Iowa

Iowa's harassment offense reaches a person who disseminates, publishes, distributes, or posts a visual depiction showing another person in a state of full or partial nudity or engaged in a sex act, without that person's consent, and defines the other person to include an individual who is recognizable by face, likeness, or other distinguishing features whose image is used to create, adapt, or modify a visual depiction to depict them in that manner, reaching a nonconsensual synthetic or deepfake intimate image.

A violation is harassment in the first degree, an aggravated misdemeanor, and an offender eighteen or older must register as a sex offender. Exceptions apply to voluntary exposure in public or commercial settings, disclosures made in the public interest, and disclosures by an interactive computer service under 47 U.S.C. 230.

The provision binds any person and is not limited to an AI developer or platform; a private civil action under this section is available only for a different subparagraph, the false reporting of a crime, not for this one. The synthetic and deepfake image language was added by 2024 Iowa Acts, chapter 1065 (House File 2240), section 3, whose effective date the Iowa Legislature's own bill history record states as July 1, 2024.

Iowa's sexual-exploitation-of-a-minor offense reaches a visual depiction that has been created, adapted, or modified to give the appearance that an identifiable minor is engaged in a prohibited sexual act, which extends the offense to AI-generated and digitally manipulated depictions and does not require proof of the actual identity of the depicted minor.

Purchasing or possessing such a depiction is a class D felony for a first offense and a class C felony for a second or subsequent offense; knowingly promoting one is a class C felony; employing, using, or causing a minor to engage in the underlying act is a class B felony, with a court-imposable fine of up to fifty thousand dollars per offense in addition to any other sentence. The provision binds any person and is not limited to an AI developer or platform.

The AI-generated and manipulated depiction language, paragraph f, was added by 2024 Iowa Acts, chapter 1015 (Senate File 2243), section 1, whose effective date the Iowa Legislature's own bill history record states as July 1, 2024.

House File 2635, 2026 Iowa Acts chapter 1087, was signed by the Governor on May 13, 2026 and adds subsection 2A to Iowa Code section 514F.8, in the division on health insurance trade practices. A utilization review organization may use an artificial intelligence-based algorithm or system to provide an initial review of a request for prior authorization.

For a prior authorization request for a health care service based on medical necessity, the organization may not use such an algorithm or system as the sole basis for its decision to deny, delay, or downgrade the request. To downgrade means to change an expedited or urgent request for prior authorization to a standard determination, or otherwise to modify the health care service that is the subject of the request to a lower-level service. The bill history states an effective date of July 1, 2026.

An operator of a conversational AI service accessible to the public must clearly and conspicuously disclose to a minor account holder that the minor is interacting with artificial intelligence, and must disclose to any user that the service is artificial intelligence whenever a reasonable person could otherwise believe they are interacting with a human.

An operator may not give a minor user points or similar rewards at unpredictable intervals intended to increase engagement, must take reasonable measures to prevent the service from producing sexual content involving a minor account holder, urging a minor toward sexual conduct, sexually objectifying a minor, claiming to be sentient or human, or simulating a romantic or emotionally dependent relationship with a minor.

An operator must offer minor account holders, and the parents or guardians of minors under thirteen, tools to manage privacy and account settings, must adopt a protocol for responding to suicidal ideation or self-harm, and may not represent that the service provides licensed psychology or behavioral health services.

The Act was signed into law on May 2, 2026 as 2026 Iowa Acts chapter 1068, but its own applicability section defers every duty in the chapter to July 1, 2027, and it does not create a private right of action.

The chapter does not limit an operator to a private actor, and Iowa's general definitions statute includes a government or governmental subdivision or agency within the word person unless a chapter otherwise provides, so a government body operating a covered conversational AI service is bound in the same way as a private one.

Section 507F.7 of the Iowa Code requires a licensee to notify the commissioner of insurance no later than three business days from the date of the licensee's confirmation of a cybersecurity event if a listed condition applies. Section 507F.7(1)(b) reaches a licensee that reasonably believes that nonpublic information compromised by the cybersecurity event involves 250 or more consumers.

Section 507F.7(2) requires the notice to the commissioner to provide, in the form and manner the commissioner prescribes by rule, as much of the listed information as is available to the licensee at the time of the notification. Section 507F.7(3) gives the licensee a continuing obligation to update and supplement the initial notification to the commissioner as material changes to information previously provided occur.

