Technology (Consumer Data Protection)

HF 503 amends Iowa's consumer data protection law to give residents greater control over how personal data is used, particularly regarding automated profiling that affects major life decisions like loans, housing, jobs, or healthcare. It defines "profiling" as automated analysis of data to predict factors like health or behavior, requiring businesses to notify consumers in plain language and allow them to opt out of such profiling. The bill exempts health data already covered by federal HIPAA rules, financial institutions under federal law, government entities, and public health activities using de-identified data. It applies retroactively to January 1, 2025, affecting businesses handling consumer data in Iowa.

HF 406 requires device companies (manufacturers of smart devices) and AI application developers to provide clear, upfront notices when users initialize devices or start apps with AI. These notices must explain exactly what private data the AI accesses, how it will be used, and give users interactive options to refuse specific data access or uninstall the AI before it collects data. The bill mandates that all data usage must align with a "statement of purpose" disclosed to users, prohibiting companies from accessing or using data in ways not previously explained. It directly affects consumers using smart devices (like smartphones or tablets) sold in Iowa after July 2025, as well as manufacturers and developers of AI-enabled products.