Indiana Consumer Data Protection Act
Data last verified: March 23, 2026
- Effective Date
- January 1, 2026
- Enforcement Date
- Not specified in statute
Summary
Indiana Consumer Data Protection Act provides consumers the right to opt out of fully automated profiling for decisions with legal or similarly significant effects, requires data protection assessments, and mandates privacy notice disclosure. Profiling opt-out is limited to decisions made solely through automated processing.
Who It Applies To
Applies to businesses processing data of 100,000+ IN consumers, or 25,000+ consumers if deriving 50%+ of gross revenue from the sale of personal data.
- Min Consumers:
- 100,000
Any threshold triggers applicability
Penalties
- Penalty Range
- $0 – $7,500per violation
- Cure Period
- 30-day cure period
- Private Right of Action
- No private right of action
- Enforcement Body
- Indiana Attorney General
Requirements (4)
- Opt-OutChapter 3, Sec. 1(b)(5)(C); Chapter 2, Sec. 23
This law provides consumers the right to opt out of profiling in furtherance of decisions that produce legal or similarly significant effects, limited to fully automated processing.
- Impact AssessmentChapter 6, Sec. 1(a)-(c)
This law requires controllers to conduct data protection assessments for processing activities involving profiling, targeted advertising, sale of personal data, or sensitive data.
- DisclosureChapter 4, Sec. 3; Chapter 4, Sec. 4
This law requires controllers to provide a clear and accessible privacy notice disclosing data processing practices.
- ConsentChapter 4, Sec. 1(5); Chapter 2, Sec. 28
This law requires controllers to obtain consent before processing sensitive data, or comply with COPPA for children's data.
Claire tracks 31 state and local AI laws across 23 US states. No prescriptive federal AI compliance statutes have been enacted. EU AI Act and sector-specific regulations are not covered.
Check if this law applies to your business