{ "jurisdiction_id": "US-IA", "jurisdiction": "United States – Iowa", "url": "https://dataprotection.gi/jurisdictions/united-states-iowa/", "generator": "render_jid v13-gdpri-1.0.0", "date_modified": "2026-08-06", "schema_version": "gdpri-v2", "counts": { "categories": 10, "claims": 39, "sub_modules": 57, "source_register": 11 }, "categories": [ { "code": "regulator_and_framework", "name": "Regulator & Framework", "traffic_light": "green", "sub_modules": [ "act_and_instruments", "material_scope", "regulator_and_authority", "regulator_registration_and_filing", "territorial_scope" ], "url": "https://dataprotection.gi/jurisdictions/united-states-iowa/#regulator-and-framework-regulator-framework", "traffic_light_rationale": "Core instrument is in force, regulator identity and enforcement pathway are well documented from primary AG sources and secondary legal trackers.", "claims": [ { "statement": "The Iowa Attorney General holds exclusive enforcement authority over the ICDPA through civil investigative demands, and the statute provides no private right of action for consumers.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Confirmed", "source_publisher": "International Association of Privacy Professionals", "source_url": "https://iapp.org/news/a/iowa-becomes-sixth-us-state-to-enact-comprehensive-consumer-privacy-legislation", "source_tier": null, "observed_at": "2026-08-05" }, { "statement": "The Iowa Consumer Data Protection Act (Senate File 262) was signed into law on March 28, 2023 and entered into effect on January 1, 2025.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Confirmed", "source_publisher": "OneTrust DataGuidance", "source_url": "https://www.dataguidance.com/jurisdictions/iowa", "source_tier": null, "observed_at": "2026-08-05" }, { "statement": "The ICDPA applies to entities that control or process personal data of at least 100,000 Iowa consumers, or that derive more than 50% of gross revenue from the sale of personal data while controlling/processing data of at least 25,000 Iowa consumers.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Confirmed", "source_publisher": "International Association of Privacy Professionals", "source_url": "https://iapp.org/news/a/iowa-becomes-sixth-us-state-to-enact-comprehensive-consumer-privacy-legislation", "source_tier": null, "observed_at": "2026-08-05" }, { "statement": "The ICDPA applies to entities that conduct business in Iowa or produce products or services targeted to Iowa consumers, without an independent revenue threshold as a scope trigger.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Confirmed", "source_publisher": "International Association of Privacy Professionals", "source_url": "https://iapp.org/news/a/iowa-becomes-sixth-us-state-to-enact-comprehensive-consumer-privacy-legislation", "source_tier": null, "observed_at": "2026-08-05" }, { "statement": "The ICDPA imposes no controller registration or advance-filing obligation with the Attorney General; the only regulator-facing filing duty identified is post-breach written notice under Iowa's Personal Information Security Breach Protection Act.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Probable", "source_publisher": "State of Iowa Office of the Attorney General", "source_url": "https://www.iowaattorneygeneral.gov/for-consumers/security-breach-notifications", "source_tier": null, "observed_at": "2026-08-05" } ] }, { "code": "lawful_processing_and_special_data", "name": "Lawful Processing & Special Data", "traffic_light": "amber", "sub_modules": [ "consent_thresholds", "lawful_bases", "pseudonymisation_and_anonymisation", "special_categories" ], "url": "https://dataprotection.gi/jurisdictions/united-states-iowa/#lawful-processing-and-special-data-lawful-processing-special-data", "traffic_light_rationale": "Consent and sensitive-data protections are materially weaker than GDPR-analogue peer states (no opt-in for sensitive data, no purpose limitation/data-minimization duty).", "claims": [ { "statement": "Controllers may process personal data that is reasonably necessary and proportionate to the purposes disclosed to the consumer, in lieu of an enumerated closed list of lawful bases analogous to GDPR Article 6.