Technology (Consumer Data Protection) in Iowa

in committee · Iowa · House Feb 16, 2026

HF 2469: A bill for an act prohibiting the use of an automated decision-making system to alter the price of a product or service for a specific individual based on surveillance data, and providing civil penalties.

HF 2469 prohibits businesses from using automated systems (like AI or algorithms) to change the price of a product or service for a specific person based on "surveillance data" - such as information gathered about their behavior, salary, or biometrics. The law defines this data as anything collected through observation or inference about an individual or their group. Exceptions include price changes due to actual cost differences, widely available discounts (like student or senior rates), insurance pricing, or credit decisions under federal law. Violations could result in civil penalties of up to $40,000 per incident, enforced through existing consumer fraud laws.

Topics ✓ Technology

Sub-Topics Artificial Intelligence Consumer Data Protection

in committee · Iowa · House Feb 12, 2026

HSB 723: A bill for an act relating to intelligence data, including the use of historical location information.

This bill requires automatic license plate readers used by law enforcement to permanently delete captured vehicle images and associated data within 72 hours (down from 30 days). It defines "historical location information" as data revealing locations more than 24 hours old and restricts sharing this data with private third parties. Law enforcement may access such data only with a warrant, consent, during emergencies (like Amber Alerts), or for specific enforcement purposes. The bill also limits interstate sharing of historical location data and mandates public disclosure of inter-agency agreements within metropolitan areas.

Topics ✓ Criminal Justice ✓ Technology

Sub-Topics Law Enforcement Consumer Data Protection

in committee · Iowa · Senate Feb 12, 2026

SF 2278: A bill for an act prohibiting personalized algorithmic pricing and surveillance pricing at certain food retail establishments, and providing civil penalties.

SF 2278 prohibits large food retail stores (over 15,000 sq ft selling primarily food) from using personalized algorithmic pricing or surveillance pricing based on consumer data. It requires clear disclosure ("THIS PRICE WAS SET BY AN ALGORITHM USING YOUR PERSONAL DATA") when algorithmic pricing is used, bans electronic shelf labels for personalized pricing, and prohibits using data about minors (<17) or protected class characteristics (like race or gender) to set prices. Retailers must use physical price tags instead of digital displays for non-promotional pricing and cannot withhold discounts based on protected class data. The law applies only to qualifying food retailers, excluding financial services and insurers.

Topics ✓ Technology

Sub-Topics Artificial Intelligence Consumer Data Protection Data Privacy

in committee · Iowa · House Mar 9, 2026

HF 2555: A bill for an act relating to the use of automatic registration plate readers and providing penalties.

HF 2555 regulates how law enforcement in Iowa uses automatic license plate readers. It requires all plate readers to be approved by a state procurement team, mandates vendors to delete captured vehicle data after 21 days (and audit records after 2 years), and generally requires a warrant for accessing plate data more than 24 hours after capture - except for stolen vehicles, voluntary consent, or emergency situations. The bill directly affects law enforcement agencies and technology vendors supplying plate reader systems, ensuring data is deleted promptly and access is legally justified. Key provisions include strict vendor certification about data handling, mandatory audit trails tracking all system access, and requirements for data security standards.

Topics ✓ Criminal Justice ✓ Technology

Sub-Topics Law Enforcement Consumer Data Protection

in committee · Iowa · House Feb 16, 2026

HF 2452: A bill for an act establishing the data security program within the department of education, and making appropriations.

HF 2452 establishes a state-run data security program within Iowa's Department of Education, allowing school districts to opt in for enhanced protection of student and district data. The department must select data security vendors through a request for proposals process, and participating school districts must commit for an entire school year without mid-year withdrawal. The bill appropriates $250,000 from the state general fund for the 2026-2027 fiscal year to fund this program, with money in the dedicated fund rolling over annually instead of reverting to the general fund. This program directly affects school districts choosing to participate and aims to standardize data security practices across Iowa's educational institutions.

