Careers

Diversity

With 17 offices, from New York to Los Angeles and Seattle to Orlando, we live and work in communities all over the U.S., collaborating across locations, disciplines and even borders. Our experienced, highly ranked lawyers serve businesses wherever they are and wherever they want to go.

Offices

About Us

Pages

Professionals

Thought leadership: blogs, podcasts, videos, publications, events and news

Insights

Services

Pro Bono

Am Law 100 firm with practices in Business, Digital Assets and Data Management, Intellectual Property, Labor & Employment, Litigation and Tax.

Home | BakerHostetler

The State of Employee Status

ADventures in Law

Promotions Trends to Look for in 2025

New Jersey Employers Must Disclose Pay and Benefits Information to Employees and Applicants

Technology from the Top: AI, Data and the Future of Business with Today’s CIOs

Technology from the Top: AI, Data and the Future of Business with Today’s CIOs – Shannon Johnston

On March 29, 2023, Iowa became the sixth U.S. state to pass comprehensive consumer privacy legislation. The new law will go into effect on January 1, 2025. Iowa’s privacy law bears substantial similarity to the Virginia, Colorado, Connecticut and Utah privacy laws, which should facilitate compliance for businesses subject to those laws. Likewise, businesses familiar with the California Consumer Privacy Act (CCPA) will find overlap with the CCPA, though Iowa’s law is not as far-reaching and provides a more limited slate of consumer rights.    



Applicability



Companies are subject to the Iowa privacy law if they do business in Iowa or target products or services to Iowa consumers, and meet one of the following criteria during a calendar year:



<ol type="1">
<li>Control or process personal data of at least 100,000 Iowa consumers.</li>



<li>Control or process personal data of at least 25,000 Iowa consumers and derive over 50 percent of gross revenue from the sale of personal data.</li>
</ol>



Unlike the CCPA, the Iowa law does not include a revenue-based applicability threshold. The law expressly applies only to consumers acting in an “individual or household context” and excludes anyone “acting in a commercial or employment context.” It also includes both entity-level and data-level exemptions for companies and information subject to other privacy laws such as the Gramm-Leach-Bliley Act, the Health Insurance Portability and Accountability Act, and the Fair Credit Reporting Act, among others.



Overview of Requirements



The Iowa law requires businesses to be transparent about their processing activities by providing a privacy notice that includes the following:



<ol type="1">
<li>The categories of personal data processed.</li>



<li>The purposes for which personal data is processed.</li>



<li>How Iowans can exercise their consumer data rights.</li>



<li>The categories of personal data shared with third parties.</li>



<li>The third parties with which personal data is shared.</li>
</ol>



Generally, though, the Iowa law is not particularly prescriptive in terms of how notice must be provided (other than making it “reasonably accessible”), does not mandate any special links or forms for websites, and does not necessarily require any specific reference to Iowa within a privacy policy that otherwise meets the above requirements. This approach should help with interoperability with the other state privacy laws.



The Iowa privacy law will provide Iowa consumers with the following limited slate of data privacy rights:



<ol type="1">
<li>The right to confirm whether a controller is processing a consumer’s personal data and to access their personal data.</li>



<li>The right to obtain a portable copy of personal data the consumer previously provided to the business.</li>



<li>The right to delete personal data provided to the business by the consumer.</li>



<li>The right to opt out of the sale of personal data (defined as an exchange of data for monetary consideration).</li>
</ol>



The law also requires that businesses provide consumers with an opportunity to opt out of the processing of sensitive personal data and the right to appeal the denial of a consumer data rights request. The Iowa law does not include a right to correct or a right to opt out of profiling. Although the law does not include a right to opt out of targeted advertising among the express list of consumer data rights, it does include a somewhat cryptic requirement that “[i]f a controller . . . engages in targeted advertising, the controller shall clearly and conspicuously disclose such activity, as well as the manner in which a consumer may exercise the right to opt out of such activity.” Businesses will have 90 days to respond to consumer data rights requests, which may be extended by 45 days if needed.



The law includes specific contractual requirements for agreements between controllers and processors that overlap with those mandated under other state privacy laws. The law does not require data protection assessments.



Penalties and Enforcement



Enforcement authority lies exclusively with the Iowa Attorney General. The law provides for civil penalties of up to $7,500 per violation in the event a business is not able to remedy a violation within the 90-day cure period. There is no private right of action.



Key Takeaways



Although the patchwork of state privacy laws developing in the United States is certainly a challenge for businesses and will continue to grow more challenging with each additional law, the Iowa law presents an approach to data privacy regulation that provides rights to consumers while balancing the compliance costs for businesses. Although the law does not take effect until January 2025, companies that do business in Iowa or target goods or services to consumers in the state should assess the impact of this law and prepare for compliance with it.

Iowa Becomes the Sixth U.S. State to Pass a Comprehensive Consumer Privacy Law

Featured Insights

Related Services

Featured Insights