Iowa Children's Privacy Laws (2026)

Iowa Consumer Data Protection Act (ICDPA): minors' provisions · SF 262

In force: Effective and enforceable today. · Privacy law (minors) · effective 2025-01-01 · binds operators

Ages: Known children under 13 (no separate teen 13-17 band)

Requires: The personal data collected from a known child is treated as 'sensitive data,' and a controller must not process a known child's sensitive data except in accordance with the federal Children's Online Privacy Protection Act (COPPA), 15 U.S.C. 6501 et seq. (i.e., per COPPA's verifiable-parental-consent regime). A known child's parent or legal guardian may exercise the child's consumer rights on the child's behalf. Iowa does not impose a separate heightened opt-in/targeted-advertising regime for teens 13-17; its child-specific duty is the COPPA tie-in for under-13s only.

Entry last reviewed 2026-07-18

Conversational AI service requirements (SF 2417) · SF 2417 (Iowa Acts 2026 ch. 1068); Iowa Code ch. 554J

Enacted, not yet effective: Signed into law; its effective date is still in the future. · AI companion · the act took effect 2026-07-01 by default under Iowa Code § 3.7, but section 7 provides that it applies 2027-07-01, so no operator obligation attaches until then · binds operators

Ages: All users for the general AI disclosure; heightened duties for minor account holders under 18

Requires: Operators of public-facing conversational AI services must tell minor account holders they are interacting with AI, either by a persistent disclaimer or by one at the start of each interaction plus one at least every three hours of continuous interaction. They may not use unpredictable-interval rewards on minors, and must take reasonable measures to block sexual content directed at minors and to stop the service simulating humanity (claims of sentience, emotional dependence, romance, or adult-minor roleplay). Privacy and account controls must be offered to minors and to parents, mandatory for under-13s. For all users, operators must disclose AI status on the same three-hour cadence where a reasonable person would think they were talking to a human, run a suicide and self-harm crisis-referral protocol, and not hold the service out as licensed mental health care. Enforced by the Attorney General, with the greater of actual damages or $1,000 per violation capped at $500,000 per operator; § 554J.6(4) bars any private right of action.

Litigation: None. Not challenged.

Entry last reviewed 2026-07-24