Skip to content

Session Expired

Your session has expired. Please sign in again to continue where you left off.

Sign In Again

IA SSB3085: A bill for an act relating to private entity requirements concerning biometric data, and providing civil penalties.

In Committee Iowa · 2025–2026 session

Last verified Oct 13, 2026 · official bill text

SSB3085 · where it stands

1 of 5 steps complete
  1. Introduced In committee
  2. Passed first chamber
  3. Passed both chambers
  4. Enacted
  5. Effective
What do these statuses mean?
Introduced
Filed in the legislature; may be waiting for a committee hearing.
Passed a chamber
Approved by one or both chambers; awaiting further action.
Enacted
Signed into law, or became law without a signature or over a veto.
Effective date
The date the law says it takes effect. Once it has passed, the page shows "Effective" and the date. A court order can still block a law; if we know of one, the summary says so.
Dead / vetoed
Vetoed, failed, or the session ended without action.

In one paragraph

Iowa's SSB 3085 would create Code chapter 554J requiring private entities holding biometric data (such as facial geometry, fingerprints or voice) to have a public retention policy, give written notice before collecting, never sell it, and protect it. The Department of Inspections, Appeals, and Licensing would enforce with civil penalties of $1,000, $5,000 and $10,000; no private right of action. Senate subcommittee recommended passage February 4, 2026.

Plain-English summary, written with AI assistance. The official text controls.

What it means for business

None yet: the bill has not been enacted. If enacted, private entities collecting biometric data such as face or voice prints would need retention policies, written notice and security, with state-enforced penalties up to $10,000.

Key provisions

  1. Biometric identifiers include retina, iris, fingerprint, voice, hand or facial geometry that is unique and permanent; photographs and health information are excluded.
  2. A private entity in possession of biometric data must adopt a public written retention schedule and may not retain data more than three years after the subject's last interaction, or until the purpose is accomplished, whichever is longer.
  3. Before obtaining biometric data the entity must notify the subject in writing of the collection, purposes and retention period; it may not sell, lease, trade or otherwise profit from the data.
  4. Data must be stored, transmitted and protected with reasonable methods at least as protective as for passwords.
  5. Exemption: employers using an employee's biometric data solely within the scope of employment.
  6. The Department of Inspections, Appeals, and Licensing enforces: 30-day cure for a first violation, then $1,000 first, $5,000 second and $10,000 third or later violation; the chapter creates no private right of action.
  7. No effective date is stated. Status: subcommittee recommended passage February 4, 2026.

Latest legislative action

Feb 4, 2026. Subcommittee recommends passage.

Sponsors

NameRole
Sponsor

Topics and industries

Related topics

AI PrivacyFacial Recognition

Affected industries

TechnologyConsumer ProtectionEmployment

This page is general information, not legal advice. Summaries are AI-assisted and may contain errors; read the statute for the controlling text and talk to a lawyer about your situation. Full disclaimer · Report an error

Related AI laws in Iowa

All Iowa bills →
HF406 A bill for an act relating to restrictions on the use of artificial intelligence SF2278 A bill for an act prohibiting personalized algorithmic pricing and surveillance HF2204 A bill for an act relating to the requirements for chatbot deployers, including SF302 An Act relating to motor vehicles operated by an automated driving system, and m HF304 An Act relating to personal delivery devices, providing penalties, and making pe SF2243 An Act relating to sexual exploitation of a minor by the creation, adaptation, o

Same topic in other states

Maine LD1585 An Act To Increase Privacy and Security by Regulating the Use of Facial Surveill Tennessee HB1316 AN ACT to amend Tennessee Code Annotated, Section 2-7-112 and Title 55, Chapter Texas HB149 Relating to regulation of the use of artificial intelligence systems in this sta New York A6787 Directs the commissioner of education to conduct a study on the use of biometric Connecticut SB00004 An Act Concerning Consumer Privacy And Protection. New Jersey S1463 Prohibits collection of biometric identifier information by public or private en