What are the fines under Iowa's Consumer Data Protection Act?

Iowa's privacy law has the softest enforcement posture of any enacted US state privacy statute, and the reason is a single subsection with no expiry date on it.

The number is $7,500, and it is per violation

Section 715D.8(3) is explicit. If a controller or processor continues to violate the chapter following the cure period, or breaches the written statement it gave the attorney general, the attorney general may seek an injunction and civil penalties of up to seven thousand five hundred dollars for each violation.

"Each violation" is the phrase that decides the size of the number. A single misconfigured opt-out link is not one violation if it failed for forty thousand Iowa consumers. Texas uses the same $7,500 ceiling in Tex. Bus. & Com. Code 541.155(a), and Nebraska uses it in Neb. Rev. Stat. 87-1124(1). California is the outlier in the other direction, at $2,663 per violation and $7,988 for an intentional one after the CPPA's inflation adjustment.

Money collected goes to the consumer education and litigation fund established under Section 714.16C, which tells you something about how the state expects to use it.

The ninety-day cure period is the real story

Section 715D.8(2) requires the attorney general, before initiating any action, to give the controller or processor ninety days' written notice identifying the specific provisions of the chapter alleged to have been violated. If within that period the business cures the noticed violation and provides an express written statement that the violations have been cured and no further violations shall occur, no action shall be initiated.

Ninety days is the longest cure window in the country. Texas gives thirty. Indiana gives thirty. Nebraska gives thirty. Colorado repealed its general cure right, and Oregon's expired on January 1, 2026. Iowa's has no sunset clause in the text at all.

That does not make Iowa a safe place to be sloppy. It makes the first notice letter the moment the clock starts, and it makes the written statement a commitment you have to be able to keep.

Breaching the written statement is its own violation

Read Section 715D.8(3) again and notice it has two triggers, not one. Penalties follow if the business "continues to violate this chapter following the cure period in subsection 2" or "breaches an express written statement provided to the attorney general under that subsection".

So the statement you send to close out a cure period becomes an independent basis for liability. Sending an assurance you have not actually operationalized converts a fixable problem into a documented one.

No private right of action, and one enforcer

Section 715D.8(1) gives the attorney general exclusive authority to enforce the chapter, and empowers a civil investigative demand whenever there is reasonable cause to believe a person has engaged in, is engaging in, or is about to engage in a violation. The procedures in Section 685.6 apply to that demand.

Section 715D.8(4) closes the other door: nothing in the chapter provides a basis for, or is subject to, a private right of action, under the chapter or any other law. No class actions, no statutory damages claims from consumers.

What this means in practice

The realistic exposure in Iowa is not the first violation. It is the second one, or the one you told the attorney general you had fixed. A business operating across several states also cannot standardize on Iowa's timeline, because the same missed opt-out that buys ninety days in Iowa buys thirty in Texas and none in Colorado.