Iowa Code Chapter 715D: Four Rights, a 90-Day Clock and No Assessment Duty

The Chapter as Enacted and Codified

Senate File 262 of the 90th General Assembly was approved by the governor on March 28, 2023 and became 2023 Iowa Acts chapter 17. Its Section 10 sets the effective date at January 1, 2025. The chapter added a new chapter 715D, titled Consumer Data Protections, to the Iowa Code. The bill book page records the enrolled bill with the governor's action. The 2026 Iowa Code text of chapter 715D, published by the Legislative Services Agency, shows no amendment since enactment: each of the nine sections still cites only 2023 Acts, ch 17.

Those nine sections are definitions, scope, consumer rights, controller duties, processor duties, data-processing exemptions, limitations, enforcement and preemption. That is the whole statute, and its length shapes what follows: several features that sibling statutes carry in separate sections simply have no counterpart in Iowa.

Who Chapter 715D Applies To

Section 715D.2(1) reaches a person "conducting business in the state or producing products or services that are targeted to consumers who are residents of the state" that, during a calendar year, controls or processes personal data of at least 100,000 consumers, or of at least 25,000 consumers while deriving over 50 percent of gross revenue from the sale of personal data. A consumer is an Iowa resident "acting only in an individual or household context," excluding commercial and employment roles. A sale requires "monetary consideration."

Subsection (2) excludes the state and its political subdivisions, financial institutions, their affiliates and Gramm-Leach-Bliley data, nonprofit organizations, institutions of higher education, and "persons who are subject to and comply with" the HIPAA and HITECH privacy regulations. The HIPAA entity exclusion is phrased by compliance rather than by covered-entity status. The nonprofit definition in section 715D.1(17) is specific to Iowa law: corporations organized under chapter 504, organizations exempt under sections 501(c)(3), 501(c)(6) or 501(c)(12), insurance-fraud organizations exempt under 501(c)(4), and subsidiaries and affiliates of cooperatives organized under chapter 499.

Subsection (3) exempts eighteen categories of information, from protected health information and health records to FCRA, DPPA, FERPA and Farm Credit Act data and employment records. Its last item, paragraph (r), exempts personal data "used in accordance with" COPPA and its rules. The chapter has no separate clause deeming COPPA verifiable parental consent sufficient, because it imposes no parental-consent duty of its own.

The Rights It Grants and the Ones It Omits

The text supports the commonly reported design. Section 715D.3(1) requires a controller to honor an authenticated request to do four things:

1. Confirm whether it is processing the consumer's personal data and give access to it
2. "Delete personal data provided by the consumer"
3. Provide a copy of personal data the consumer previously provided, in a portable and readily usable format where processing is automated, "except as to personal data that is defined as 'personal information' pursuant to section 715C.1 that is subject to security breach protection"
4. "Opt out of the sale of personal data"

Three omissions follow from that list. There is no right to correct inaccurate data. Deletion covers data "provided by the consumer," not data obtained about the consumer from other sources, and the chapter has no rule for handling third-party-sourced data under a deletion request. The only opt-out is from sale; there is none for targeted advertising or for profiling, and the chapter does not define profiling at all.

Section 715D.4(6) adds a wrinkle. A controller that "sells a consumer's personal data to third parties or engages in targeted advertising" must disclose that activity "as well as the manner in which a consumer may exercise the right to opt out of such activity." Section 715D.3 grants no right to opt out of targeted advertising, so the disclosure clause names a right that the rights section does not list. The chapter does not resolve the difference.

The 90-Day Response Period

This heading also survives the text. Section 715D.3(2)(a) requires a response "without undue delay, but in all cases within ninety days of receipt," extendable once by 45 days if the consumer is told within the first 90 days, with a reason. The outer limit is therefore 135 days.

Paragraph (b) treats refusals differently. A controller declining to act must tell the consumer "without undue delay" of its justification and give appeal instructions, but no day count is attached. Where fraud is suspected, the controller may state only that it could not authenticate the request. Under paragraph (c), two responses a year are free; a controller may charge or decline if a request is "manifestly unfounded, excessive, repetitive, technically unfeasible," or if it "reasonably believes that the primary purpose of the request is not to exercise a consumer right." The burden sentence that follows lists the first four grounds and omits the primary-purpose ground.

Appeals under subsection (3) are decided within 60 days, in writing. On denial, the controller must provide "an online mechanism through which the consumer may contact the attorney general to submit a complaint," without the "if available" qualifier that several other states attach.

Sensitive Data: Notice and Opt-Out Rather Than Consent

Section 715D.1(26) defines sensitive data as racial or ethnic origin, religious beliefs, mental or physical health diagnosis, sexual orientation, or citizenship or immigration status, "except to the extent such data is used in order to avoid discrimination on the basis of a protected class"; genetic or biometric data processed to uniquely identify a person; data collected from a known child; and precise geolocation within 1,750 feet.

Section 715D.4(2) states the rule: a controller "shall not process sensitive data collected from a consumer for a nonexempt purpose without the consumer having been presented with clear notice and an opportunity to opt out of such processing." Data concerning a known child must be processed in accordance with COPPA. The heading's premise holds. Section 715D.1(6) defines consent as "a clear affirmative act," but a search of the codified chapter finds the word only in that definition. No operative provision conditions any processing on consent, including secondary uses beyond the disclosed purpose, which the chapter does not separately restrict.

No Data Protection Assessment Requirement

The outline for this post did not include assessments, and the reason is in the text. None of the nine sections requires a controller to conduct or document a data protection assessment, and section 715D.8 contains no power to demand one. Processor duties in section 715D.5 are limited to helping with rights requests and security and breach obligations, and to contract terms on confidentiality, deletion or return of data, information for demonstrating compliance, and subcontractor flow-down.

Attorney General Enforcement and the 90-Day Cure

Section 715D.8(1) gives the Attorney General exclusive authority and the power to issue a civil investigative demand on reasonable cause, governed by section 685.6. Subsection (2) requires "ninety days' written notice" identifying the provisions at issue before any action. A controller or processor that cures within that window and provides "an express written statement that the alleged violations have been cured and that no further such violations shall occur" cannot be sued. The codified text has no sunset for the cure.

After a failed cure or a broken statement, subsection (3) allows an action in the state's name for an injunction and civil penalties of up to $7,500 for each violation. All money collected, including penalties, costs and fees, goes to the consumer education and litigation fund under section 714.16C. Subsection (4) forecloses a private right of action under the chapter "or under any other law," and section 715D.9 preempts city and county rules on processing personal data.

No enforcement action under chapter 715D was located on the Attorney General's newsroom as of October 26, 2026. Two recent filings were checked. The October 14, 2026 release describes a suit against OpenAI for "violating Iowa's Consumer Fraud Act," and the Polk County petition pleads its claims under section 714.16; it cites section 715D.4(2) once, in a factual paragraph, without a count under chapter 715D. The October 9, 2026 petition against Lorex Corporation does not cite chapter 715D. The enforcement record under the chapter therefore stands at zero.

Frequently Asked Questions