Indiana Consumer Data Protection Act (INCDPA): An Overview

Indiana was the seventh state to pass a comprehensive consumer privacy law. Governor Eric Holcomb signed the INCDPA, Senate Bill 5, on May 1, 2023, and it took effect on January 1, 2026, after a runway of two and a half years.

The U.S. still does not have a comprehensive federal privacy law, though several recent years have been quite active for state-level legislation. Six state privacy laws were passed between March and June 2023. Along with Indiana, there were Iowa, Tennessee, Montana, Florida, and Texas.

The INCDPA is often described as business-friendly because it follows the Virginia Consumer Data Protection Act (VCDPA) model, with a cure period that has no end date, no private right of action, and no requirement to honor universal opt-out signals. Its consumer rights and business obligations are also comparable to those under the Connecticut Data Privacy Act (CTDPA) and the Colorado Privacy Act (CPA).

What Is the Indiana Consumer Data Protection Act (INCDPA)?

The Indiana Consumer Data Protection Act, from Senate Bill 5, protects the privacy and personal data rights of Indiana residents. It is codified at Indiana Code Article 24-15 and establishes data privacy responsibilities for companies that do business in the state or produce products or services targeted to Indiana residents.

Indiana defines a consumer as a resident of the state who is acting only for a personal, family, or household purpose. Individuals acting in a commercial or employment context are not consumers.

Like most U.S. state privacy laws, the INCDPA uses an opt-out model for most processing, with consent required for sensitive data. Businesses covered by the law must tell consumers what data they process, for what purposes, and with which third parties they share it.

They must also give consumers a way to opt out of targeted advertising, sale, and certain profiling, and they and any processors they use must maintain reasonable data security.

Definitions in the Indiana Consumer Data Protection Act

The INCDPA relies on a set of defined terms to determine who must comply and which information falls under its protections. Understanding them is the first step in assessing how the law applies to your business, beginning with personal data.

Personal Data Under the INCDPA

The INCDPA defines personal data as “information that is linked or reasonably linkable to an identified or identifiable individual.” It excludes de-identified data, aggregate data, and publicly available information. The Act does not list specific examples. In practice, names, account names, email addresses, IP addresses, and other online identifiers commonly qualify when they can be linked to an Indiana resident.

Consent Under the INCDPA

The European Union’s GDPR set the standard for defining consent, which has been followed by many regulations passed since, including Indiana’s.

Under the INCDPA, consent is defined as “a clear affirmative act that signals a consumer’s freely given, specific, informed, and unambiguous agreement to process personal data relating to the consumer.”

A “clear affirmative act” “includes a written statement, including a statement written by electronic means, or any other unambiguous affirmative action.”

The second part of that definition is relevant for consent management platforms, which can collect and record visitors’ consent choices on websites, apps, and connected media devices. The INCDPA does not require controllers to give consumers a way to revoke consent, which some other state laws do.

Sensitive Data Under the INCDPA

Sensitive data is a category of personal data that could cause greater harm if misused. Under the INCDPA, it includes:

• Personal data revealing racial or ethnic origin, religious beliefs, a mental or physical health diagnosis made by a health care provider, sexual orientation, or citizenship or immigration status
• Genetic or biometric data processed for the purpose of uniquely identifying a specific individual
• Personal data collected from a known child, meaning a child under 13
• Precise geolocation data, meaning data that identifies a person’s location within a radius of 1,750 feet (533.4 meters)

The INCDPA’s definition of biometric data excludes photographs, video and audio recordings, and data generated from them. It also excludes information collected, used, or stored for health care treatment, payment, or operations under HIPAA.

Many state laws defer to the federal Children’s Online Privacy Protection Act (COPPA) for the handling of children’s data and treat data from a known child as sensitive by default. Under the INCDPA, a controller or processor that complies with COPPA satisfies the Act’s parental consent obligations.

Controller Under the INCDPA

Businesses that collect and process personal data will likely qualify as controllers, which the INCDPA defines as “a person that, alone or jointly with others, determines the purpose and means of processing personal data.” In this case, “person” can also mean a company or other organization that is required to comply with the law.

Processor Under the INCDPA

For businesses that share personal data for processing purposes, the business will be the controller and the third-party entity will be the processor, defined in the INCDPA as “a person that processes personal data on behalf of a controller.”

Sale Under the INCDPA

The INCDPA defines a sale as “the exchange of personal data for monetary consideration by a controller to a third party.” That is narrower than the laws in California, Colorado, and Connecticut, which also cover other valuable consideration. The definition does not include:

• Disclosures to a processor that processes the personal data on the controller’s behalf
• Disclosures to a third party to provide a product or service requested by the consumer or by the parent of a child to whom the data pertains
• Disclosures or transfers to an affiliate of the controller
• Disclosures of information the consumer intentionally made available to the general public through a mass media channel and did not restrict to a specific audience
• Disclosures or transfers to a third party as an asset in a merger, acquisition, bankruptcy, or other transaction in which the third party assumes control of all or part of the controller’s assets

Targeted Advertising Under the INCDPA

The INCDPA defines targeted advertising as “the displaying of an advertisement to a consumer in which the advertisement is selected based on personal data obtained from that consumer’s activities over time and across nonaffiliated websites or online applications to predict the consumer’s preferences or interests.” It does not include:

• Advertisements based on activities within a controller’s own or affiliated websites or online applications
• Advertisements based on the context of a consumer’s current search query, visit to a website, or online application
• Advertisements directed to a consumer in response to the consumer’s request for information or feedback
• Personal data processed solely for measuring or reporting advertising performance, reach, or frequency

Who Has to Comply with the INCDPA?

