Publishes adult content, in Iowa

Iowa Code ch. 554G (554G.1 to 554G.4, added by 2023 Acts, ch. 63 (H.F. 553)) · Read the law's page

• This affirmative defense is available to a covered entity, a business, defined to include a financial institution and an entity organized under chapter 28E, that accesses, receives, stores, maintains, communicates, or processes personal information or restricted information in or through a system, network, or service located in or outside Iowa; a municipality is excluded from the definition of business, and the chapter creates no independent duty to adopt a cybersecurity program.
• To claim the defense against a tort claim alleging that a failure to implement reasonable information security controls resulted in a data breach of personal information or restricted information, create, maintain, and comply with a written cybersecurity program containing administrative, technical, operational, and physical safeguards, designed to continually evaluate and mitigate reasonably anticipated threats, evaluate the maximum probable loss from a data breach at least annually, and communicate to affected parties the extent of any risk and steps to reduce damages once a breach is known to have occurred.
• Fund the program at a scale and scope that is appropriate if the cost to operate it is no less than the covered entity's most recently calculated maximum probable loss value.
• Satisfy the framework requirement by reasonably conforming the program to a named industry-recognized cybersecurity framework (the NIST framework for improving critical infrastructure cybersecurity, NIST SP 800-171, NIST SP 800-53 and 800-53A, the FedRAMP Security Assessment Framework, the CIS Critical Security Controls, or the ISO/IEC 27000 family), or, where already regulated under one, by conforming the program to the entirety of HIPAA's Security Rule, Gramm-Leach-Bliley Title V, the federal Information Security Modernization Act of 2014, HITECH, Iowa's own Insurance Data Security Act (chapter 507F), or applicable federal critical-infrastructure-protection rules, or by combining PCI Data Security Standard compliance with one of the named frameworks; conform the program to a revised framework or amended regulation within one year of its publication or effective date.
• This section creates no private right of action, including a class action, for a person's failure to comply with it: it is a defense available in litigation another statute or the common law already permits, never an independent basis to sue.

Iowa Code 708.7(1)(a)(5) · Read the law's page

• Do not disseminate, publish, distribute or post a visual depiction showing another person nude or engaged in a sex act without that person's consent, including a synthetic or deepfake image created, adapted or modified from their face, likeness or other distinguishing features.
• Exceptions cover voluntary exposure in public or commercial settings, disclosures made in the public interest, and disclosures by an interactive computer service under 47 U.S.C. 230.

Iowa Code 728.12(3) · Read the law's page

• Do not purchase, possess or knowingly promote a visual depiction created, adapted or modified to give the appearance that an identifiable minor is engaged in a prohibited sexual act, including an AI-generated or digitally manipulated depiction.
• The offense does not require proof of the actual identity of the depicted minor, and it binds any person, not only an AI developer or platform.

Iowa Code ch. 554J (2026 Iowa Acts, HF 864) · Read the law's page

• Applies to websites, apps and segments of apps where a substantial portion (one third or more) of the content is pornographic material harmful to minors.
• Perform reasonable age verification of Iowa users, confirming they are 18 or older, before granting access.
• Do not retain, sell, or disseminate identifying information.