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Confirmed", "source_publisher": "International Association of Privacy Professionals", "source_url": "https://iapp.org/news/a/iowa-becomes-sixth-us-state-to-enact-comprehensive-consumer-privacy-legislation", "source_tier": null, "observed_at": "2026-08-05" }, { "statement": "The ICDPA requires consent to be a clear affirmative act indicating a consumer's freely given, specific, informed and unambiguous agreement to processing.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Confirmed", "source_publisher": "International Association of Privacy Professionals", "source_url": "https://iapp.org/news/a/iowa-becomes-sixth-us-state-to-enact-comprehensive-consumer-privacy-legislation", "source_tier": null, "observed_at": "2026-08-05" }, { "statement": "Unlike Colorado, Connecticut and Virginia, the ICDPA does not require opt-in consent for sensitive-data processing; it instead requires clear notice and an opportunity for the consumer to opt out.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Confirmed", "source_publisher": "International Association of Privacy Professionals", "source_url": "https://iapp.org/news/a/iowa-becomes-sixth-us-state-to-enact-comprehensive-consumer-privacy-legislation", "source_tier": null, "observed_at": "2026-08-05" }, { "statement": "The ICDPA excludes deidentified and aggregate data from the definition of personal data, and consumer opt-out rights do not extend to pseudonymous data, in contrast to Colorado, Connecticut, Virginia and Utah.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Confirmed", "source_publisher": "International Association of Privacy Professionals", "source_url": "https://iapp.org/news/a/iowa-becomes-sixth-us-state-to-enact-comprehensive-consumer-privacy-legislation", "source_tier": null, "observed_at": "2026-08-05" } ] }, { "code": "data_subject_rights", "name": "Data Subject Rights", "traffic_light": "amber", "sub_modules": [ "access_right", "data_portability", "deadlines_and_response_windows", "rectification_and_erasure", "restriction_and_objection" ], "url": "https://dataprotection.gi/jurisdictions/united-states-iowa/#data-subject-rights-data-subject-rights", "traffic_light_rationale": "Materially narrower rights basket than peer comprehensive state laws; longer statutory response windows reduce consumer-facing responsiveness.", "claims": [ { "statement": "The ICDPA provides consumers with the right to access their personal data held by a controller.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Confirmed", "source_publisher": "International Association of Privacy Professionals", "source_url": "https://iapp.org/news/a/iowa-becomes-sixth-us-state-to-enact-comprehensive-consumer-privacy-legislation", "source_tier": null, "observed_at": "2026-08-05" }, { "statement": "The ICDPA provides a right to delete personal data but does not provide a right to rectification/correction of inaccurate personal data, unlike most peer state privacy statutes.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Confirmed", "source_publisher": "OneTrust DataGuidance", "source_url": "https://www.dataguidance.com/jurisdictions/iowa", "source_tier": null, "observed_at": "2026-08-05" }, { "statement": "The ICDPA does not provide a general consumer-rights-section opt-out for targeted advertising or profiling, though controllers engaging in targeted advertising must clearly and conspicuously disclose that activity and how to opt out.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Confirmed", "source_publisher": "International Association of Privacy Professionals", "source_url": "https://iapp.org/news/a/iowa-becomes-sixth-us-state-to-enact-comprehensive-consumer-privacy-legislation", "source_tier": null, "observed_at": "2026-08-05" }, { "statement": "Consumers have a right to data portability under the ICDPA.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Confirmed", "source_publisher": "International Association of Privacy Professionals", "source_url": "https://iapp.org/news/a/iowa-becomes-sixth-us-state-to-enact-comprehensive-consumer-privacy-legislation", "source_tier": null, "observed_at": "2026-08-05" }, { "statement": "Controllers must respond to consumer rights requests within 90 days, with a potential 45-day extension, longer than the standard 45-day (extendable by 45 days) window found in most peer state statutes.