Indiana
Indiana Consumer Data Protection Act
Indiana’s consumer privacy law. It gives Indiana residents rights over their personal data and sets rules for businesses that meet its size limits.
- Status
- In effect since January 1, 2026
- Citation
- Ind. Code § 24-15
- Official text
- Read the law(opens in a new tab)
Who it covers
Businesses that handle data of 100,000+ Indiana residents a year, or 25,000+ if they earn revenue from selling data.
What it asks of your website
- A privacy notice explaining what you collect, why, who you share it with and how people use their rights.
- Let people access, delete and correct their data, and opt out of targeted ads and the sale of their data.
- Get opt-in consent before using sensitive data (health, precise location, children’s data and more).
- Offer an appeal when you turn down a privacy request.
Who has to comply
The Indiana Consumer Data Protection Act took effect on January 1, 2026. It applies to businesses that operate in Indiana or target Indiana residents and handle the personal data of 100,000 or more Indiana consumers, or 25,000 or more while getting over 50% of gross revenue from selling personal data.
Nonprofits are exempt, as are government bodies, colleges, utilities, Gramm-Leach-Bliley financial institutions and HIPAA covered entities.
Visitors’ rights and your deadlines
- Rights to confirm and access, correct, delete, get a portable copy (or a summary), and opt out of targeted advertising, sale and significant profiling.
- Respond within 45 days, extendable once by 45 more with notice. Free once a year.
- Appeals: answer within 60 days; a denial must say how to contact the Attorney General.
Opt-out signals and sensitive data
Indiana doesn’t require honoring universal opt-out signals such as Global Privacy Control.
Sensitive data needs consent, and data of a known child under 13 counts as sensitive and must be handled under COPPA. Data protection assessments are required for targeted advertising, sale, profiling and sensitive data, for processing that started after December 31, 2025.
Your privacy notice
Give a reasonably accessible, clear and meaningful privacy notice: the categories of data you process and why, how to use and appeal rights, and the categories of data and third parties you share with. If you sell data or do targeted advertising, disclose it clearly and conspicuously, with how to opt out.
Enforcement
The Attorney General has exclusive authority; there’s no private right of action. Before acting, the Attorney General must give 30 days’ written notice to cure, with no end date in the statute. Penalties are up to $7,500 per violation, plus investigation costs and attorney fees.
Where GoConsent helps
Privacy Policy builder
A Privacy Policy with a Notice at Collection, written from your settings and your latest scan, drafted to cover the points privacy laws describe. Review it with your lawyer.
Opt-outs and requests
Your Privacy Choices with a Marketing switch, “Opt out using your email”, and a Requests tab with deadlines and reminders.
Copy and delete requests (Pro)
Visitors ask for a copy of their information or for it to be deleted from Your Privacy Choices, with a 45-day deadline, a checklist and reminders.
Children’s Privacy Policy (Pro)
A children’s privacy notice page for sites that may collect information from children under 13.
A plain-English summary, last reviewed October 26, 2026. It isn’t legal advice, and some duties depend on how your business handles data, such as security programs and answering access requests. Read the official text and talk to a lawyer about your situation.
FAQ
Questions, answered
When did Indiana’s privacy law take effect?
January 1, 2026.
Do I have to honor Global Privacy Control in Indiana?
The law doesn’t require it.
Is there a cure period in Indiana?
Yes, 30 days after written notice from the Attorney General, with no end date in the statute.
Check your site against this law
GoConsent scans your site, tells you which laws likely apply and what to fix. Free, with no visit limits.
