Iowa Consumer Data Protection Act

PrivacyIn Effect

A focused view of the rule, its enforcement posture, and the timeline teams should keep in their operating plan.

Plain-English summary

What this regulation means

Built for operators

Iowa gives consumers rights to know whether personal data is processed, access and delete data they provided, and obtain a portable copy, while also allowing opt outs from data sale. It applies to controllers that meet volume thresholds and focuses on privacy notices, reasonable security, and processor contracts. Compared with some other state privacy laws, it is narrower on correction and sensitive-data consent requirements.

Reading guide

Use the timeline below to see how the rule progressed from enactment to current obligations.

Related regulations surface adjacent requirements in the same jurisdiction or policy lane.

Timeline

Regulatory lifecycle

Sequence: In Effect

1
Jan 1, 2025
In Effect
Iowa's consumer data protection obligations and consumer rights became effective.

Pro feature

📊 Stay ahead of this regulation

Get email alerts when this regulation changes and export records to CSV for your compliance workflow — available with RuleWatch Pro.

→Email alerts when this regulation is updated or enforced
→Export to CSV or JSON for compliance reporting
→API access to integrate regulation tracking into your workflows

See what's included

Subscribe for regulation alerts

Get alerts for this regulation →

Free weekly digest for compliance professionals following material legal changes.

Related regulations

What else belongs on the watchlist

Pulled from the same jurisdiction or category so teams can compare adjacent obligations quickly.

Indiana, United States

Indiana Consumer Data Protection Act

PrivacyIn Effect

Indiana gives consumers rights to confirm processing, access data, correct inaccuracies, delete certain personal data, obtain portable copies, and opt out of targeted advertising, sale, and profiling. It applies to businesses that meet threshold tests and requires clear notices, purpose limitation, security safeguards, and contracts with processors. The attorney general enforces the law after a cure process.

Effective

Jan 1, 2026

View detail

New York, United States

New York Child Data Protection Act

PrivacyIn Effect

New York requires operators of covered online sites, services, and connected devices to provide privacy-by-default protections for minors and to limit data processing unless a statutory exception applies. It affects operators directed to children or that know a user is under 18, with special focus on profiling, data transfers, and persistent identifiers.

Effective

Jun 20, 2025

View detail

Montana, United States

Montana Consumer Data Privacy Act

PrivacyAmended

Montana grants rights to access, delete, correct, and port personal data and to opt out of sale, targeted advertising, and profiling. Controllers and processors must provide clear notices, maintain contracts, and honor consumer rights requests. Amendments effective in 2025 lowered applicability thresholds and tightened disclosure and opt-out expectations for data sales and targeted advertising.

Effective

Oct 1, 2024

View detail