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Confirmed", "source_publisher": "International Association of Privacy Professionals", "source_url": "https://iapp.org/news/a/iowa-set-to-finalize-sixth-us-comprehensive-state-privacy-law", "source_tier": null, "observed_at": "2026-08-05" } ] }, { "code": "controller_processor_duties", "name": "Controller/Processor Duties", "traffic_light": "amber", "sub_modules": [ "accountability_and_dpia", "breach_notification", "dpo_requirements", "joint_controller_arrangements", "retention_and_disposal", "ropa_requirements", "security_measures" ], "url": "https://dataprotection.gi/jurisdictions/united-states-iowa/#controller-processor-duties-controller-processor-duties", "traffic_light_rationale": "Core accountability tooling (DPIA, DPO, ROPA) is absent; security and breach-notice duties are present and well documented from primary AG sources.", "claims": [ { "statement": "The ICDPA does not contain provisions requiring privacy/data-protection risk assessments, a notable divergence from Colorado, Connecticut, Virginia and Indiana.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Confirmed", "source_publisher": "OneTrust DataGuidance", "source_url": "https://www.dataguidance.com/resource/ultimate-guide-iowa-consumer-data-protection-act", "source_tier": null, "observed_at": "2026-08-05" }, { "statement": "No statutory requirement for controllers to appoint a data protection officer was identified under the ICDPA.", "regulatory_stage": null, "is_binding": false, "confidence": "Probable", "source_publisher": "OneTrust DataGuidance", "source_url": "https://www.dataguidance.com/resource/ultimate-guide-iowa-consumer-data-protection-act", "source_tier": null, "observed_at": "2026-08-05" }, { "statement": "No formal records-of-processing-activities (ROPA) obligation is imposed on controllers or processors under the ICDPA.", "regulatory_stage": null, "is_binding": false, "confidence": "Probable", "source_publisher": "OneTrust DataGuidance", "source_url": "https://www.dataguidance.com/resource/ultimate-guide-iowa-consumer-data-protection-act", "source_tier": null, "observed_at": "2026-08-05" }, { "statement": "Controllers must have a contract with processors clearly setting forth processing instructions, nature and purpose of processing, data types, processing duration, and the rights and duties of both parties, including retention, deletion, access and subcontractor accountability.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Confirmed", "source_publisher": "International Association of Privacy Professionals", "source_url": "https://iapp.org/news/a/iowa-becomes-sixth-us-state-to-enact-comprehensive-consumer-privacy-legislation", "source_tier": null, "observed_at": "2026-08-05" }, { "statement": "Controllers must implement reasonable administrative, technical and physical data-security practices appropriate to the volume and nature of personal data, to protect confidentiality, integrity and availability.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Confirmed", "source_publisher": "International Association of Privacy Professionals", "source_url": "https://iapp.org/news/a/iowa-becomes-sixth-us-state-to-enact-comprehensive-consumer-privacy-legislation", "source_tier": null, "observed_at": "2026-08-05" }, { "statement": "Under the Personal Information Security Breach Protection Act (Iowa Code ch. 715C), any breach affecting 500 or more Iowa residents must be reported in writing to the Attorney General's Consumer Protection Division within five business days of notifying affected individuals.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Confirmed", "source_publisher": "State of Iowa Office of the Attorney General", "source_url": "https://www.iowaattorneygeneral.gov/for-consumers/security-breach-notifications", "source_tier": null, "observed_at": "2026-08-05" }, { "statement": "The ICDPA does not impose a data-minimization or retention-limitation obligation on controllers, consistent with its omission of purpose-limitation duties found in peer state statutes.