In effect since January 1, 2025, the Iowa Consumer Data Protection Act (ICDPA) lets Iowans see, delete, and obtain a copy of the data companies hold and opt out of its sale. It is narrower than most state laws, though: Iowa grants no right to correct inaccurate data, and where most states make a company get a person's consent before handling sensitive information, it asks only that the company offer a chance to opt out.
This survey analyzes and compares data breach notification laws across all 50 U.S. states and the District of Columbia. Using a standardized framework of 50 questions, we examined each jurisdiction's requirements for breach notification timing, covered data types, notification recipients, enforcement mechanisms, and consumer remedies.
The survey reflects statutes enacted as of January 1, 2026.
The survey reflects statutes enacted as of January 1, 2026.