In chapter 507F, a licensee is a person licensed, authorized to operate, or registered, or required to be licensed, authorized to operate, or registered, under the insurance laws of Iowa.

Section 507F.13 exempts a licensee that is subject to and in compliance with the Health Insurance Portability and Accountability Act, which must annually certify its compliance to the commissioner, and a licensee owned or controlled by a federally insured depository institution that complies with the Gramm-Leach-Bliley Act or comparable federal law. Section 507F.14 subjects a licensee that violates chapter 507F to penalties under section 505.7A and chapter 507B of the Iowa Code.

Section 507F.2 provides that chapter 507F is not to be construed to create or imply a private cause of action for a violation of its provisions. Chapter 79 of the 2021 Acts, House File 719, added chapter 507F, the Insurance Data Security Act, to the Iowa Code.

A licensee must maintain all records and documentation related to its investigation of a cybersecurity event for a minimum of five years from the date of the event and must produce them upon demand of the commissioner. Where a cybersecurity event has or may have occurred in an information system maintained by a third-party service provider, the licensee must complete an investigation or confirm and document that the provider has completed one.

A licensee is a person licensed, authorized to operate, or registered, or required to be, under the insurance laws of Iowa.

Notification of a breach of security must be made in the most expeditious manner possible and without unreasonable delay, consistent with the legitimate needs of law enforcement. A business subject to a breach requiring notification to more than 500 Iowa residents must also give written notice to the director of the consumer protection division of the Attorney General's office within five business days of notifying consumers.

A violation is an unlawful practice under section 714.16, and the Attorney General may recover damages on behalf of an injured person, but that recovery runs through the Attorney General rather than arming the person with a direct private right of action. The provisions this entry describes came into force on different days.

ICDPA governs private-sector processing of Iowa consumers' personal data. Enacted as Senate File 262 (90th General Assembly, 2023 session), signed March 28, 2023 (2023 Iowa Acts ch. 17), effective January 1, 2025 per consistent secondary reporting; the effective date was not independently pulled as an explicit sentence from the primary code text, since Iowa's official code PDF does not print effective dates inline the way some peer states' history lines do. Controller duties are allocated at section 715D.4 and processor duties at section 715D.5.

Chapter 90 of the Insurance Division's rules governs the treatment of nonpublic personal financial information and nonpublic personal health information about individuals by all licensees of the insurance division.

Chapter 90 also applies to information about individuals who obtain, or are claimants or beneficiaries of, products or services primarily for personal, family or household purposes from licensees, and does not apply to information about individuals or companies that obtain products or services for business, commercial or agricultural purposes.

Rule 90.9 bars a licensee from disclosing nonpublic personal financial information about a consumer to a nonaffiliated third party, except as the rules authorize, unless the licensee has provided the initial notice and an opt-out notice and a reasonable opportunity to opt out and the consumer does not opt out.

Rule 90.9 treats a licensee that mails the notices and allows the consumer to opt out by mailing a form, calling a toll-free telephone number or any other reasonable means within 30 days from the date of mailing as having given a reasonable opportunity to opt out.

Rule 90.6 requires the opt-out notice to state that the licensee discloses or reserves the right to disclose nonpublic personal financial information about its consumer to a nonaffiliated third party, that the consumer has the right to opt out, and a reasonable means to exercise the right.

Rule 90.11 bars a licensee from disclosing a policy number or similar access number or code for a consumer's policy or transaction account to a nonaffiliated third party, other than a consumer reporting agency, for use in telemarketing, direct-mail marketing or marketing through electronic mail to the consumer.

Rule 90.23 bars a licensee from unfairly discriminating against a consumer or customer because that consumer or customer has opted out of the disclosure of nonpublic personal financial information. Rule 90.3 requires a licensee to give an individual who becomes the licensee's customer a clear and conspicuous notice that accurately reflects its privacy policies and practices not later than when the licensee establishes a customer relationship.

Rule 90.3 also requires a licensee to give a consumer such a notice before the licensee discloses any nonpublic personal financial information about the consumer to a nonaffiliated third party, other than as two exception rules authorize. Rule 90.4 requires a licensee to give customers a clear and conspicuous notice of its privacy policies and practices not less than annually during the continuation of the customer relationship.

Rule 90.5 requires each initial, annual and revised privacy notice to state the categories of nonpublic personal financial information the licensee collects and discloses, and the categories of affiliates and nonaffiliated third parties to which it discloses.