The INCDPA applies to organizations that conduct business in Indiana or produce products or services targeted to Indiana residents, wherever the organization is based. A business is covered if, during a calendar year, it:

• Controls or processes the personal data of at least 100,000 Indiana consumers, or
• Controls or processes the personal data of at least 25,000 Indiana consumers and derives more than 50 percent of its gross revenue from the sale of personal data

Unlike the CCPA which also covers businesses above an annual revenue threshold, the INCDPA has no revenue test. A business of any size is covered if it meets either consumer-count test. A business below both tests is outside the INCDPA, even if it processes the personal data of some Indiana residents.

Exemptions to the INCDPA

The INCDPA exempts certain organizations outright and certain categories of data. Exempt organizations include:

• The state, state agencies, political subdivisions, and third parties acting on their behalf under contract
• Financial institutions and their affiliates, and data subject to the Gramm-Leach-Bliley Act (GLBA)
• Covered entities and business associates governed by the Health Insurance Portability and Accountability Act (HIPAA)
• Nonprofit organizations, defined as organizations exempt from tax under Section 501(c)(3), 501(c)(6), or 501(c)(12) of the Internal Revenue Code
• Institutions of higher education
• Public utilities and their affiliated service companies
• Certain 501(c)(4) organizations established to detect or prevent insurance-related crime or fraud that are subject to a memorandum of understanding with a statewide law enforcement agency

Exempt data includes:

• Protected health information under HIPAA, patient identifying information, patient safety work product, and certain human subjects research data
• Information bearing on creditworthiness handled by consumer reporting agencies, furnishers, and users of consumer reports, but only to the extent regulated by the Fair Credit Reporting Act (FCRA)
• Personal data regulated by the Family Educational Rights and Privacy Act (FERPA), or collected, processed, sold, or disclosed in compliance with the Driver’s Privacy Protection Act or the Farm Credit Act
• Data processed in an employment context, including data about job applicants, employees, agents, and independent contractors, plus emergency contact and benefits administration data, to the extent used within that role

Complying with COPPA is treated as satisfying the INCDPA’s parental consent obligations. A controller that processes personal data under one of the Act’s listed exemptions bears the burden of showing that the processing qualifies.

Consumers’ Rights Under the INCDPA

Consumers have five main personal data rights under the INCDPA. Parents or legal guardians of known children can invoke a child’s rights regarding processing of the child’s personal data.

Each right is subject to exceptions, such as when a controller cannot authenticate the consumer using commercially reasonable efforts.

Decisions with legal or similarly significant effects are those that result in the provision or denial of financial or lending services, housing, insurance, education enrollment, criminal justice, employment opportunities, health care services, or access to basic necessities such as food and water.

The INCDPA has no private right of action, so consumers cannot sue controllers for violations. They can report suspected violations, including denied requests, to the Indiana Attorney General.

INCDPA Consumer Rights

Right to access

Confirmation of whether the controller is processing the consumer’s personal data, and access to that data

Right to correction

Correction of inaccuracies in the personal data the consumer previously provided to the controller

Right to delete

Deletion of personal data provided by or obtained about the consumer

Right to portability

A copy or representative summary of the personal data the consumer previously provided to the controller, in a portable and, where technically practicable, readily usable format. A controller does not have to provide it to the same consumer more than once in 12 months

Right to opt out

Opt out of targeted advertising, the sale of personal data, and profiling in furtherance of decisions that produce legal or similarly significant effects concerning the consumer

How Does the INCDPA Affect Businesses?

The INCDPA places obligations on businesses that meet its thresholds, covering how they inform consumers, handle requests, assess risk, and protect personal data. The practical effect depends on a business’s role and the data it handles.

Consumer Requests and Appeals

Consumers submit requests through the secure and reliable means a controller describes in its privacy notice. A controller may not require a consumer to create a new account to make a request, though it can require use of an existing account.

Controllers must respond within 45 days of receiving an authenticated request. They can extend that period once, by 45 days, when reasonably necessary, if they tell the consumer about the extension and the reason within the first 45 days. Information must be provided free of charge once a year per consumer.

If requests are manifestly unfounded, excessive, or repetitive, the controller can charge a reasonable fee or decline to act, and it bears the burden of demonstrating that. If a controller cannot authenticate a request using commercially reasonable efforts, it does not have to comply and can ask for additional information.

