Under the Iowa Consumer Data Protection Act (IACDPA), obtaining valid consent from individuals for processing sensitive personal data requires that consent be freely given, specific, informed, and unambiguous. Businesses must clearly explain the categories of sensitive data being collected and the specific purposes for processing it, using plain language in a prominent and easy-to-understand notice. Consent must be obtained through an affirmative act, such as checking a box or clicking an "I agree" button, and cannot rely on pre-ticked boxes or passive acceptance.

Individuals must also be informed of their right to withdraw consent at any time, with an easy and accessible mechanism provided for doing so. Businesses should document consent details, including the date, method, and purpose, and avoid coercive practices that condition services on unnecessary data processing. If the purpose for processing changes, new consent must be obtained.

The Iowa Consumer Data Protection Act (IACDPA) is enforced exclusively by the Iowa Attorney General. Here’s how enforcement works:
- Notice and Cure Period: If the Attorney General believes a violation has occurred, they must provide the business with a 90-day written notice and an opportunity to cure the violation. If the business corrects the issue within this period, no further action is taken.
- Penalties for Non-Compliance: If the violation is not resolved within the cure period, the Attorney General may pursue enforcement actions, including civil penalties (fines) and court-ordered injunctions to stop non-compliant practices. The exact amount of fines is not specified in the law but is determined based on the nature and severity of the violation.
- No Private Right of Action: Unlike some other state privacy laws, the IACDPA does not allow individuals to sue businesses for violations. Only the Attorney General can enforce the law.
- Investigative Authority: The Attorney General has the authority to investigate potential violations, request documentation, and take legal action to ensure compliance with the IACDPA.

Start by confirming if the law applies to you based on data processing thresholds. Update your privacy policy to clearly explain what data you collect, how it’s used, and how consumers can exercise their rights, such as accessing, deleting, or opting out of data sales. Implement processes to handle these requests within the required timeframes. Obtain explicit consent before collecting sensitive data and ensure robust data security measures are in place. Limit data collection to what’s necessary and establish contracts with third-party processors to ensure compliance. Train employees on IACDPA requirements and regularly audit your practices. By taking these steps, you can avoid penalties and build consumer trust.
‍
Shopify merchants can streamline compliance by leveraging tools like Consentmo, which offers automated solutions for managing cookie consent, generating privacy notices, and processing data subject requests.