Rule 90.5 also requires each such notice to explain the consumer's right to opt out of disclosure to nonaffiliated third parties and the methods for exercising it, and to describe the licensee's policies and practices for protecting the confidentiality and security of nonpublic personal financial information.

Rule 90.7 bars a licensee from disclosing nonpublic personal financial information to a nonaffiliated third party other than as the initial notice described unless it has provided a clear and conspicuous revised privacy notice and a new opt-out notice, among other conditions. Rule 90.26 provides that the rules became effective November 13, 2000, and extends the time for compliance until July 1, 2001. Rule 90.1 as currently printed was adopted by ARC 7741C, effective April 24, 2024.

Rule 90.25 provides that an insurer, producer or licensee that violates a requirement of the rules has committed a violation of Iowa Code section 507B.4, in addition to any other penalties provided by the laws of Iowa.

Section 507B.7 lets the Commissioner of Insurance order a civil penalty of up to $1,000 for each act or violation, up to $10,000 in the aggregate, or up to $5,000 for each act or violation, up to $50,000 in any one six-month period, if the person knew or reasonably should have known of the violation.

ICDPA gives an Iowa consumer the right to confirmation of processing, access, deletion, a portable copy, and an opt-out of the sale of personal data, and no right of correction or to opt out of profiling. Section 715D.3 lists no opt-out of targeted advertising, but a controller that sells personal data to third parties or engages in targeted advertising must clearly and conspicuously disclose it and the manner in which a consumer may opt out of it (section 715D.4(6)).

A controller must respond without undue delay and within 90 days of receipt, with one 45-day extension available; an appeal of a refusal must be decided within 60 days.

The Iowa Attorney General has exclusive authority to enforce ICDPA. Before suing, the Attorney General must give a controller or processor 90 days' written notice identifying the specific provisions violated; unlike Connecticut's, Delaware's, and Montana's time-limited or eliminated cure rights, this 90-day cure right carries no sunset date in the text read. Civil penalties run up to $7,500 per violation, and the chapter creates no private right of action.

In chapter 228 of the Iowa Code, mental health information means oral, written or recorded information which indicates the identity of an individual receiving professional services and which relates to the diagnosis, course or treatment of the individual's mental or emotional condition.

Section 228.2 bars a mental health professional, data collector, or employee or agent of a mental health professional, of a data collector, or of or for a mental health facility from disclosing or permitting the disclosure of mental health information, except as the chapter specifically authorizes. Section 228.2 requires the person disclosing mental health information to enter a notation with the individual's record stating the date of the disclosure and the name of the recipient.

Section 228.2 also requires the person disclosing to give the recipient a statement that unauthorized disclosure of mental health information is unlawful and that civil damages and criminal penalties may be applicable. Section 228.2 bars a recipient of mental health information from disclosing the information received, except as the chapter specifically authorizes.

Section 228.3 lets an individual eighteen years of age or older, or the individual's legal representative, consent to disclosure of mental health information by signing a voluntary written authorization that must specify the nature of the information, the persons authorized to disclose it and the purposes of use. Section 228.4 lets an individual or the individual's legal representative revoke a prior authorization in writing, effective on receipt by the person previously authorized to disclose.

Chapter 1082 of the 1986 Acts, Senate File 2247, added chapter 228 on the disclosure of mental health information to the Iowa Code. The Secretary of State certified that Senate File 2247 was published in the Quad-City Times on April 21, 1986, and in The Anamosa Journal-Eureka on April 23, 1986.

In section 729.6 of the Iowa Code, a health insurer means a carrier as defined in section 513B.2, and a third-party administrator has the meaning given in section 510.11. Subsection 4 of section 729.6 bars a third-party administrator or health insurer from releasing genetic information pertaining to an individual without the individual's prior written authorization.

Subsection 4 of section 729.6 lifts the authorization requirement for individuals participating in research settings, for tests conducted purely for research, for tests for somatic mutations, for forensic testing, for newborn screening, for paternity testing and for criminal investigations. Subsection 4 of section 729.6 bars a health insurer from discriminating against an individual or a member of the individual's family on the basis of genetic information or genetic testing.

Subsection 4 of section 729.6 bars a health insurer from using genetic information or genetic testing for underwriting health insurance in the individual and group markets. Subsection 4 of section 729.6 makes a violation of that subsection an unfair insurance trade practice under section 507B.4.

