Iowa
AI behavior law: bot and agent disclosure, crawler and training-data rules, automated-agent transactions, and algorithmic decision-making.
Summary
Iowa has enacted one AI-specific statute — SF 2417 (2026), the Conversational AI Services Act — which imposes disclosure and safety duties on operators of public-facing conversational AI services accessible to minors, effective July 1, 2026 with applicability from July 1, 2027. No enacted Iowa law specifically addresses AI crawler conduct, training-data scraping, or broad automated decision-making accountability; Iowa's consumer data-protection framework (Iowa Code ch. 715D, ICDPA, eff. January 1, 2025) provides limited opt-out rights over personal-data sales but does not grant a right to opt out of consequential automated profiling. An election-deepfake disclosure bill (HSB 294) advanced through committee in early 2025 but did not reach the governor's desk in the 91st General Assembly session. At the federal level, FTC Act § 5 unfair-or-deceptive-practices authority applies to Iowa-based private actors that deploy AI in misleading or harmful ways.
Enacted law
Private sector obligations
| Instrument | Category | Effective | Source |
|---|---|---|---|
| Iowa Consumer Data Protection Act (ICDPA) — Iowa Code ch. 715D (Iowa Code ch. 715D (Senate File 262, 90th General Assembly, 2023)) | Automated decision-making | 2025-01-01 | securiti.ai/privacy-laws/us/iowa; akingump.com iowa-data-protection-act-what-businesses-need-to-know |
| Iowa Conversational AI Services Act (SF 2417) (Iowa Acts 2026, ch. ___ (Senate File 2417); to be codified in Iowa Code) | Bot / agent disclosure | 2026-07-01 | legiscan.com/IA/bill/SF2417/2025; govtech.com iowa-bill-restricting-ai-chatbots-heads-to-governors-desk; harrisbeachmurtha.com state-ai-regulation-continues-to-tighten-in-utah-iowa-connecticut-and-colorado |
Drafted & in discussion
| Instrument | Status | Applies to | Category | Source |
|---|---|---|---|---|
| Iowa HSB 294 — AI Election Materials Disclosure Bill (Iowa HSB 294 (91st General Assembly, 2025–2026 session)) | Dead / withdrawn | Both | Bot / agent disclosure | legiscan.com/IA/bill/HSB294/2025; ballotpedia.org/AI_deepfake_policy_in_Iowa |
Automated-access legality
Carried forward from the crawler-law index. Governs whether automated clients may access public websites in this jurisdiction.
| Dimension | Value |
|---|---|
| Authorization test | without permission |
| Public-page carve-out | yes |
| Terms-of-service browsewrap enforceable | notice dependent |
| Terms-of-service clickwrap enforceable | yes |
| Copyright exception model | fair use |
| Text and data mining — commercial status | unsettled |
| Text and data mining — opt-out mechanism | none |
| robots.txt legal weight | non binding notice |
| AI training-specific law | none |
| Privacy regime | Iowa CDPA |
| Trespass to chattels | not recognized |
Last reviewed: 2026-05-23. Confidence: medium. Not legal advice.