What the Iowa Data Privacy Act means for you

How to exercise your rights under the Iowa Data Privacy Act

The Iowa data privacy law gives you a bit of control over how businesses collect and use your personal data. Here's how to take advantage.

Darwin Laganzon | Pixabay.com

Take Action

Phoebe Normandia

Intern, Don't Sell My Data campaign

The Iowa privacy law – called the Iowa Consumer Data Protection Act – passed in March 2023. It goes into effect January 1, 2025.

What is the Iowa Consumer Data Protection Act?

The Iowa Consumer Data Protection Act is a consumer privacy law that gives you some basic rights regarding how businesses collect, use and sell your data.

The Iowa Consumer Data Protection Act earns a F grade on our recent scorecard report – co-authored with the Electronic Privacy Information Center (EPIC) – for how well it actually protects consumers. In fact, Iowa came in very last place. 

Iowa’s privacy law puts a lot of work on you if you want to stop companies from collecting and selling your data. It’d be better if instead companies were limited to what data they can collect on you and what they can do with it in the first place.

What does the Iowa privacy law do for consumers?

The Iowa privacy law gives you several rights regarding your personal information:

  • Right to Access: You can request a copy of the personal information businesses have collected about you.
  • Right to Correct: You can request a business correct inaccuracies in the personal information it has collected about you.
  • Right to Delete: You can request a business delete the personal information that you have provided it with. 
  • Right to Opt Out: You can opt out of businesses selling your personal information to advertisers and other third parties.

Most of these rights are too difficult to exercise. To access, correct or delete your data, or opt out of data sales, you have to submit requests one at a time to individual companies. Exercising the rights Iowa’s privacy law gives you would be like taking on a part-time job. There are likely hundreds of third parties holding your information right now. 

Plus, Iowa’s deletion rights are also more limited than in other states. You can’t request a company delete all your data – it only has to delete the data you have provided it with. Companies often buy data from other places. There’s not a way for you to get companies to delete data they’ve bought.

How do I exercise my Iowa privacy law rights?

To exercise your other core rights – accessing, correcting or deleting the data a company has already collected on you – you must submit a request directly to each business. Companies must tell you how to send a request in their privacy policy.

Read: How to read a privacy policy

Where can I find instructions for exercising my rights in a privacy policy?

When looking at a privacy policy, search for a section titled “Your Privacy Rights,” “Your Rights and Choices,” or something similar. Use ctrl+f for the term “privacy”, “rights”, or “opt” to find this information more quickly. In this section, the business should give you instructions for how to access, correct, or delete your personal data. It will typically be a web form or an email address you need to send a request to.

How could the Iowa Consumer Data Protection Act be better?

As the weakest law in the nation, there’s a lot Iowa could do to make it’s law better.

The single most impactful things for consumers is to change how companies can collect and use data in the first place. It should be on companies to limit their data collection to only the data they need to deliver the service you’re expecting to get up front. There’s no good reason for your fast food loyalty app to be collecting your location 24/7 or your VR game app to be collecting your social security number

Companies should also be limited to only using the data they collect for what the consumer is expecting. There’s no good reason for your health app to turn around and sell your prescription information to advertisers or your child’s internet-enabled stuffed animal to be sending transcripts of your child’s conversations to third parties. 

This is a big deal. The more data that companies collect, and the more companies they sell it to, the more likely it is that your personal information is going to be exposed in a breach or a hack and end up in the wrong hands. This makes it more likely you’ll be the victim of identity theft, financial fraud and hyper-targeted scams. 

It’s absurd we haven’t stopped companies treating our data like a commodity. States can lead the way in amending the laws they’ve already passed to do more to protect consumers.

What else can I do to protect my data?

Since your Iowa privacy rights are incredibly limited, we highly recommend taking other steps to protect yourself. We’ve got simple ways you can boost your data security here.

See below for even more tips to put you more in control of your information online.


Phoebe Normandia

Intern, Don't Sell My Data campaign

R.J. Cross

Director, Don't Sell My Data Campaign, U.S. PIRG Education Fund

R.J. focuses on data privacy issues and the commercialization of personal data in the digital age. Her work ranges from consumer harms like scams and data breaches, to manipulative targeted advertising, to keeping kids safe online. In her work at Frontier Group, she has authored research reports on government transparency, predatory auto lending and consumer debt. Her work has appeared in WIRED magazine, CBS Mornings and USA Today, among other outlets. When she’s not protecting the public interest, she is an avid reader, fiction writer and birder.