A bill for an act relating to consumer data protection, and including retroactive applicability provisions.

HF 503 amends Iowa's consumer data protection law to give residents greater control over how personal data is used, particularly regarding automated profiling that affects major life decisions like loans, housing, jobs, or healthcare. It defines "profiling" as automated analysis of data to predict factors like health or behavior, requiring businesses to notify consumers in plain language and allow them to opt out of such profiling. The bill exempts health data already covered by federal HIPAA rules, financial institutions under federal law, government entities, and public health activities using de-identified data. It applies retroactively to January 1, 2025, affecting businesses handling consumer data in Iowa.