Iowa Consumer Data Protection Act (ICDPA), publicly available information exemption

Iowa Code ch. 715D (Senate File 262, 2023)

A citation is an address, not a summary. The first part names the law; what follows narrows it to the exact section, article or paragraph.

What follows is LexLint's own research summary of this law, not legal advice.

In force since 1 January 2025.

A personal data rule binding private bodies.

As of 29 August 2026.

What it requires

Personal data that is lawfully made available through a government record, or that a consumer or widely distributed media has lawfully made available to the public without restricting it to a specific audience, falls outside the ICDPA's definition of personal data.
Do not assume Iowa consumers can opt out of automated profiling for consequential decisions the way Colorado or Connecticut consumers can; the ICDPA grants no such right.

What this law does

Drafted with AI from the cited sources under the direction of UnGovr staff. UnGovr holds editorial responsibility for this page.

Section 715D.1(18) defines personal data to exclude de-identified or aggregate data or publicly available information, and section 715D.1(24) defines publicly available information as information lawfully made available through federal, state, or local government records, or information a business has a reasonable basis to believe is lawfully made available to the general public through widely distributed media, by the consumer, or by a person to whom the consumer disclosed it to the general public via a channel of mass media without restricting it to a specific audience.

As in several peer states, this exemption is built into the definition of personal data itself, so scraped public-record or public-media personal data falls outside the ICDPA's scope by definition. The Act applies to persons conducting business in Iowa or targeting Iowa residents who, during a calendar year, control or process the personal data of at least 100,000 consumers, with a second, lower-threshold prong for entities deriving a substantial share of revenue from data sales.

Notably, unlike Colorado, Connecticut, and Virginia, the ICDPA does not grant Iowa consumers a right to opt out of automated profiling used in consequential decisions, a meaningful gap relative to those states.

When LexLint raises it

crawls_web
trains_models
processes_biometrics

Read the law

official text, Iowa Legislature (legis.iowa.gov)

Every line above is drawn from the primary source linked here, read on the date shown. This is a research summary, not legal advice.

Back to the example · Lint your app