Indiana (US)
Full entry AI-checked Checked 5 November 2026
Read this together with United States (federal), which also applies.
| Law | Citation | Status | In force from |
|---|---|---|---|
| Indiana Consumer Data Protection Act | IC 24-15, added by Senate Enrolled Act 5 (2023) | In force | 1 January 2026 |
| Disclosure of Security Breach law | IC 24-4.9 | In force | 1 July 2006 |
| Social media providers law | IC 24-16, added by House Enrolled Act 1408 (2026) | Enacted, not yet in force | 1 January 2027 |
- Indiana Consumer Data Protection Act: Passed in 2023. The Attorney General has enforced it since 1 January 2026.
- Disclosure of Security Breach law: House Enrolled Act 1351 (2022) added the 45-day outer limit for telling people about a breach, from 1 July 2022.
- Social media providers law: Signed on 4 March 2026 as part of an act on education matters. The social media rules take effect on 1 January 2027.
Regulators
Section titled “Regulators”What builders must do
Section titled “What builders must do”Who it covers
Section titled “Who it covers”Applies to businesses that operate in Indiana or target its residents and, in a calendar year, control or process personal data of at least 100,000 Indiana residents, or of 25,000 while earning over 50% of gross revenue from selling personal data. Government, financial institutions and GLBA data, HIPAA covered entities and business associates, nonprofits, higher education and public utilities are exempt. People acting as employees or in a business context aren’t covered.
Sources: in.gov/attorneygeneral/files/Indiana-Consumer-Data-Protection_Consume… · iga.in.gov/pdf-documents/123/2023/senate/bills/SB0005/SB0005.05.ENRH.pdf
Lawful bases
Section titled “Lawful bases”No GDPR-style lawful bases. Give a clear privacy notice and honour rights to confirm processing, get a copy or summary of data the person provided, correct it, delete, port it, and opt out of targeted advertising, sale and profiling. Answer within 45 days (one 45-day extension) and offer an appeal, decided within 60 days. Sensitive data needs opt-in consent. Collect only what’s reasonably necessary for the purposes you disclosed.
Sources: in.gov/attorneygeneral/files/Indiana-Consumer-Data-Protection_Consume…
Consent age for online services
Section titled “Consent age for online services”A child is under 13. A controller that knows it’s processing a child’s data needs a parent’s consent, given as COPPA requires, and parents can use the child’s rights. The privacy act has no teen consent rule, but from 2027 large social media platforms need a parent’s consent before opening an account for anyone under 16 (see children).
Sources: in.gov/attorneygeneral/files/Indiana-Consumer-Data-Protection_Consume… · iga.in.gov/pdf-documents/124/2026/house/bills/HB1408/HB1408.04.ENRS.pdf
Children
Section titled “Children”Under the privacy act, a known child’s data is sensitive and needs COPPA parental consent. From 1 January 2027, IC 24-16 covers social media with content algorithms and addictive features, where 10% or more of under-16 daily users average 2 hours a day, run by groups with $1 billion in worldwide revenue in one of the last three years. Under-16s need verifiable parental consent to open an account, ages must be checked, and their accounts must block messages and search from unlinked users, usage-based content and ads, and addictive features. The Attorney General enforces it as a deceptive act.
Sources: in.gov/attorneygeneral/files/Indiana-Consumer-Data-Protection_Consume… · iga.in.gov/pdf-documents/124/2026/house/bills/HB1408/HB1408.04.ENRS.pdf · in.gov/gov/newsroom/2026-bill-watch
Cookies and similar technologies
Section titled “Cookies and similar technologies”No cookie-consent rule. Controllers that sell personal data or use it for targeted advertising must say so in the privacy notice and let people opt out. Opt-outs are made by request to each controller. The act sets no authorised-agent process; the Attorney General’s guide says only a parent (for a child) or someone with a power of attorney or other legal authority can act for another person. There’s no duty to honour universal opt-out signals such as Global Privacy Control.
Sources: in.gov/attorneygeneral/files/Indiana-Consumer-Data-Protection_Consume… · iga.in.gov/pdf-documents/123/2023/senate/bills/SB0005/SB0005.05.ENRH.pdf
Electronic marketing
Section titled “Electronic marketing”Adds to CAN-SPAM and the TCPA. Telephone solicitors must register with the Attorney General before doing business in Indiana and buy the state Do Not Call list ($750 a year, updated quarterly). Sales calls and texts to listed home, mobile or VoIP numbers are banned, with exemptions such as express requests and, for some sectors, existing customers.