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Probable", "source_publisher": "International Association of Privacy Professionals", "source_url": "https://iapp.org/news/a/iowa-set-to-finalize-sixth-us-comprehensive-state-privacy-law", "source_tier": null, "observed_at": "2026-08-05" } ] }, { "code": "cross_border_and_adequacy", "name": "Cross-Border & Adequacy", "traffic_light": "red", "sub_modules": [ "adequacy_granted", "adequacy_received", "data_localisation", "sccs_and_bcrs", "transfer_impact_assessment", "transfer_mechanisms" ], "url": "https://dataprotection.gi/jurisdictions/united-states-iowa/#cross-border-and-adequacy-cross-border-adequacy", "traffic_light_rationale": "No cross-border transfer framework exists in the operative Iowa statute; absence confirmed across all reviewed primary and secondary sources.", "claims": [ { "statement": "The ICDPA contains no cross-border data-transfer mechanism, adequacy determination, SCC/BCR framework, or data-localisation mandate; such transfer-restriction regimes are a feature of omnibus regimes such as the GDPR and are not present in current Iowa state law.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Confirmed", "source_publisher": "OneTrust DataGuidance", "source_url": "https://www.dataguidance.com/jurisdictions/iowa", "source_tier": null, "observed_at": "2026-08-05" } ] }, { "code": "sectoral_watch", "name": "Sectoral Watch", "traffic_light": "amber", "sub_modules": [ "credit_and_scoring", "education", "employment_data", "financial_sector_overlay", "health_sector_overlay", "insurance", "telecoms_and_eprivacy" ], "url": "https://dataprotection.gi/jurisdictions/united-states-iowa/#sectoral-watch-sectoral-watch", "traffic_light_rationale": "Exemption structure well documented; several declared sub-modules (telecoms/eprivacy, credit_and_scoring, insurance) carry no Iowa-specific findings.", "claims": [ { "statement": "The ICDPA exempts financial institutions and their affiliates, and entities and data subject to the Gramm-Leach-Bliley Act, from its scope.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Confirmed", "source_publisher": "International Association of Privacy Professionals", "source_url": "https://iapp.org/news/a/iowa-becomes-sixth-us-state-to-enact-comprehensive-consumer-privacy-legislation", "source_tier": null, "observed_at": "2026-08-05" }, { "statement": "The ICDPA exempts entities and personal data covered by HIPAA and the Health Information Technology for Economic and Clinical Health Act, as well as protected health records, from its scope.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Confirmed", "source_publisher": "International Association of Privacy Professionals", "source_url": "https://iapp.org/news/a/iowa-becomes-sixth-us-state-to-enact-comprehensive-consumer-privacy-legislation", "source_tier": null, "observed_at": "2026-08-05" }, { "statement": "The ICDPA exempts personal data processed or maintained in the employment context from its scope, leaving Iowa employees without ICDPA-based rights over employment records.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Confirmed", "source_publisher": "International Association of Privacy Professionals", "source_url": "https://iapp.org/news/a/iowa-becomes-sixth-us-state-to-enact-comprehensive-consumer-privacy-legislation", "source_tier": null, "observed_at": "2026-08-05" }, { "statement": "The ICDPA exempts personal data covered by the Family Educational Rights and Privacy Act (FERPA) from its scope.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Confirmed", "source_publisher": "International Association of Privacy Professionals", "source_url": "https://iapp.org/news/a/iowa-becomes-sixth-us-state-to-enact-comprehensive-consumer-privacy-legislation", "source_tier": null, "observed_at": "2026-08-05" } ] }, { "code": "adtech_and_commercial_privacy", "name": "AdTech & Commercial Privacy", "traffic_light": "amber", "sub_modules": [ "clean_rooms_and_dcr", "cookies_and_trackers", "cross_context_advertising", "dark_patterns", "direct_marketing", "opt_out_signals" ], "url": "https://dataprotection.gi/jurisdictions/united-states-iowa/#adtech-and-commercial-privacy-adtech-commercial-privacy", "traffic_light_rationale": "Partial adtech coverage (disclosure + sale opt-out) with explicit gaps on universal signals, dark patterns and clean rooms.", "claims": [ { "statement": "Controllers engaging in targeted advertising must clearly and conspicuously disclose that activity and the manner in which a consumer may exercise the right to opt out, and consumers may opt out of the sale of personal data exchanged for monetary consideration.