Iowa

HF 864, age verification for websites and apps pornographic for minors

Operators of internet sites, apps, or segments of apps containing a substantial portion (one third or more) of material pornographic for minors must perform reasonable age verification of Iowa users before granting access, and may not retain, sell, or disseminate identifying information. Signed June 1, 2026.

Personal Information Security Breach Protection

Notification of a breach of security must be made in the most expeditious manner possible and without unreasonable delay, consistent with the legitimate needs of law enforcement. A business subject to a breach requiring notification to more than 500 Iowa residents must also give written notice to the director of the consumer protection division of the Attorney General's office within five business days of notifying consumers.

A violation is an unlawful practice under section 714.16, and the Attorney General may recover damages on behalf of an injured person, but that recovery runs through the Attorney General rather than arming the person with a direct private right of action. This provision is in force under the current codified text; the underlying research did not establish a dated original commencement, so no effective_date is recorded here.

Iowa Consumer Data Protection Act (ICDPA), general applicability and controller/processor duties

ICDPA governs private-sector processing of Iowa consumers' personal data. Enacted as Senate File 262 (90th General Assembly, 2023 session), signed March 28, 2023 (2023 Iowa Acts ch. 17), effective January 1, 2025 per consistent secondary reporting; the effective date was not independently pulled as an explicit sentence from the primary code text in this pass, since Iowa's official code PDF does not print effective dates inline the way some peer states' history lines do. Controller duties are allocated at section 715D.4 and processor duties at section 715D.5.

Iowa Consumer Data Protection Act, consumer rights

ICDPA gives an Iowa consumer the right to confirmation of processing, access, deletion, a portable copy, and opt-out of sale, targeted advertising, and profiling for solely-automated consequential decisions, but notably grants no right of correction, a real gap relative to the other six states researched in this batch.

A controller must respond without undue delay and within 90 days of receipt, double the 45-day window used elsewhere in this batch, with one 45-day extension available; an appeal of a refusal must be decided within 60 days.

Iowa Consumer Data Protection Act, Attorney General enforcement

The Iowa Attorney General has exclusive authority to enforce ICDPA. Before suing, the Attorney General must give a controller or processor 90 days' written notice identifying the specific provisions violated; unlike Connecticut's, Delaware's, and Montana's time-limited or eliminated cure rights, this 90-day cure right carries no sunset date in the text read. Civil penalties run up to $7,500 per violation, and the chapter creates no private right of action.

Iowa Consumer Data Protection Act, sensitive data and biometric data definitions

ICDPA classifies data revealing racial or ethnic origin, religious beliefs, mental or physical health diagnosis, sexual orientation, or citizenship or immigration status (with a discrimination-avoidance carve-out not seen in the other six states in this batch), the processing of genetic or biometric data to uniquely identify a person, a known child's data, and precise geolocation data as sensitive data, but requires only an opt-out mechanism for sensitive-data processing rather than the opt-in consent every other state in this batch requires.

Genetic or biometric data collected to identify a person is itself an enumerated sensitive-data category (§ 715D.1(26)(b)), so biometric data is a heightened category here.

Separately, 'Biometric data' (§ 715D.1(4)) carries the same blanket, unconditional exclusion for recording-derived data as Virginia's VCDPA, word for word: no clawback for data generated to identify someone, so a voiceprint or faceprint extracted from a recording is not biometric data under ICDPA regardless of purpose, and therefore is not sensitive data either.

This document cites these definitions to § 715D.1, correcting an earlier draft's citation to § 715D.2, which is a different section (Scope and exemptions).