Fast.  Secure.  Free.  Forever.
Iowa State Privacy Law
Effective January 1, 2025

Iowa Consumer Data Protection Act
(ICDPA)

The Iowa Consumer Data Protection Act (ICDPA) gives Iowa residents the right to access, delete, and opt out of the sale of their personal data.

ICDPA
Law Abbreviation
$7,500
Max Fine Per Violation
90
Days to Respond
100,000
Coverage Threshold
Your Rights Under ICDPA

What the law gives you

The Iowa Consumer Data Protection Act (ICDPA) grants residents the following legally enforceable rights over their personal data:

Access
Confirm whether a company processes your personal data and obtain a copy.
Delete
Delete personal data you provided to a controller.
Portability
Receive your data in a machine-readable format.
Opt Out
Opt out of the sale of personal data or targeted advertising.
How to Exercise Your Rights

Step by step

01
Submit a rights request using the company’s designated privacy contact or form.
02
The company has 90 days to respond — Iowa has one of the longer response windows.
03
If denied, submit an internal appeal. The company must respond within 90 days.
04
Escalate to the Iowa AG if the company fails to comply.
ClickOff makes this automatic. Rather than submitting individual requests to hundreds of data brokers, ClickOff acts as your authorized agent under the ICDPA and all applicable state laws — submitting deletion requests to 200+ brokers simultaneously. Free forever.
Delete your data under ICDPA.
Free forever. Legal receipt generated instantly. 45-day compliance clock starts now.
Delete My Data From Every Broker →
Related Laws

Other privacy laws that protect you

CCPA — California → SB 362 — Delete Act → ADPA — Federal → All Your Rights →
ICDPA questions
Iowa privacy law,
explained.
How is Iowa’s law different from others?
Iowa’s ICDPA is notably more limited than most state laws. It does not include a right to correct data, has a 90-day response window instead of 45, and requires opt-out only (not opt-in) for sensitive data. It’s considered more business-friendly.
Is there a cure period in Iowa?
Yes. Companies receive a 90-day cure period — the longest of any state — before the AG can bring an action.
How does ClickOff help me use my ICDPA rights?
ClickOff acts as your authorized agent under the ICDPA and all applicable state laws. Instead of sending individual deletion requests to hundreds of data brokers one by one, ClickOff submits on your behalf to 200+ brokers simultaneously — with a legal receipt generated instantly. Free forever.