Bills › 91st General Assembly
Relating to consumer data protection, and including retroactive applicability provisions
Sponsored by Sen. Kevin Alons (R), Sen. Dennis Guth (R), Sen. Mark S. Lofgren (R), Sen. Sandy Salmon (R), Sen. Cherielynn Westrich (R)
Topics:Technology & privacyData privacy
Same legislation: HF 503
Where it is now
- Done: IntroducedJanuary 28, 2025
- Done: SubcommitteeJanuary 28, 2025
- Stopped: Senate committeeDied when the General Assembly ended
- Next: Passes the Senate
- Next: House committeeFunnel: by March 20, 2026
- Next: Passes the House
- Next: To the Governor
- Next: Signed into law
Died when the session ended The General Assembly adjourned on October 2, 2026. Bills that didn’t pass both chambers died. What’s a funnel?
What’s in it
This bill relates to consumer data protection.1, “child” is defined as any natural person younger than years of age. Under the bill, “child” is defined as any natural person younger than years of age. The bill expands the definition of “health record” to include, in addition to any record containing related health information, any record containing nonhealth information that is related to health information provided in confidence to a health care provider. The bill expands the definition of “sensitive data” to include health data.
Read the full explanation
“Health data” is defined in the bill. Under the bill, except as it relates to health data, the Code chapter shall not apply to the state or any political subdivision of the state; financial institutions, affiliates of financial institutions, or data subject to Tit.; persons who are subject to and comply with regulations promulgated pursuant to Tit. II, subtit. F, of the federal Health Insurance Portability and Accountability Act of 1996, Pub. L. 104-191, and Tit. XIII, subtit. §17921 – 17954; nonprofit organizations; or institutions of higher education. The bill exempts information or data maintained by a public health authority, as defined by HIPAA, from the Code chapter provided the public health authority has received the consumer’s authorization, unless otherwise required by HIPAA. The bill exempts information used only for public health activities and purposes as authorized by HIPAA, provided that the information is de-identified, aggregated, and processed in batches of no less than 100 consumers from the Code chapter. Under the bill, a consumer shall have the right to request to be notified of, or to opt out of, profiling in furtherance of a decision that produces legal or similarly significant effects concerning a consumer. The bill defines “profiling” as any form of automated processing performed on personal data to evaluate, analyze, or predict specific factors related to the economic status, health, personal preferences, interests, reliability, behavior, location, or movements of an individual. Notification to the consumer shall be in plain language and include the type of data subject to profiling, any requirements for a person receiving the consumer’s data to delete or return the data, and the process for a consumer to file a complaint. “Decision that produces legal or similarly significant effects concerning a consumer” is defined in the bill. The bill applies retroactively to January 1, 2025.
From the explanation printed with the bill as introduced, written by the Legislative Services Agency. Amendments adopted later aren’t reflected. Full bill text
Senate subcommittee
Named January 28, 2025. On January 30, 2025 it recommended passage.
Three legislators hear a bill first and recommend what the committee should do; it’s the best time to weigh in. How to take part
Iowa Code it changes
Read from the bill as introduced. Each links to every bill touching that chapter of the Iowa Code. How the Code works
Lobbying
2 for · 17 against · 7 undecided · Who →
Family tree
Where this legislation came from and where it went: earlier tries, the versions it moved through this Assembly, and later bills built on it.
Tried before
91st General Assembly
Earlier and later bills are matched by wording or an identical title; check the text to be sure it’s the same idea.
Tried before
This idea has been filed in an earlier General Assembly. None got through a chamber.
- SF 2272 Relating to consumer data protection, and including effective date provisions90th General Assembly · Renumbered as SF 2321 · nearly identicalCleared committee
Matched by the wording of each bill’s explanation, or an identical title. Companion bills and renumbered versions of this bill aren’t listed; they’re the same bill.