IA HF2048

Applies to companies conducting business in Iowa that process personal data of 5,000 or more state residents in a single calendar year

Requires companies to obtain affirmative consent before processing personal data and disclose purposes for data use, including whether data will be used for automated decision making or AI training

Grants Iowa residents rights to confirm whether their data is being processed, obtain detailed summaries of their data, request corrections or deletion, and revoke consent at any time

Companies must cease all data processing within 30 calendar days after an individual revokes consent and cannot deny or downgrade service because someone exercised their privacy rights

Violations constitute unlawful practices under Iowa Code section 714.16, with enforcement authority given to the Attorney General and a private right of action for residents to seek injunctive relief, civil penalties, and actual damages