Iowa consumer data protection law, controller duties (sensitive data notice and opt-out) (Iowa Code 715D.4(2))
Iowa needs clear notice and an opportunity to opt out before sensitive data is processed, not opt-in consent.
Dated 17 Oct 2026Source checked 17 Oct 2026Basis: primary text
In the source's own words
“2. A controller shall not process sensitive data collected from a consumer for a nonexempt purpose without the consumer having been presented with clear notice and an opportunity to opt out of such processing”
Where it was read
Figures it counts in
It is shown on its own, not counted into a figure.
Cited in this guide