Iowa

Iowa's harassment offense reaches a person who disseminates, publishes, distributes, or posts a visual depiction showing another person in a state of full or partial nudity or engaged in a sex act, without that person's consent, and defines the other person to include an individual who is recognizable by face, likeness, or other distinguishing features whose image is used to create, adapt, or modify a visual depiction to depict them in that manner, reaching a nonconsensual synthetic or deepfake intimate image.

A violation is harassment in the first degree, an aggravated misdemeanor, and an offender eighteen or older must register as a sex offender. Exceptions apply to voluntary exposure in public or commercial settings, disclosures made in the public interest, and disclosures by an interactive computer service under 47 U.S.C. 230.

The provision binds any person and is not limited to an AI developer or platform; a private civil action under this section is available only for a different subparagraph, the false reporting of a crime, not for this one. The provision's own amendment history in the Iowa Code names the amending Acts by year only, without a single commencement date for this language.

Iowa's sexual-exploitation-of-a-minor offense reaches a visual depiction that has been created, adapted, or modified to give the appearance that an identifiable minor is engaged in a prohibited sexual act, which extends the offense to AI-generated and digitally manipulated depictions and does not require proof of the actual identity of the depicted minor.

Purchasing or possessing such a depiction is a class D felony for a first offense and a class C felony for a second or subsequent offense; knowingly promoting one is a class C felony; employing, using, or causing a minor to engage in the underlying act is a class B felony, with a court-imposable fine of up to fifty thousand dollars per offense in addition to any other sentence. The provision binds any person and is not limited to an AI developer or platform.

The provision's own amendment history in the Iowa Code names the amending Acts by year only, without a single commencement date for this language.

An operator of a conversational AI service accessible to the public must clearly and conspicuously disclose to a minor account holder that the minor is interacting with artificial intelligence, and must disclose to any user that the service is artificial intelligence whenever a reasonable person could otherwise believe they are interacting with a human.

An operator may not give a minor user points or similar rewards at unpredictable intervals intended to increase engagement, must take reasonable measures to prevent the service from producing sexual content involving a minor account holder, urging a minor toward sexual conduct, sexually objectifying a minor, claiming to be sentient or human, or simulating a romantic or emotionally dependent relationship with a minor.

An operator must offer minor account holders, and the parents or guardians of minors under thirteen, tools to manage privacy and account settings, must adopt a protocol for responding to suicidal ideation or self-harm, and may not represent that the service provides licensed psychology or behavioral health services.

The Act was signed into law on May 2, 2026 as 2026 Iowa Acts chapter 1068, but its own applicability section defers every duty in the chapter to July 1, 2027, and it does not create a private right of action.

The chapter does not limit an operator to a private actor, and Iowa's general definitions statute includes a government or governmental subdivision or agency within the word person unless a chapter otherwise provides, so a government body operating a covered conversational AI service is bound in the same way as a private one.

Notification of a breach of security must be made in the most expeditious manner possible and without unreasonable delay, consistent with the legitimate needs of law enforcement. A business subject to a breach requiring notification to more than 500 Iowa residents must also give written notice to the director of the consumer protection division of the Attorney General's office within five business days of notifying consumers.

A violation is an unlawful practice under section 714.16, and the Attorney General may recover damages on behalf of an injured person, but that recovery runs through the Attorney General rather than arming the person with a direct private right of action. This provision is in force under the current codified text; no dated original commencement is established, so no effective date is recorded here.

ICDPA governs private-sector processing of Iowa consumers' personal data. Enacted as Senate File 262 (90th General Assembly, 2023 session), signed March 28, 2023 (2023 Iowa Acts ch. 17), effective January 1, 2025 per consistent secondary reporting; the effective date was not independently pulled as an explicit sentence from the primary code text, since Iowa's official code PDF does not print effective dates inline the way some peer states' history lines do. Controller duties are allocated at section 715D.4 and processor duties at section 715D.5.

