Iowa Becomes Sixth State with Comprehensive Privacy Law


With the governor signing SF 262 into law last week, Iowa became the sixth US state with a comprehensive privacy law. The law goes into effect January 1, 2025. It applicability is similar to other states’ laws. It applies to companies that do business in Iowa and either: (1) control or process personal data of at least 100,000 Iowans; or (2) derive over 50% of gross revenue from the sale of personal data and control or process personal data of 25,000 or more Iowans. These thresholds are calculated annually.

Key provisions include:

Putting It Into Practice: Iowa’s new law, while not substantially different from that of other states, does have some unique features. Companies will have until January 2025 to expand their rights provisions to Iowa residents and otherwise update their practices. This includes privacy policy and contractual updates as well as any consumer rights tools and workflows.


Copyright © 2024, Sheppard Mullin Richter & Hampton LLP.
National Law Review, Volumess XIII, Number 101