Does Iowa's Consumer Data Protection Act Require Businesses to Honor Universal Opt-Out Signals?

No. Iowa's Consumer Data Protection Act (ICDPA), in effect since January 1, 2025, does not require businesses to recognize or act on universal opt-out preference signals such as Global Privacy Control — a position confirmed by compliance guides reviewing the statute as recently as September 2026.

What the ICDPA Requires Instead

The ICDPA still gives Iowa consumers the right to opt out of the sale of their personal data and of targeted advertising, but it requires them to exercise that right through a direct request to each business — for example, by submitting a form or emailing a privacy contact — rather than letting a single browser-level signal apply across every site a consumer visits. That's a meaningfully lighter compliance lift than states where one signal does the work for every covered business at once.

Iowa and Utah Are the Outliers

Most comprehensive state privacy laws that followed California's lead — Colorado, Connecticut, and more recently Oregon — built in a universal opt-out signal requirement from the start or added one on a later effective date. Iowa's law, modeled more closely on Utah's, deliberately left that requirement out. Industry analyses comparing the two have consistently grouped Iowa with Utah as the two state laws that impose no obligation to honor a browser-based or device-based opt-out signal, in contrast to the other states that require it.

Why This Still Doesn't Mean "Ignore It"

Dropping Global Privacy Control detection for Iowa traffic specifically is rarely worth the engineering effort it would take to carve out one state from an otherwise unified compliance stack. Most businesses operating across multiple states already honor universal signals everywhere because building state-by-state exceptions costs more than treating every visitor as if the strictest applicable rule applies. Iowa's lack of a mandate is relevant mainly for businesses that operate only in Iowa, or that are deciding how much engineering investment a nationwide opt-out system needs to meet the minimum legal bar in every jurisdiction they touch.

What Iowa Does Still Require

• Direct opt-out requests: A consumer who emails or submits a form asking to stop having their data sold or used for targeted ads must have that request honored.
• A privacy notice: Controllers still need a reasonably accessible, clear privacy notice disclosing data practices.
• Data protection assessments: Processing that presents a heightened risk, such as targeted advertising or the sale of personal data, requires a documented risk assessment under the statute.

Bottom Line

If your opt-out system already honors Global Privacy Control nationwide, there's no compliance reason to disable it for Iowa visitors — but if you're scoping a system from scratch and need to know the legal floor, Iowa doesn't require a universal-signal mechanism the way Colorado, Connecticut, and Oregon do.

Sources: Cookiebot, "Iowa Consumer Data Protection Act (ICDPA)" guide (updated September 2026, cookiebot.com); Sourcepoint, "Iowa Enacts Comprehensive Privacy Law" (sourcepoint.com); Gibson Dunn, "Iowa Becomes Sixth State to Enact Comprehensive Privacy Law" (gibsondunn.com); PrivacyLawMap, Iowa state guide (privacylawmap.com).