iowa or target Iowa residents and meet certain thresholds related to the volume of personal data processed or revenue derived from data sales.
In particular, it applies to organizations that process large volumes of consumer data or derive significant revenue from selling personal data.
What data is covered?
The law applies to personal data that is linked or reasonably linkable to an identifiable individual.
The ICDPA also covers sensitive personal data, such as health data, biometric data, and precise geolocation. Unlike many other state laws, the ICDPA does not require opt-in consent for sensitive data. Instead, organizations must provide clear notice and allow users to opt out of such processing.
Consumer rights
Under the ICDPA, Iowa residents have the right to access and delete their personal data and to opt out of the sale of personal data.
Compared to other U.S. state privacy laws, the ICDPA provides a more limited set of rights and does not include rights related to targeted advertising or profiling.
Organizations are required to respond to requests within a reasonable timeframe.
What does this mean for your consent setup?
To support the requirements of the ICDPA, a consent solution should enable users to opt out of the sale of personal data and provide clear notice regarding data processing activities, including sensitive data.
Unlike other state laws, the ICDPA does not require opt-in consent for sensitive data and does not mandate support for universal opt-out mechanisms such as Global Privacy Control.
How Cookiebot supports ICDPA
Cookiebot provides a dedicated ICDPA template within the Web Consent Management Platform. This template supports the implementation of the law's opt-out requirements and enables organizations to configure consent flows aligned with ICDPA.
Getting started
To use the ICDPA template, create a new configuration, select the ICDPA template, adjust the settings as needed, and publish your configuration.
This article is for informational purposes only and does not constitute legal advice.
Comments
0 comments
Please sign in to leave a comment.