Business Online Data Privacy Laws Across The U.S
Six states require data protection assessments and opt-in consent before processing sensitive personal information SPI. In Iowa and Utah, a controller CANNOT process an Iowa or Utah resident’s SPI without first presenting them with a clear notice and opportunity to opt out
Source: natlawreview.com