Section 507B.7 lets the Commissioner of Insurance order a civil penalty of up to $1,000 for each act or violation, up to $10,000 in the aggregate, or up to $5,000 for each act or violation, up to $50,000 in any one six-month period, if the person knew or reasonably should have known of the violation. Chapter 1153 of the 2010 Acts, Senate File 2215, added subsection 7A, release or use of genetic information, to section 507B.4.

Under section 729.6 of the Iowa Code, an employer includes the state of Iowa and any political subdivision, board, commission, department, institution or school district, and every other person employing employees within the state.

Subsection 2 of section 729.6 bars an employer, employment agency, labor organization or licensing agency from soliciting, requiring or administering a genetic test of a person as a condition of employment, preemployment application, labor organization membership or licensure. Subsection 2 of section 729.6 also bars the same persons from affecting the terms, conditions or privileges of employment, or terminating employment, membership or licensure, of a person who obtains a genetic test.

Subsection 5 of section 729.6 bars a person from selling to or interpreting for an employer, employment agency, labor organization or licensing agency a genetic test of an employee, member or licensee or of a prospective one. Subsection 6 of section 729.6 prohibits an agreement offering employment, membership, licensure or any pay or benefit in return for taking a genetic test.

Subsection 7 of section 729.6 requires compensation for lost wages and benefits for a person discharged, disciplined or discriminated against in violation of the section.

Subsection 9 of section 729.6 allows genetic testing of an employee who requests it and gives written and informed consent, to investigate a workers' compensation claim or, if the employer takes no adverse action as a result of the test, to determine the employee's susceptibility or level of exposure to potentially toxic chemicals or substances in the workplace.

Subsection 8 of section 729.6 lets an aggrieved employee, member, licensee or prospective one recover affirmative relief including reinstatement or hiring, with or without back pay, and attorney fees and court costs, from a person who violates subsection 2, 3, 5, 6 or 7.

Subsection 8 of section 729.6 also lets an aggrieved employee, member, licensee or prospective one, the county attorney or the attorney general seek an injunction in district court against an act that violates subsection 2, 3, 5, 6 or 7. Chapter 1059 of the 1992 Acts, Senate File 2145, added section 729.6 to the Iowa Code, in an act relating to the use of genetic testing in employment situations by employers, employment agencies, labor organizations and licensing agencies.

Subsection 3 of section 729.6 of the Iowa Code bars a person from obtaining genetic information or samples for genetic testing from an individual without first obtaining informed and written consent from the individual or the individual's authorized representative.

Subsection 3 of section 729.6 also bars a person from performing genetic testing of an individual, or collecting, retaining, transmitting or using genetic information, without the informed and written consent of the individual or the individual's authorized representative.

Subsection 3 of section 729.6 lifts the consent requirement for collection, retention, transmission or use that federal or other state law permits without consent, for identifying an individual in a criminal investigation by a law enforcement agency, for identifying deceased individuals, for establishing parental identity, for screening newborns, and for research, education and medical repositories whose information contains no personally identifiable information.

In section 729.6, genetic information has the meaning given in section 1191b(d)(6) of title 29 of the United States Code, and genetic testing has the meaning given to genetic test in section 1191b(d)(7) of that title.

Subsection 8 of section 729.6 makes a person who violates subsection 3 liable to an aggrieved employee, labor organization member, licensee or prospective one, and lets an aggrieved employee, member, licensee or prospective one, the county attorney or the attorney general seek an injunction against an act that violates subsection 3. Chapter 1153 of the 2010 Acts, Senate File 2215, added the consent requirement to section 729.6 as new subsection 2A.

Chapter 90 of the Insurance Division's rules governs the treatment of nonpublic personal financial information and nonpublic personal health information about individuals by all licensees of the insurance division. Rule 90.17 bars a licensee from disclosing nonpublic personal health information about a consumer or customer unless an authorization is obtained from the consumer or customer whose information is sought to be disclosed.

Rule 90.17 leaves a licensee or its insurance affiliate free to disclose nonpublic personal health information without an authorization for listed insurance functions, among them claims administration, fraud detection and underwriting.

Rule 90.18 requires a valid authorization to be in written or electronic form and to identify the consumer or customer, describe the types of information, the recipients, the purpose and use, carry the signature and date, and state how long it is valid and how it may be revoked. Rule 90.18 limits an authorization to no more than 24 months, lets the individual revoke it at any time, and requires the licensee to retain the authorization or a copy in the individual's record.

