Law / United States / 
Iowa
HF 864, age verification for websites and apps pornographic for minors
Iowa Code ch. 554J (2026 Iowa Acts, HF 864)
In force since .
An adult content age verification (AV) rule binding private bodies.
- Audit expectation
- none
What it requires
- Applies to websites, apps and segments of apps where a substantial portion (one third or more) of the content is pornographic material harmful to minors.
- Perform reasonable age verification of Iowa users, confirming they are 18 or older, before granting access.no control in the NIST Privacy Framework
- Do not retain, sell, or disseminate identifying information.NIST Privacy FrameworkCT.DM-P5NIST Privacy FrameworkCT.PO-P1
These lines are LexLint's reading of the law's text.
In the frameworks
Our reading of where this law's duties sit in each framework, and in the NIST Privacy Framework, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
If you get it wrong
Private right of actionNo
Penalties
Civil penalties up to $1,000 per violation, capped at $10,000 per day; each access of a noncompliant site or app is a separate violation.
Who enforces it
Enforcement body
Iowa Attorney General (injunctions and civil penalty actions); the Attorney General may also approve additional verification methods by rule.
Settledness
The Attorney General's rulemaking docket lists a chapter 40 rulemaking, "Age Verification for Internet Material Pornographic for Minors", with a regulatory analysis published on and a public hearing on .
- As of
- Open questions
- Does a 'segment of an internet site or application' under Iowa Code section 554J.2(1) include a single feed, channel or account on a social media platform, and is the 'substantial portion' threshold of thirty-three percent or more of the total amount of data publicly available measured within that segment or across the whole site?
- Which methods has the attorney general approved by rule under Iowa Code section 554J.2(2)(c) as reasonable age verification, beyond digital identification and a commercially reasonable method that relies on transactional data?
What it reaches
Age threshold
18
Covered services
Websites, applications, or segments of applications where a substantial portion of the content is pornographic material harmful to minors.
Verification methods
Digital ID, Transactional data
What it makes you log
Log retention
The exception applies where retention or dissemination is required by law or a court order.
- As of
- Basis
- Fixed
- Prohibits retaining
- Identifying information of an individual subject to reasonable age verification, which the person performing the verification, or a third party that does it for them, may not retain, sell, lease or otherwise disseminate
Logging duty
Section 554J.2(1) requires a person who operates an internet site, application or segment with a substantial portion of content pornographic for minors to use reasonable age verification. It does not require a log or record of the check, and it names no audit. Subsection 3 instead bars keeping, selling, leasing or disseminating the identifying information.
- Kind
- None
- As of
What this law does
Operators of internet sites, apps, or segments of apps containing a substantial portion (one third or more) of material pornographic for minors must perform reasonable age verification of Iowa users before granting access, and may not retain, sell, or disseminate identifying information. Signed .
When LexLint raises it
When your app profile says your app publishes adult content.
Back to the example · Lint your app
Page updated .