IN SB0005: Consumer data protection.

In one paragraph

Indiana's consumer data protection law, effective January 1, 2026, gives Indiana consumers rights to confirm and access their personal data, delete it, correct inaccuracies in data they provided, and get a copy or summary of data they provided, and to opt out of targeted advertising, the sale of their data, and profiling used for decisions with legal or similarly significant effects. It applies to businesses that control or process personal data of at least 100,000 Indiana consumers a year, or 25,000 if more than half their revenue comes from selling personal data. The attorney general enforces it.

Plain-English summary, written with AI assistance. The official text controls.

What it means for business

If you process personal data of 100,000 or more Indiana residents, you must honor opt-outs from profiling and targeted ads and assess risky profiling from January 1, 2026.

Key provisions

1. 1Applies to businesses handling personal data of at least 100,000 Indiana consumers a year, or at least 25,000 while earning over 50% of gross revenue from selling personal data (IC 24-15-1-1)
2. 2Consumers can opt out of targeted advertising, the sale of personal data, and profiling in furtherance of decisions with legal or similarly significant effects, such as lending, housing, insurance, education, employment and health care (IC 24-15-3-1)
3. 3'Profiling' means solely automated processing of personal data to evaluate or predict aspects of a person such as economic situation, health, preferences, behavior or location (IC 24-15-2-23)
4. 4Controllers must conduct and document data protection impact assessments for profiling that presents a reasonably foreseeable risk of unfair or deceptive treatment of, or unlawful disparate impact on, consumers, or other substantial injury; applies to processing activities created after December 31, 2025 (IC 24-15-6)
5. 5Exclusive attorney general enforcement with a 30-day cure period and civil penalties up to $7,500 per violation; no private right of action (IC 24-15-10)

Latest legislative action

May 1, 2023. Public Law 94 (Signed by the Governor)