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Confirmed", "source_publisher": "International Association of Privacy Professionals", "source_url": "https://iapp.org/news/a/iowa-becomes-sixth-us-state-to-enact-comprehensive-consumer-privacy-legislation", "source_tier": null, "observed_at": "2026-08-05" }, { "statement": "The ICDPA, like Virginia's law, does not require controllers to recognize universal opt-out mechanisms such as the Global Privacy Control.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Confirmed", "source_publisher": "International Association of Privacy Professionals", "source_url": "https://iapp.org/news/a/iowa-becomes-sixth-us-state-to-enact-comprehensive-consumer-privacy-legislation", "source_tier": null, "observed_at": "2026-08-05" } ] }, { "code": "algorithmic_biometric_and_surveillance_governance", "name": "Algorithmic, Biometric & Surveillance Governance", "traffic_light": "red", "sub_modules": [ "ai_risk_assessments", "automated_decision_making_transparency", "biometric_regime", "genetic_data", "profiling_restrictions", "state_surveillance_carveouts" ], "url": "https://dataprotection.gi/jurisdictions/united-states-iowa/#algorithmic-biometric-and-surveillance-governance-algorithmic-biometric-surveill", "traffic_light_rationale": "No ADM transparency right, no dedicated AI-risk-assessment law, no biometric-specific statute; coverage is indirect via the general sensitive-data opt-out.", "claims": [ { "statement": "The ICDPA does not provide consumers a right not to be subject to solely automated decision-making, a right present in most other comprehensive state privacy statutes.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Confirmed", "source_publisher": "OneTrust DataGuidance", "source_url": "https://www.dataguidance.com/jurisdictions/iowa", "source_tier": null, "observed_at": "2026-08-05" }, { "statement": "Iowa's sensitive-data definition, mirrored in Indiana's subsequently enacted statute, includes genetic and biometric data processed for the purpose of identifying a specific individual, as well as precise geolocation data within a defined radius.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Probable", "source_publisher": "International Association of Privacy Professionals", "source_url": "https://iapp.org/news/a/indiana-governor-signs-a-comprehensive-privacy-act-into-law", "source_tier": null, "observed_at": "2026-08-05" } ] }, { "code": "children_and_vulnerable_groups", "name": "Children & Vulnerable Groups", "traffic_light": "amber", "sub_modules": [ "age_verification", "dependent_adults", "education_settings", "minor_profiling_bans", "parental_consent" ], "url": "https://dataprotection.gi/jurisdictions/united-states-iowa/#children-and-vulnerable-groups-children-vulnerable-groups", "traffic_light_rationale": "Core ICDPA sensitive-data treatment of children's data is confirmed; HF 712's precise enactment/effective status remains unverified from primary sources in this pass.", "claims": [ { "statement": "Iowa House File 712 is reported to mandate parental consent for social-media platforms' collection of personal data from minors under age 18, with penalties for noncompliance.", "regulatory_stage": "proposed", "is_binding": true, "confidence": "Uncertain", "source_publisher": "OneTrust DataGuidance", "source_url": "https://www.dataguidance.com/jurisdictions/iowa", "source_tier": null, "observed_at": "2026-08-05" }, { "statement": "Personal data collected from a known child falls within the sensitive-data category under Iowa's comprehensive privacy framework, triggering the general notice-and-opt-out duties applicable to sensitive data.