Iowa is now the sixth state to pass state-level consumer privacy data protection laws. This new law will take effect January 1, 2025! Revised California and new Virginia laws went live on January 1, 2023, Colorado and Connecticut will be effective July 1, 2023, then Utah to follow at the end of the year on December 31, 2023.
SF 262 bill flew through the House and Senate, being introduced on February 13 and through both of them by March 15! That is lightning fast. The Governor signed the bill into law on March 28th.
Who will this apply to?
[P]erson(s) conducting business in the state or producing products or services that are targeted to consumers who are residents of the state and that during a calendar year does either of the following:
- Controls or processes personal data of at least one hundred thousand consumers.
- Controls or processes personal data of at least twenty-five thousand consumers and derives over fifty percent of gross revenue from the sale of personal data.
What consumer rights are provided under the new law
- Right to know and Access
- Right to Delete
- Right to Data Portability
- Right to Opt Out of Sale
- Right to Opt Out of Processing Sensitive Data
- Right to Opt Out of Targeted Advertising
Like most states Iowa tracks very similarly with giving the consumers clear access to exercise their rights, and the ability to appeal denied requests. While most states outline a response and processing timeline of 45 days from a consumer request, with the possible extension of 45 additional days if necessary, Iowa allows a time period within 90 days of receiving a consumer request and may allow a one-time 45-day extension when necessary for processing.
There are approximately 18 to 20 other states with bills centered around consumer privacy. We will continue to track and provide updates as these bills become law.