How to Opt Out of Data Brokers in Iowa

Iowa's Consumer Data Protection Act took effect on January 1, 2025, giving residents new rights to opt out of data sales and request deletion of their personal information. While the ICDPA is one of the most business-friendly privacy laws in the country, it still provides actionable tools you can use to remove your data from brokers. Here is a complete guide to exercising your rights and taking control of your personal information in Iowa.

Understanding the Iowa Consumer Data Protection Act (ICDPA)

The ICDPA was signed into law by Governor Kim Reynolds on March 28, 2023, and became effective on January 1, 2025. It applies to businesses that conduct business in Iowa or produce products and services targeted to Iowa residents and meet at least one of these thresholds:

• Control or process the personal data of 100,000 or more Iowa consumers during a calendar year, or
• Control or process the personal data of at least 25,000 Iowa consumers and derive more than 50% of gross revenue from the sale of personal data

Most major data brokers and people search sites meet these thresholds, which means they are required to comply with your opt-out and deletion requests under this law.

Your Rights Under the ICDPA

As an Iowa resident, you have the following rights over your personal data:

• Right to access: Confirm whether a business is processing your personal data and obtain access to that data
• Right to delete: Request deletion of personal data that the business has collected from or about you
• Right to data portability: Receive a copy of your personal data in a portable, readily usable format
• Right to opt out of data sales: Direct a business to stop selling your personal data for monetary consideration
• Right to opt out of targeted advertising: Stop businesses from using your data for ads based on your activity across different websites and platforms

Businesses must respond to your requests within 90 days. This is the longest response window of any state privacy law in the country, so patience is required.

Step 1: Find Out Where Your Data Is

Before you can opt out or request deletion, you need to identify which data brokers hold your information. Follow these steps:

1. Search your full name on Google, Bing, and DuckDuckGo. Include your city or zip code to narrow results to your specific profile.
2. Check major people search sites directly: TruePeopleSearch, Spokeo, WhitePages, BeenVerified, PeopleFinders, Radaris, Intelius, FastPeopleSearch, Nuwber, and MyLife.
3. Search your phone number and email address separately. Data brokers often create additional profiles indexed by contact information.
4. Check property record aggregators if you own property in Iowa. County assessor records are a common data source for brokers.
5. Search business record sites if you are listed as an officer or registered agent of any Iowa business entity.

Make a list of every site where your information appears. The typical Iowa resident can expect to find their data on 30 or more broker sites.

Step 2: Submit Opt-Out and Deletion Requests

For each data broker on your list, follow their removal process:

1. Look for a "Do Not Sell My Personal Information," "Privacy," or "Opt Out" link in the site footer.
2. Fill out the opt-out or data deletion request form. You will usually need to provide your name, address, date of birth, and email to locate your record.
3. Complete any verification step such as an email confirmation link or identity verification upload.
4. Save all confirmation emails and take dated screenshots for your records.
5. Check back in 30 to 45 days to verify removal, keeping in mind that businesses have up to 90 days to respond under Iowa law.

Step 3: Formally Invoke Your ICDPA Rights

If a data broker does not provide a clear opt-out process or ignores your initial request, you can send a formal written request citing the ICDPA. This puts the company on notice that you are exercising specific legal rights under Iowa law.

Step 4: Deal With Iowa Public Records

Data brokers build their profiles from public records as much as from commercial data purchases. In Iowa, the primary public record sources include:

• Property tax records: County assessor offices in Iowa publish property ownership, assessed values, and addresses online. All 99 Iowa counties maintain searchable databases.
• Voter registration: Iowa voter files include your name, address, date of birth, and party affiliation. These records are available to political parties, campaigns, and other authorized entities.
• Court records: Iowa's judicial branch publishes court case information through the Iowa Courts Online portal at iowacourts.gov.
• Vehicle registration: Iowa DOT records are restricted under the Driver's Privacy Protection Act but may still be accessed by certain authorized parties.
• Professional licenses: If you hold a state-issued professional license, your name and sometimes address are publicly searchable.

You cannot remove yourself from public records, but you can consistently remove the aggregated profiles that data brokers construct from these sources. This requires ongoing vigilance.

Step 5: File a Complaint If Needed

If a business fails to respond to your ICDPA request within 90 days or denies your request without valid justification, you can file a complaint with the Iowa Attorney General's Consumer Protection Division at iowaattorneygeneral.gov.

The Iowa Attorney General has exclusive enforcement authority over the ICDPA. There is no private right of action, meaning you cannot sue businesses directly for violations. However, the AG can pursue civil penalties of up to $7,500 per violation, along with injunctive relief, attorney's fees, and investigative costs.

The 90-Day Cure Period

Be aware that the ICDPA includes the longest cure period of any state privacy law. When the AG identifies a potential violation, the business has 90 full days to fix the problem before any enforcement action is taken. Unlike other states where cure periods have sunset clauses, Iowa's 90-day window is permanent. This means enforcement can be slow, which makes proactive self-removal efforts even more important.

Let PrivacyOn Automate the Process

Manually opting out of dozens of data brokers every few months is exhausting, and Iowa's 90-day response window makes the process even slower than in other states. PrivacyOn automates the entire process for Iowa residents. We submit removal requests to more than 100 data broker and people search sites on your behalf, monitor for re-listings continuously, and handle re-submissions automatically whenever your information reappears.

PrivacyOn also provides dark web monitoring to alert you if your personal data surfaces in data breaches or leaked databases — threats that fall entirely outside the scope of the ICDPA. Family plans cover up to 5 household members, so you can protect your entire family. Plans start at $8.33 per month.

Iowa Privacy Resources

• Iowa Attorney General Consumer Protection Division: File complaints at iowaattorneygeneral.gov
• Iowa Consumer Data Protection Act: Full text available at legis.iowa.gov (Senate File 262)
• IdentityTheft.gov: Federal resource for identity theft reporting and recovery
• AnnualCreditReport.com: Free credit reports from all three bureaus

Start Protecting Your Data Today

The ICDPA may not be the strongest privacy law in the country, but it gives Iowa residents real, enforceable rights to opt out of data sales and request deletion of their personal information. The key is to actually use those rights. Whether you handle the opt-out process yourself or let PrivacyOn manage it for you, the most important step is the first one — finding out where your data is and starting the removal process now.