Legal or illegal, it depends on who you ask. The DEA contends that CBD is schedule I no matter where it's sourced, same as marijuana. The supplement industry says that CBD containing less than 0.3% THC is legal when derived from hemp. They make this conclusion from language in the 2014 farm bill and this position hasn't really been tested in courts.
To further complicate matters, the 2018 farm bill just passed fully legalizes hemp, yet the DEA still contends that CBD is illegal even when derived from hemp. To complicate matters further, Epidiolex, an anti-seizure medication has been approved and scheduled V by the FDA. The FDA released a statement that Epidiolex is what is schedule 5, and not the CBD it contains.
Lastly you have a myriad of state laws and last I checked CBD was legal under state law in something like 49 states. I think Idaho is the lone holdout on this one. Here in Kansas, CBD is legal under state law only if it contains no THC. I'm not as familiar with Iowa law.