Sources: in.gov/attorneygeneral/consumer-protection-division/id-theft-preventi… · in.gov/attorneygeneral/consumer-protection-division/id-theft-preventi…
Breach notification
Section titled “Breach notification”Tell affected Indiana residents without unreasonable delay, and no later than 45 days after discovery, when their unencrypted personal information (or encrypted data with its key) was or may have been taken and the breach has caused or could cause identity theft, identity deception or fraud. Delay is reasonable only to restore the system, find the breach’s scope, or at the request of the Attorney General or police. Also tell the Attorney General, and the national credit reporting agencies when more than 1,000 people are notified.
Sources: in.gov/attorneygeneral/consumer-protection-division/id-theft-preventi… · iga.in.gov/pdf-documents/122/2022/house/bills/HB1351/HB1351.04.ENRS.pdf · archive.iga.in.gov/2009/bills/HE/HE1121.1.html
Leads, not sources: law.justia.com/codes/indiana/title-24/article-4-9/chapter-3/section-2… · law.justia.com/codes/indiana/title-24/article-4-9/chapter-3/section-2…
Registration and fees
Section titled “Registration and fees”No data protection registration or fee, and no data broker registry. Telephone solicitors register separately (see marketing).
Sources: iga.in.gov/pdf-documents/123/2023/senate/bills/SB0005/SB0005.05.ENRH.pdf · in.gov/attorneygeneral/consumer-protection-division/id-theft-preventi…
Data protection officer
Section titled “Data protection officer”No duty to appoint a data protection officer.
Sources: iga.in.gov/pdf-documents/123/2023/senate/bills/SB0005/SB0005.05.ENRH.pdf
International transfers
Section titled “International transfers”Indiana law doesn’t restrict sending personal data outside the state or the US. Federal rules are in us-federal.
Sources: iga.in.gov/pdf-documents/123/2023/senate/bills/SB0005/SB0005.05.ENRH.pdf
Impact assessments
Section titled “Impact assessments”Do and document a data protection impact assessment for targeted advertising, selling personal data, risky profiling, sensitive data and other high-risk processing. It covers processing activities created or generated after 31 December 2025. The Attorney General can demand it through a civil investigative demand, and it stays confidential.
Sources: iga.in.gov/pdf-documents/123/2023/senate/bills/SB0005/SB0005.05.ENRH.pdf
Leads, not sources: law.justia.com/codes/indiana/title-24/article-15/chapter-6/section-24… · law.justia.com/codes/indiana/title-24/article-15/chapter-6
Automated decisions and AI
Section titled “Automated decisions and AI”People can opt out of profiling, meaning solely automated evaluation or prediction of things like their finances, health, interests, behaviour or movements, used for decisions with legal or similarly significant effects. Profiling with a foreseeable risk of unfair treatment or other substantial harm also needs an impact assessment.
Sources: in.gov/attorneygeneral/files/Indiana-Consumer-Data-Protection_Consume… · iga.in.gov/pdf-documents/123/2023/senate/bills/SB0005/SB0005.05.ENRH.pdf
Leads, not sources: law.justia.com/codes/indiana/title-24/article-15/chapter-3/section-24…
Penalties
Section titled “Penalties”The Attorney General has exclusive enforcement. Before suing it must give 30 days’ written notice; if the business cures and confirms in writing, no action follows. The act sets no end date for this right to cure. Civil penalties up to $7,500 per violation, plus injunctions and investigation costs, including attorney’s fees. No private right of action. Breach-notice failures can cost up to $150,000 per deceptive act, plus the Attorney General’s costs.
Sources: iga.in.gov/laws/2025/ic/titles/24 · iga.in.gov/pdf-documents/123/2023/senate/bills/SB0005/SB0005.05.ENRH.pdf · in.gov/attorneygeneral/consumer-protection-division/id-theft-preventi…
Leads, not sources: law.justia.com/codes/indiana/title-24/article-15/chapter-10/section-2… · law.justia.com/codes/indiana/title-24/article-15/chapter-10/section-2… · law.justia.com/codes/indiana/title-24/article-15/chapter-10
History
Section titled “History”| Date | Change |
|---|---|
| 5 November 2026 | First entry. Checked against official sources with AI assistance, then corrected after an independent AI-assisted review. |
Report a change
Section titled “Report a change”If a law, a date or a figure here has changed, open an issue with the official source. The data lives in laws/full/us-in.yaml.