Rule 90.26 provides that the health information rules are effective January 2, 2002, and that no administrative action against noncompliance will be taken until that date. Rule 90.25 provides that an insurer, producer or licensee that violates a requirement of the rules has committed a violation of Iowa Code section 507B.4, in addition to any other penalties provided by the laws of Iowa.

Section 507B.7 lets the Commissioner of Insurance order a civil penalty of up to $1,000 for each act or violation, up to $10,000 in the aggregate, or up to $5,000 for each act or violation, up to $50,000 in any one six-month period, if the person knew or reasonably should have known of the violation.

ICDPA classifies data revealing racial or ethnic origin, religious beliefs, mental or physical health diagnosis, sexual orientation, or citizenship or immigration status (with a discrimination-avoidance carve-out not seen in the other six states in this batch), the processing of genetic or biometric data to uniquely identify a person, a known child's data, and precise geolocation data as sensitive data, but requires only an opt-out mechanism for sensitive-data processing rather than the opt-in consent every other state in this batch requires.

Genetic or biometric data collected to identify a person is itself an enumerated sensitive-data category (§ 715D.1(26)(b)), so biometric data is a heightened category here.

Separately, 'Biometric data' (§ 715D.1(4)) carries the same blanket, unconditional exclusion for recording-derived data as Virginia's VCDPA, word for word: no clawback for data generated to identify someone, so a voiceprint or faceprint extracted from a recording is not biometric data under ICDPA regardless of purpose, and therefore is not sensitive data either. These definitions sit at § 715D.1, not at § 715D.2, which is a different section (Scope and exemptions).

In chapter 228 of the Iowa Code, a third-party payor is a person which provides accident and health benefits or medical, surgical or hospital benefits, including insurers, nonprofit health service corporations, health maintenance organizations, governmental agencies and self-insured employers.

Section 228.7 lets a mental health professional, data collector or mental health facility disclose mental health information, on the prior written consent of the patient or the patient's legal representative, to a third-party payor or peer review organization that has filed a written statement with the commissioner of insurance.

Section 228.7 bars an employee or agent of a third-party payor or of a peer review organization from using or disclosing mental health information to any person, except to the extent necessary to administer claims, to conduct a utilization and quality control review, to audit claims paid, or as otherwise authorized by law.

Section 228.7 bars routine or ongoing access to mental health information for employees and agents of a self-insured employer that has not filed the statement, unless they have signed a statement that they are aware of the limits on use and of the penalty for unauthorized disclosure.

Section 228.7 makes an employee or agent of a third-party payor or a peer review organization who willfully uses or discloses mental health information in violation of subsection 2 guilty of a serious misdemeanor, with a fine not to exceed $500 for a first offense and $5,000 for each subsequent offense. The history note of section 228.7 cites section 1 of chapter 1226 of the 88 Acts.

Section 279.71 of the Iowa Code defines an operator as the operator of an internet site, online service, online application or mobile application with actual knowledge that it is used primarily for kindergarten through grade twelve school purposes and was designed and marketed for such purposes.

Section 279.71 bars an operator from knowingly engaging in targeted advertising based on information acquired through use of its site, service or application for kindergarten through grade twelve school purposes, and from knowingly using such information to amass a profile about a student except in furtherance of those purposes. Paragraph 2(a)(3) of section 279.71 lists selling or renting a student's information, including covered information, among the acts that paragraph 2(a) bars.

Paragraph 2(a)(4) of section 279.71 bars disclosure of covered information unless it is made for a purpose the paragraph lists.

Subsection 3 of section 279.71 requires an operator to implement and maintain security procedures and practices consistent with current industry standards and applicable law, and to delete a student's covered information as soon as reasonably practicable when the school district or attendance center requests deletion, unless the student or parent or guardian consents to keeping it.

Section 279.71 does not apply to general audience internet sites, online services, online applications or mobile applications, even if login credentials created for an operator's site, service or application may be used to access them. House File 2354 of the 2018 session added the student online personal information protection section to the Iowa Code.

Section 716.6B, titled Unauthorized computer access, penalties, civil cause of action, provides that a person who knowingly and without authorization accesses a computer, computer system, or computer network commits a simple misdemeanor for any access that is not an aggravated or serious misdemeanor, a serious misdemeanor if computer data is copied, altered, or deleted, and an aggravated misdemeanor if the data accessed contains a confidential record as defined in section 22.7, operational or support data of a public utility, rural water district, municipal utility or public airport, or a trade secret.

