Iowa · verified official-source register

Iowa Privacy Enforcement Cases

3 approved, official-source case records from the 50-state register. Dates, amounts, legal context and disposition qualifications are supported by the cited evidence.

3 primary case-source links · 3 unique primary source URLs

Last editorial review (targeted corrections): · Last link check (automated availability check):

Actual case links

Iowa case register

Each record cites an official Attorney General or state-agency source. Shared multistate amounts should not be summed as unique state penalties. Additional verification sources are identified when an amount has been reconciled.

Verified case 1 of 3

23andMe

Date
July 14, 2026
Amount
$18 million settlement; Iowa will receive $429,767
Legal basis
Iowa’s Consumer Fraud Act; Iowa Consumer Data Protection Act

Why the action was brought

23andMe’s 2023 data breach compromised the genetic data of 6.9 million customers worldwide, including genetic ancestry information in some cases, with subsets published for sale on the dark web. The investigation alleged unreasonable security practices, including inadequate credential-stuffing safeguards, rate limiting, monitoring, unusual-login investigation, vulnerability remediation, and design-feature testing.

View Official Case Source ↗ (opens in a new tab)

Verified case 2 of 3

Marriott International

Date
October 9, 2024
Amount
$52 million to the States; Iowa will receive $594,105
Legal basis
state consumer protection laws, personal-information protection laws, and breach-notification laws

Why the action was brought

Marriott’s guest reservation database was accessed by intruders for years, exposing 131.5 million guest records, including contact information, gender, dates of birth, preferred guest information, reservation information, hotel-stay preferences, and some passport numbers and payment-card information. Attorneys general alleged Marriott violated state consumer-protection, personal-information-protection, and breach-notification laws by failing to implement proper security measures.

View Official Case Source ↗ (opens in a new tab)

Verified case 3 of 3

Anthem, Inc.

Date
September 29, 2020
Amount
$39,500,000.00 total; $199,694.24 to the Iowa Attorney General
Legal basis
Iowa Consumer Fraud Act, Iowa Code § 714.16; Iowa Personal Information Security Breach Protection Act, Iowa Code § 715C; federal Health Insurance Portability and Accountability Act of 1996 (HIPAA), Public Law 104-191, and implementing regulations, 45 C.F.R. §§ 160, 162, and 164

Why the action was brought

A criminal cyber-attacker gained unauthorized access to Anthem’s network and internally hosted enterprise data warehouse, exposing unencrypted personal and protected health information of approximately 78,800,000 individuals. The accessed data included names, birth dates, Social Security numbers, healthcare identification numbers, addresses, email addresses, phone numbers, employment information, and income data.

View Official Case Source ↗ (opens in a new tab)

This register contains approved, official-source privacy, data-breach and data-security enforcement records. Read any case-specific court-approval qualification; inclusion does not confirm payment or final judgment. Shared multistate amounts should not be summed as unique state penalties.

Educational information, not legal advice.

Back to IowaAll states

Original case-library snapshot: August 23, 2026. Original state-law research cutoff: August 25, 2026. Monetary-library update: September 16, 2026, not a new full 50-state research cutoff. Targeted Indiana and New Hampshire law review: October 19, 2026 only. Source inclusion does not independently confirm final court entry or payment.