Law note · Iowa
Iowa Consumer Data Protection Act, consumer rights
ICDPA gives an Iowa consumer the right to confirmation of processing, access, deletion, a portable copy, and opt-out of sale, targeted advertising, and profiling for solely-automated consequential decisions, but notably grants no right of correction, a real gap relative to the other six states researched in this batch.
A controller must respond without undue delay and within 90 days of receipt, double the 45-day window used elsewhere in this batch, with one 45-day extension available; an appeal of a refusal must be decided within 60 days.
What it asks of an app
- Give an Iowa consumer a means to confirm whether you process their personal data, access it, delete it, and receive a portable copy. ICDPA does not require you to offer a correction mechanism.
- Offer an Iowa consumer an opt-out of sale, targeted advertising, and profiling for solely-automated decisions with legal or similarly significant effects.
- Respond to a consumer rights request without undue delay and within 90 days of receipt, with one 45-day extension available, and decide an appeal of a refusal within 60 days.
When LexLint raises it
Declared activities: crawls_web, trains_models, deploys_chatbot, automated_outreach, high_risk_decisions
Primary source: official Iowa statute text, Iowa Code chapter 715D