Subsection 2 provides that the prosecuting attorney or an aggrieved person may institute civil proceedings against any person in district court seeking relief from conduct constituting a violation of the section or to prevent, restrain, or remedy such a violation. Section 716.6B was added by 2000 Iowa Acts, chapter 1201, section 11, approved May 19, 2000, as a simple misdemeanor for knowing access without authorization.

The serious and aggravated tiers and the civil proceedings in subsection 2 were added by 2002 Iowa Acts, chapter 1049, section 2, approved April 1, 2002. Acts of a public nature passed at a regular session take effect on the first day of July following their passage unless the act provides otherwise, so section 716.6B took effect July 1, 2000.

Section 715D.1(18) defines personal data to exclude de-identified or aggregate data and publicly available information, and section 715D.1(24) defines publicly available information as information that is lawfully made available through federal, state, or local government records, or information that a business has reasonable basis to believe is lawfully made available to the general public through widely distributed media, by the consumer, or by a person to whom the consumer has disclosed the information, unless the consumer has restricted the information to a specific audience.

The exclusion is built into the definition of personal data itself, so personal data lawfully made available through government records or widely distributed media falls outside the Act's scope by definition. The Act applies to persons conducting business in Iowa or targeting Iowa residents who, during a calendar year, control or process the personal data of at least 100,000 consumers, with a second, lower-threshold prong for entities deriving a substantial share of revenue from data sales.

A licensee must develop, implement and maintain a comprehensive written information security program based on its risk assessment, commensurate with its size and complexity, the nature and scope of its activities including its use of third-party service providers, and the sensitivity of the nonpublic information it holds.

A licensee is a person licensed, authorized to operate, or registered, or required to be, under the insurance laws of Iowa, and does not include a purchasing group, a risk retention group chartered and licensed in another state, or a person acting as an assuming insurer that is domiciled in another state or jurisdiction.

Section 507F.4 does not apply to a licensee that has fewer than twenty individuals on its workforce, including employees and independent contractors, has less than five million dollars in gross annual revenue, or has less than ten million dollars in year-end total assets.

A licensee must exercise due diligence in selecting its third-party service providers, conduct oversight of all third-party service provider arrangements and require each provider to implement appropriate administrative, technical and physical measures to protect and secure the information systems and nonpublic information it can access or holds. Licensees had to comply with the third-party service provider section no later than January 1, 2024.

A licensee with a board of directors must have the board or an appropriate committee require executive management to develop, implement and maintain the program and to provide the board a written report at least annually. The chapter does not apply to a licensee that is subject to, and in compliance with, the Health Insurance Portability and Accountability Act, and that licensee must annually submit to the commissioner a written certification of its compliance.

The chapter does not apply to a licensee that is owned or controlled by a federally insured depository institution that is subject to, and in compliance with, the Gramm-Leach-Bliley Act or comparable federal law and corresponding regulations. A licensee that violates the chapter is subject to penalties under section 505.7A and chapter 507B of the Iowa Code. The chapter does not create or imply a private cause of action for a violation of its provisions.

Among the powers and duties of the chief information officer is prescribing policies and adopting rules relating to cybersecurity, which are binding on all supported entities except as otherwise provided in the subchapter. A supported entity is a unit of state government that is an authority, board, commission, committee, council, department or independent agency as defined in section 7E.4, including each principal central department enumerated in section 7E.5.

Among the powers and duties of the chief information officer is developing and maintaining security policies and systems to ensure the integrity of the state's information resources and to prevent the disclosure of confidential records.

A covered entity is a business that accesses, receives, stores, maintains, communicates, or processes personal information or restricted information in or through a system, network, or service located in or outside Iowa. Business is defined to include a financial institution and an entity organized under Iowa Code chapter 28E, but not a municipality.

A covered entity that satisfies this chapter's requirements gains an affirmative defense to a tort claim alleging that a failure to implement reasonable information security controls caused a data breach concerning personal information or restricted information. To satisfy those requirements, a covered entity must create, maintain, and comply with a written cybersecurity program that reasonably conforms to a named industry framework or an applicable regulatory regime.

