Indiana Consumer Data Privacy Law: Thresholds, Consumer Rights & Deadlines

What Indiana’s consumer data privacy law requires, maintained by Stauss PLLC. Last reviewed August 2026.

What You Need to Know

Indiana's law is based on Virginia's law, with some notable variations. There is a right to correct inaccurate information, but only information that the consumer previously provided to the controller — not all information the controller possesses about the consumer. The right to access also contains language giving the controller the option to provide a copy of the personal data or a "representative summary." The law contains a unique riverboat casino exemption, permitting them to use facial recognition under certain circumstances.

Official law text

IC 24-15

Who the law applies to

Threshold	Requirement
Annual gross revenue	N/A
Consumers whose data is processed	100,000 consumers 1.47% of state's 6.8 million population
Revenue from sale of personal data	Derives more than 50% of gross revenue from sale of personal data and controls or processes personal data of at least 25,000 consumers.

Consumer rights under Indiana's law15

Right	Provided?
Know	Yes
Access note Controllers have the discretion to send either (a) a copy of or (b) a representative summary of the consumer’s personal data that the consumer previously provided to the controller. The information provided pursuant to the right to access must be provided in a portable format.	Partial
Obtain list of third parties to which personal data was disclosed	No
Data portability note Controllers have the discretion to send either (a) a copy of or (b) a representative summary of the consumer’s personal data that the consumer previously provided to the controller. The information provided pursuant to the right to access must be provided in a portable format.	Partial
Delete	Yes
Correct inaccuracies note Right applies only to data provided by the consumer to the controller.	Partial
Not be discriminated against for exercising rights note A controller may still offer a different price, rate, level, quality, or selection of goods or services to a consumer, including offering goods or services for no fee, if the consumer has exercised the consumer’s right to opt out of targeted advertising, the sale of personal data, or profiling in furtherance of decisions that produce legal or similarly significant effects concerning the consumer, or the offer is related to a consumer’s voluntary participation in a bona fide loyalty, rewards, premium features, discounts, or club card program.	Partial
Opt-out of sale	Yes
Opt-out of targeted advertising/sharing	Yes
Opt-out of certain types of profiling	Yes
Opt-out of ADMT	No
Recognize opt-out signals	No
Revoke consent	No
Not process data in discriminatory manner	No
Appeal	Yes

Tracking Indiana’s privacy law? We write about it as the law changes.

Categories treated as sensitive data8

Racial or ethnic origin
Religious beliefs
Mental or physical health diagnosis made by a health care provider
Sexual orientation
Citizenship or immigration status
Genetic or biometric data for purposes of uniquely identifying an individual
Personal data of known child
Precise geolocation
note
Connecticut, Maryland, Oregon, and Virginia ban the sale of precise geolocation data.

How sensitive data must be treated2

Obtain Consent to Process
Conduct Data Protection or Risk Assessment

Requirements for minors' data1

Process personal data of children under 13 in accordance with COPPA or parental/legal guardian consent

Activities that trigger a risk or impact assessment5

Targeted advertising (“sharing”)
Sale of personal data
Processing of sensitive data
Processing personal data for purposes of profiling where it presents reasonably foreseeable risk of unfair or deceptive treatment of, or unlawful disparate impact on, consumers; financial, physical, or reputational injury to consumers; physical or other intrusion upon the solitude or seclusion, or the private affairs or concerns, of consumers, where such intrusion would be offensive to a reasonable person; other subject injury to consumers
Any processing activities involving personal data that present a heightened risk of harm to consumers

Other notable provisions8

Opt-out Request Can Be Verified
Data Processing Agreements
Privacy Policy
Implement Reasonable Data Security Measures
Duty to Avoid Secondary Use
Data Minimization
Attorney General Enforcement
Right to Cure
note
30 day right to cure that does not sunset.

Key dates1

Date	What happens
January 1, 2026	Indiana's consumer data privacy law takes effect

Questions about Indiana’s privacy law?

Stauss PLLC advises companies on state privacy, AI, and data broker compliance.

Contact Stauss PLLC

Follow Indiana’s privacy law

Our analysis, by email, as the law moves.

This page is provided for general informational purposes only, is not legal advice, and does not create an attorney-client relationship. State laws change frequently; coverage reflects this tool’s most recent update. Contact Stauss PLLC to confirm how these requirements apply to your organization.