Law note · Iowa
Iowa Consumer Data Protection Act, Attorney General enforcement
The Iowa Attorney General has exclusive authority to enforce ICDPA. Before suing, the Attorney General must give a controller or processor 90 days' written notice identifying the specific provisions violated; unlike Connecticut's, Delaware's, and Montana's time-limited or eliminated cure rights, this 90-day cure right carries no sunset date in the text read. Civil penalties run up to $7,500 per violation, and the chapter creates no private right of action.
What it asks of an app
- Expect ICDPA violations to be enforced exclusively by the Iowa Attorney General, never by a private plaintiff.
- Cure a noticed violation and provide a written statement of cure within 90 days of Attorney General notice to avoid an enforcement action. Unlike some peer states, this cure right carries no sunset date in the statutory text.
When LexLint raises it
Declared activities: crawls_web, trains_models, deploys_chatbot, automated_outreach
Primary source: official Iowa statute text, Iowa Code chapter 715D