The program's scale and scope is appropriate if it is funded at or above the covered entity's own most recently calculated maximum probable loss from a data breach. The chapter imposes no independent duty to adopt a program and creates no private right of action of its own for failing to comply with it.

A sanitary sewage utility must notify the Iowa Utilities Commission about any incident involving a cyberattack affecting the well-being of the utility, its customers, or the environment, and about three other listed kinds of incident. The utility must notify the commission immediately, or as soon as practical, of any reportable incident, by emailing the commission duty officer or, when email is not available, by calling the duty officer.

The utility will notify the commission when the incident has ended and normal sanitary sewage service has been restored. The chapter's term utility means a water, sanitary sewage or storm water drainage public utility under Iowa Code section 476.1(2) and does not include a county or an entity organized under chapter 28E that is composed entirely of counties.

The Iowa Code chapter on utility regulation does not apply to municipally owned sanitary sewage or storm water drainage systems, sanitary districts or districts organized under chapter 468.

A public utility that, after written notice by the commission of a specific violation, violates the same provision of the chapter, the same commission rule or the same provision of a commission order is subject to a civil penalty, which the commission may levy, of not less than one hundred dollars nor more than two thousand five hundred dollars per violation.

A public utility that willfully violates the same provision, rule or order after that written notice is subject to a civil penalty of not less than one thousand dollars nor more than ten thousand dollars per violation.

Among the powers and duties of the chief information officer is requiring supported entities to report information technology security incidents to the department in a timely manner, to provide comprehensive information concerning the information technology security they employ and to forecast their projected future information technology security needs and capabilities.

A supported entity is a unit of state government that is an authority, board, commission, committee, council, department or independent agency as defined in section 7E.4, including each principal central department enumerated in section 7E.5.

A supported entity does not include the office of the governor or the office of an elective constitutional or statutory officer, the general assembly, the judicial branch, a political subdivision of the state or the state board of regents and the institutions it operates.

A storm water drainage utility must notify the Iowa Utilities Commission about any incident involving a cyberattack affecting the well-being of the utility, its customers, or the environment, and about three other listed kinds of incident. The utility must notify the commission immediately, or as soon as practical, of any reportable incident, by emailing the commission duty officer or, when email is not available, by calling the duty officer.

The utility will notify the commission when the incident has ended and normal storm water drainage service has been restored. The chapter's term utility means a water, sanitary sewage or storm water drainage public utility under Iowa Code section 476.1(2) and does not include a county or an entity organized under chapter 28E that is composed entirely of counties.

The Iowa Code chapter on utility regulation does not apply to municipally owned sanitary sewage or storm water drainage systems, sanitary districts or districts organized under chapter 468.

A public utility that, after written notice by the commission of a specific violation, violates the same provision of the chapter, the same commission rule or the same provision of a commission order is subject to a civil penalty, which the commission may levy, of not less than one hundred dollars nor more than two thousand five hundred dollars per violation.

A public utility that willfully violates the same provision, rule or order after that written notice is subject to a civil penalty of not less than one thousand dollars nor more than ten thousand dollars per violation.

A water utility must notify the Iowa Utilities Commission about any incident involving a cyberattack affecting the well-being of the utility, its customers, or the environment, and about five other listed kinds of incident. The utility must notify the commission immediately, or as soon as practical, of any reportable incident, by emailing the commission duty officer or, when email is not available, by calling the duty officer.

The utility will notify the commission when the incident has ended and normal water service has been restored. The chapter's term utility means a water, sanitary sewage or storm water drainage public utility under Iowa Code section 476.1(2) and does not include a county or an entity organized under chapter 28E that is composed entirely of counties.

The Iowa Code chapter on utility regulation does not apply to municipally owned waterworks, waterworks having less than two thousand customers, joint water utilities, rural water districts and cooperative water associations.

A public utility that, after written notice by the commission of a specific violation, violates the same provision of the chapter, the same commission rule or the same provision of a commission order is subject to a civil penalty, which the commission may levy, of not less than one hundred dollars nor more than two thousand five hundred dollars per violation.

A public utility that willfully violates the same provision, rule or order after that written notice is subject to a civil penalty of not less than one thousand dollars nor more than ten thousand dollars per violation.

Operators of internet sites, apps, or segments of apps containing a substantial portion (one third or more) of material pornographic for minors must perform reasonable age verification of Iowa users before granting access, and may not retain, sell, or disseminate identifying information. Signed June 1, 2026.