ICDPA gives an Iowa consumer the right to confirmation of processing, access, deletion, a portable copy, and opt-out of sale, targeted advertising, and profiling for solely-automated consequential decisions, but notably grants no right of correction, a real gap relative to the other six states researched in this batch.

A controller must respond without undue delay and within 90 days of receipt, double the 45-day window used elsewhere in this batch, with one 45-day extension available; an appeal of a refusal must be decided within 60 days.

The Iowa Attorney General has exclusive authority to enforce ICDPA. Before suing, the Attorney General must give a controller or processor 90 days' written notice identifying the specific provisions violated; unlike Connecticut's, Delaware's, and Montana's time-limited or eliminated cure rights, this 90-day cure right carries no sunset date in the text read. Civil penalties run up to $7,500 per violation, and the chapter creates no private right of action.

ICDPA classifies data revealing racial or ethnic origin, religious beliefs, mental or physical health diagnosis, sexual orientation, or citizenship or immigration status (with a discrimination-avoidance carve-out not seen in the other six states in this batch), the processing of genetic or biometric data to uniquely identify a person, a known child's data, and precise geolocation data as sensitive data, but requires only an opt-out mechanism for sensitive-data processing rather than the opt-in consent every other state in this batch requires.

Genetic or biometric data collected to identify a person is itself an enumerated sensitive-data category (§ 715D.1(26)(b)), so biometric data is a heightened category here.

Separately, 'Biometric data' (§ 715D.1(4)) carries the same blanket, unconditional exclusion for recording-derived data as Virginia's VCDPA, word for word: no clawback for data generated to identify someone, so a voiceprint or faceprint extracted from a recording is not biometric data under ICDPA regardless of purpose, and therefore is not sensitive data either. These definitions sit at § 715D.1, not at § 715D.2, which is a different section (Scope and exemptions).

Section 716.6B, titled Unauthorized computer access, penalties, civil cause of action, provides that a person who knowingly and without authorization accesses a computer, computer system, or computer network commits an offense graded from simple misdemeanor to aggravated misdemeanor depending on what is accessed, with the aggravated tier applying where the data accessed is a confidential record under Iowa Code section 22.7 or utility operational or support data.

The statute's own text confirms it creates a private civil cause of action for injunctive and other relief, the same structural feature Delaware's computer crime statute carries. No published Iowa decision applies section 716.6B to scraping of a public-facing page.

Section 715D.1(18) defines personal data to exclude de-identified or aggregate data or publicly available information, and section 715D.1(24) defines publicly available information as information lawfully made available through federal, state, or local government records, or information a business has a reasonable basis to believe is lawfully made available to the general public through widely distributed media, by the consumer, or by a person to whom the consumer disclosed it to the general public via a channel of mass media without restricting it to a specific audience.

As in several peer states, this exemption is built into the definition of personal data itself, so scraped public-record or public-media personal data falls outside the ICDPA's scope by definition. The Act applies to persons conducting business in Iowa or targeting Iowa residents who, during a calendar year, control or process the personal data of at least 100,000 consumers, with a second, lower-threshold prong for entities deriving a substantial share of revenue from data sales.

Notably, unlike Colorado, Connecticut, and Virginia, the ICDPA does not grant Iowa consumers a right to opt out of automated profiling used in consequential decisions, a meaningful gap relative to those states.

A covered entity is a business that accesses, receives, stores, maintains, communicates, or processes personal information or restricted information in or through a system, network, or service located in or outside Iowa. Business is defined to include a financial institution and an entity organized under Iowa Code chapter 28E, but not a municipality.

A covered entity that satisfies this chapter's requirements gains an affirmative defense to a tort claim alleging that a failure to implement reasonable information security controls caused a data breach concerning personal information or restricted information. To satisfy those requirements, a covered entity must create, maintain, and comply with a written cybersecurity program that reasonably conforms to a named industry framework or an applicable regulatory regime.

The program's scale and scope is appropriate if it is funded at or above the covered entity's own most recently calculated maximum probable loss from a data breach. The chapter imposes no independent duty to adopt a program and creates no private right of action of its own for failing to comply with it.