Topics ✓ Budget & Taxes ✓ Education ✓ Technology

Sub-Topics State Budget Consumer Data Protection

in committee · Iowa · Senate Jan 15, 2026

SF 2052: A bill for an act relating to the issuance of driver’s licenses and nonoperator’s identification cards, including physical forms of such identification and noncompliance with federal requirements.

SF 2052 requires Iowa's Department of Transportation to issue driver's licenses and nonoperator ID cards that do not meet federal REAL ID standards upon applicant request. It prohibits the collection or storage of biometric data (like facial scans or fingerprints), digital ID formats, and copies of identity documents (such as birth certificates or utility bills) for these noncompliant cards. The bill mandates that applicants be informed they can choose a noncompliant option and requires physical license cards instead of digital versions. This directly affects Iowa residents who opt for state-issued IDs that won't satisfy federal requirements for airport security or federal buildings.

Topics ✓ Immigration ✓ Technology

Sub-Topics Driver Licenses & IDs Consumer Data Protection

in committee · Iowa · House Jan 14, 2026

HF 2048: A bill for an act relating to personal data processing practices for companies, and making civil penalties applicable.

HF 2048 requires companies processing personal data for 5,000+ Iowa residents annually to obtain clear consent before using data, disclose how data will be used (including for automated decisions), and limit collection to what’s necessary. It grants Iowa residents the right to access, correct, delete their data, and revoke consent at any time. Companies must implement security measures to protect data and face civil penalties of up to $7,500 per violation for breaches or noncompliance. The bill applies to commercial data processing but exempts law enforcement, de-identified data, and public information.

Topics ✓ Technology

Sub-Topics Consumer Data Protection Data Privacy

in committee · Iowa · House Jan 30, 2026

HF 2110: A bill for an act relating to the issuance of driver’s licenses and nonoperator’s identification cards, including physical forms of such identification and noncompliance with federal requirements.

HF 2110 requires Iowa's Department of Transportation to issue driver's licenses and nonoperator ID cards that do not comply with federal REAL ID standards upon applicant request. The bill prohibits the department from collecting or storing biometric data (like fingerprints or facial scans), retaining supporting documents (such as birth certificates or utility bills), or sharing applicant information in federal databases. It mandates that applicants be informed about the option to obtain a noncompliant license and ensures that noncompliant IDs remain valid for state driving and identification purposes. This directly affects Iowa residents who choose not to obtain REAL ID-compliant identification.

Topics ✓ Immigration ✓ Technology

Sub-Topics Driver Licenses & IDs Consumer Data Protection

in committee · Iowa · Senate Feb 4, 2026

SSB 3085: A bill for an act relating to private entity requirements concerning biometric data, and providing civil penalties.

This Iowa bill (SSB 3085) regulates how private businesses handle biometric data - such as fingerprints, facial scans, or voice recordings - of individuals. It requires private entities to create public retention policies (capping data storage at 3 years), obtain written consent before collecting data, and prohibit selling or profiting from such data. Businesses must also secure biometric data using industry-standard protections equivalent to those for passwords. The law excludes employer use of employee biometric data and imposes escalating civil penalties: $1,000 for a first violation, up to $10,000 for repeated violations.

Topics ✓ Technology

Sub-Topics Consumer Data Protection Data Privacy

in committee · Iowa · Senate Jan 30, 2025

SF 143: A bill for an act relating to consumer data protection, and including retroactive applicability provisions.

SF 143 strengthens Iowa's consumer data protection laws by granting individuals new rights regarding automated data processing. It defines "profiling" as automated analysis of personal data to predict factors like health or behavior, requiring businesses to notify consumers and allow opt-outs for decisions affecting housing, employment, health care, or financial services. The bill expands "health data" protections and clarifies exemptions for entities already regulated under federal laws like HIPAA and the Gramm-Leach-Bliley Act. It applies retroactively to January 1, 2025, affecting businesses handling consumer data in Iowa.

Topics ✓ Healthcare ✓ Housing ✓ Technology

Sub-Topics Consumer Data Protection Data Privacy

All technology bills