Iowa Governor Kim Reynolds signed a privacy bill Tuesday
that empowers consumers to wield some control over their data but, unlike other state privacy bills, doesn't appear to give state residents the right to opt out of ad targeting based on pseudonymous
data.
Reynolds stated Tuesday that the law, slated to take effect in 2025, will give
consumers “a reasonable level of transparency and control over their personal data.”
The business group Technology Association of Iowa, which supported the measure, praised it as “a significant step forward” for the state.
The
organization -- whose board includes employees of Google and Salesforce -- added that it would prefer a national privacy law,
but is still “proud” to see the bill enacted.
Iowa's Senate File 262 explicitly enables
state residents to learn what personal information about them has been collected, to have that data deleted, and to prevent the “sale” of that data -- with sale narrowly defined as a
monetary exchange.
The Iowa measure also contains a provision that could be interpreted as requiring companies to allow consumers to opt out of ad targeting based on non-pseudonymous data --
though it's not clear whether that provision is consistent with other parts of the law.
But the law, at least as currently written, doesn't give consumers rights to control the use of
pseudonymous data -- including data collected across sites and stored in cookies -- provided that such data is kept separately from information that could be used to identify people.
In
that regard, the Iowa law differs from recently enacted privacy laws in five other states -- California, Connecticut, Colorado, Virginia and Utah -- which require companies to allow consumers to
exercise control over ad targeting based on pseudonymous data collected across sites.
Keir Lamont at the think tank Future of Privacy Forum, tells MediaPost it's uncertain whether the
provision regarding opting out of non-pseudonymous targeted advertising reflects a drafting error. He adds that the law isn't scheduled to come into effect for nearly two years, which gives the state
legislature time to make revisions.