Iowa Age-Verification Law (HF 864) Takes Effect July 1, 2026

Iowa Governor Kim Reynolds signed House File 864 on June 1, 2026, requiring websites and apps where at least one-third of the content is material harmful to minors to verify that users are adults. The law takes effect July 1, 2026, and limits what verifiers may do with the identification data.

Information last verified on June 4, 2026. This is a developing story; we update it as the record changes.

Jurisdiction scope: This article addresses Iowa House File 864 and the age-verification duties it creates under Iowa law. It does not state the age-verification or data-privacy law of other states. For Iowa privacy rights generally, see Iowa data privacy laws.

What Happened

On June 1, 2026, Governor Kim Reynolds signed House File 864 as part of a group of bills enacted that day. The new law requires the operator of an internet site, an application, or a segment of a site or application, including a portion of a social media platform, to use reasonable age verification before allowing access where a substantial portion of the content is pornographic or otherwise harmful to minors. The statute sets that threshold at one-third or more of the content.

The law is the latest in a national wave. The United States Supreme Court upheld Texas's age-verification statute in Free Speech Coalition v. Paxton in 2025, noting that at least 21 other states had already imposed materially similar requirements. Iowa is now among roughly two dozen states that require adult-content platforms to confirm a visitor is at least 18.

The measure takes effect July 1, 2026. From that date, covered operators must screen users in Iowa and must handle the verification data under specific limits the statute imposes. Enforcement falls to the Iowa Attorney General rather than to private plaintiffs.

What the Law Actually Says

House File 864 creates a new chapter, Iowa Code chapter 554J. It defines reasonable age verification to include three routes: requiring a person to provide digital identification; a method that is commercially reasonable for the operator's business and that relies on transactional data to verify age; or a method the Attorney General approves by rule. The statute is technology-neutral about which of these an operator chooses, so long as it reasonably confirms adult status.

The privacy safeguards sit at the center of the law. A person performing age verification, including a third party a site contracts with, may not retain, sell, lease, or otherwise disseminate the identifying information used to verify age, unless retention or disclosure is required by law or court order. Operators and verifiers must also secure the data they collect. That data-minimization rule is meant to address the obvious risk of an age-verification system: that confirming you are an adult could itself create a sensitive identity record.

Enforcement runs through the Iowa Attorney General, who may seek injunctions and bring actions against violators. A violation is punishable by a civil penalty of up to $1,000 per violation, and a single violator cannot accrue more than $10,000 in civil penalties in one day. The statute does not create a private right of action, so individuals cannot sue operators directly under this chapter. For how Iowa treats personal and biometric data in other contexts, see Iowa data privacy laws and Iowa biometric privacy laws.

Analysis: Why This Matters

The following is analysis from the Recording Law Editorial Team.

Age-verification laws carry a built-in tension, and Iowa's drafting shows the legislature saw it. The goal is to keep minors away from explicit material, but the mechanism asks adults to prove their age, often by presenting a government ID or a digital credential. Every such check is a potential collection point for exactly the kind of sensitive data privacy law usually tries to limit. Iowa's answer is the data-retention ban: verify, then do not keep or share the identifying information. Whether that promise holds depends on how operators and their third-party vendors actually build the systems, which is the part a statute cannot fully control.

The constitutional backdrop matters too. The Supreme Court's 2025 decision in Free Speech Coalition v. Paxton held that requiring age verification is within a state's authority to keep children from sexually explicit content, and that Texas's law triggers and survives intermediate rather than strict scrutiny. We are not predicting whether Iowa's specific provisions will face their own challenge or how any such challenge would resolve. What is clear is the direction: age verification is becoming a standard feature of accessing adult content in much of the country, and the privacy terms attached to it, who collects the ID and how long they keep it, are now part of the debate.

How This Affects You

If you are an adult internet user in Iowa, starting July 1, 2026 you can expect to encounter an age check on covered adult sites and apps. Under the statute, the entity performing the check is not allowed to retain or share the identifying information you submit unless a law or court order requires it. That is the legal protection on paper; in practice, reading a platform's privacy disclosures before submitting an ID is a reasonable step. This is general information, not advice about your circumstances.

If you operate a website or app, the threshold question is whether a substantial portion, one-third or more, of your content is material harmful to minors, because that is what triggers the obligation. General descriptions of the duty are not a substitute for a close read of the statute and, where stakes are high, advice from an Iowa-licensed lawyer. Penalties are enforced by the Attorney General, not through private lawsuits, but they can add up at up to $1,000 per violation.

This is general legal information, not legal advice. It covers Iowa House File 864 and Iowa Code chapter 554J, verified on June 4, 2026. Laws change and this story is developing; consult a lawyer licensed in your jurisdiction about your specific situation.

---

Related articles

• Iowa data privacy laws: ICDPA consumer rights
• Iowa biometric privacy laws
• Iowa recording laws

---

Last updated: 2026-06-04. This is a developing story; details verified as of June 4, 2026.

Frequently Asked Questions

When does Iowa's age-verification law take effect?

House File 864 was signed on June 1, 2026 and takes effect July 1, 2026. From that date, covered sites and apps must use reasonable age verification for Iowa users.

Which sites does Iowa HF 864 cover?

It covers an internet site, application, or segment of one, including parts of social media platforms, where a substantial portion, defined as one-third or more, of the content is material harmful to minors.

What counts as reasonable age verification under the law?

Digital identification, a commercially reasonable method that relies on transactional data to verify age, or a method approved by the Iowa Attorney General by rule.

Can a site keep my ID after verifying my age?

No. The law bars sites and third-party verifiers from retaining, selling, leasing, or sharing the identifying information used for verification unless a law or court order requires it, and it requires them to secure the data collected.

Can I sue a website that violates Iowa HF 864?

The statute does not create a private right of action. The Iowa Attorney General enforces it through injunctions and actions for civil penalties of up to $1,000 per violation, capped at $10,000 in a single day.

Why are so many states passing these laws now?

The U.S. Supreme Court upheld Texas's age-verification law in Free Speech Coalition v. Paxton in 2025; by then, at least 21 other states had imposed materially similar requirements. Iowa is among roughly two dozen states with such a requirement.