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Probable", "source_publisher": "International Association of Privacy Professionals", "source_url": "https://iapp.org/news/a/indiana-governor-signs-a-comprehensive-privacy-act-into-law", "source_tier": null, "observed_at": "2026-08-05" } ] }, { "code": "enforcement_and_redress", "name": "Enforcement & Redress", "traffic_light": "amber", "sub_modules": [ "collective_redress_and_class_actions", "enforcement_activity_index", "private_right_of_action", "recent_developments_180d", "regulator_funding_and_capacity", "regulator_powers_and_penalties" ], "url": "https://dataprotection.gi/jurisdictions/united-states-iowa/#enforcement-and-redress-enforcement-redress", "traffic_light_rationale": "Enforcement powers and penalty structure for the ICDPA itself are narrow (capped fines, mandatory cure, no private right of action); the AG's broader consumer-protection enforcement record is more active but is grounded in adjacent statutes rather than the ICDPA.", "claims": [ { "statement": "The Attorney General must provide violating parties written notice of ICDPA violations and a 90-day non-sunsetting cure period before initiating civil proceedings; violators found in breach are subject to civil penalties of up to $7,500 per violation, paid into the consumer education and litigation fund.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Confirmed", "source_publisher": "International Association of Privacy Professionals", "source_url": "https://iapp.org/news/a/iowa-becomes-sixth-us-state-to-enact-comprehensive-consumer-privacy-legislation", "source_tier": null, "observed_at": "2026-08-05" }, { "statement": "The ICDPA does not provide consumers with a private right of action; enforcement runs exclusively through the Iowa Attorney General.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Confirmed", "source_publisher": "OneTrust DataGuidance", "source_url": "https://www.dataguidance.com/jurisdictions/iowa", "source_tier": null, "observed_at": "2026-08-05" }, { "statement": "In January 2024, the Iowa Attorney General filed suit against TikTok and related ByteDance entities alleging deceptive age-rating practices and unlawful features affecting minors, litigated under the Iowa Consumer Fraud Act rather than the ICDPA.", "regulatory_stage": null, "is_binding": false, "confidence": "Confirmed", "source_publisher": "State of Iowa Office of the Attorney General / Iowa District Court for Polk County", "source_url": "https://www.iowaattorneygeneral.gov/media/cms/AsFiled_TikTok_Complaint_AD07A587C6BC2.pdf", "source_tier": null, "observed_at": "2026-08-05" }, { "statement": "The Iowa Attorney General sued Change Healthcare under the Iowa Consumer Fraud Act and the Personal Information Security Breach Protection Act (Iowa Code ch. 715C) over a data breach affecting approximately 2.2 million Iowans, seeking remedies including civil penalties of up to $40,000 per violation under the Consumer Fraud Act.", "regulatory_stage": null, "is_binding": false, "confidence": "Confirmed", "source_publisher": "State of Iowa Office of the Attorney General / Iowa District Court for Polk County", "source_url": "https://www.iowaattorneygeneral.gov/media/cms/3_DC1828BB91C4E.pdf", "source_tier": null, "observed_at": "2026-08-05" }, { "statement": "In early August 2026, Iowa Attorney General Brenna Bird led a multistate coalition demanding that OpenAI preserve records and provide transparency following a reported AI-related data breach, citing potential violations of state consumer-protection and data-privacy statutes.", "regulatory_stage": null, "is_binding": false, "confidence": "Confirmed", "source_publisher": "State of Iowa Office of the Attorney General", "source_url": "https://www.iowaattorneygeneral.gov/newsroom/attorney-general-brenna-bird-leads-coalition-demanding-transparency-from-openai-after-ai-breach-and", "source_tier": null, "observed_at": "2026-08-05" }, { "statement": "Iowa Senate Bill 143, introduced in a recent legislative session, proposes amendments to the ICDPA that would redefine key terms and expand certain consumer rights; enactment status remains pending as of this research pass.", "regulatory_stage": "proposed", "is_binding": true, "confidence": "Uncertain", "source_publisher": "OneTrust DataGuidance", "source_url": "https://www.dataguidance.com/jurisdictions/iowa", "source_tier": null, "observed_at": "2026-08-05" }, { "statement": "No collective-redress or class-action mechanism specific to ICDPA violations exists; redress is channeled exclusively through Attorney General civil enforcement.", "regulatory_stage": "in_force", "is_binding": true, "confidence": "Probable", "source_publisher": "International Association of Privacy Professionals", "source_url": "https://iapp.org/news/a/iowa-becomes-sixth-us-state-to-enact-comprehensive-consumer-privacy-legislation", "source_tier": null, "observed_at": "2026-08-05" } ] } ] }