If a controller declines a request, it must explain why within 45 days and give instructions for appealing. The appeal process must be conspicuously available and similar to the process for submitting requests.

The controller has 60 days to respond to an appeal in writing, with an explanation of its reasons. If it denies the appeal, it must give the consumer an online mechanism, if available, or another method to contact the Attorney General and submit a complaint.

Any contract provision that purports to waive or limit a consumer’s rights under the INCDPA is void and unenforceable.

Purpose Limitation Under the INCDPA

Controllers must limit the collection of personal data to what is adequate, relevant, and reasonably necessary for the purposes they have disclosed to the consumer. They may not process personal data for purposes that are neither reasonably necessary for nor compatible with those disclosed purposes unless they obtain the consumer’s consent.

Data Security Under the INCDPA

Controllers must establish, implement, and maintain reasonable administrative, technical, and physical data security practices to protect the confidentiality, integrity, and accessibility of personal data. These practices should be appropriate to the volume and nature of the personal data being processed.

Data Protection Impact Assessments (DPIAs) Under the INCDPA

Controllers must conduct and document a data protection impact assessment (DPIA) for the following processing activities:

• Processing for targeted advertising
• Selling personal data
• Profiling that presents a reasonably foreseeable risk of unfair or deceptive treatment, unlawful disparate impact, financial, physical, or reputational injury, intrusion on seclusion, or other substantial injury to consumers
• Processing sensitive data
• Any other processing that presents a heightened risk of harm to consumers

A DPIA must weigh the benefits of the processing to the controller, the consumer, other stakeholders, and the public against the potential risks to consumers, as mitigated by safeguards. A single DPIA can cover a comparable set of processing operations, and an assessment prepared for another law may satisfy the requirement if its scope and effect are reasonably comparable.

The requirement applies to processing activities created or generated after December 31, 2025, and is not retroactive.

The Attorney General can request a DPIA that is relevant to an investigation through a civil investigative demand. DPIAs are confidential and exempt from public inspection, and disclosing one to the Attorney General does not waive attorney-client privilege or work product protection.

Consent Requirements Under the INCDPA

Like most U.S. states with privacy laws, Indiana uses an opt-out model, so consent is not required before collecting and processing personal data in many cases. Consent is required to process sensitive data, and to process personal data for purposes that are neither reasonably necessary for nor compatible with the purposes disclosed to the consumer.

Consumers must be given clear notice about processing and be able to opt out of targeted advertising, sale, and certain profiling.

For known children under 13, controllers must process sensitive data in accordance with COPPA, which includes obtaining verifiable parental consent. All personal data collected from a known child is sensitive data under the INCDPA.

Nondiscrimination Under the INCDPA

Controllers may not process personal data in violation of state or federal anti-discrimination laws. They also cannot discriminate against consumers for exercising their rights, including by denying goods or services, charging different prices or rates, or providing a different level or quality of goods or services.

The INCDPA sets two limits on this rule. A controller does not have to provide a product or service that requires personal data it does not collect or maintain.

A controller may also offer a different price, rate, level, quality, or selection of goods or services, including goods or services for no fee, if the consumer has opted out of targeted advertising, sale, or certain profiling, or if the offer relates to the consumer’s voluntary participation in a bona fide loyalty, rewards, premium features, discount, or club card program.

Some website features will not work without certain cookies, so a site may not function fully if a visitor declines them. Whether a specific practice is discriminatory depends on the facts, and qualified legal counsel can help assess it.

Transparency Under the INCDPA

Controllers must give consumers a reasonably accessible, clear, and meaningful privacy notice, commonly on the company’s website. Under the INCDPA, the notice must include:

• The categories of personal data the controller processes
• The purpose for processing personal data
• How consumers can exercise their rights, including how to appeal a decision
• The categories of personal data the controller shares with third parties, if any
• The categories of third parties with which the controller shares personal data, if any

Controllers that sell personal data to third parties or use it for targeted advertising must also clearly and conspicuously disclose that activity and explain how consumers can opt out.

Third-Party Contracts Under the INCDPA

Controllers must have a binding contract with each processor (vendors and service providers). It must set out the instructions for processing, the nature and purpose of the processing, the type of data, the duration of processing, and the rights and obligations of both parties. The contract must also require the processor to:

• Subject each person processing personal data to a duty of confidentiality
• Delete or return all personal data to the controller at the end of the services, at the controller’s direction, unless the law requires retention
• Make available the information needed to demonstrate its compliance, on the controller’s reasonable request
• Allow and cooperate with reasonable assessments by the controller or the controller’s designated assessor, or arrange for a qualified, independent assessor to conduct one and share the report
• Engage any subcontractor under a written contract that requires the subcontractor to meet the same obligations

Processors must also assist controllers with consumer requests, data security, breach notification, and the information needed to conduct DPIAs.

Universal Opt-Out Signals Under the INCDPA

Like Virginia, Iowa, and Utah, Indiana does not require controllers to honor Global Privacy Control (GPC) or similar universal opt-out signals. The INCDPA requires only that controllers clearly and conspicuously disclose sales and targeted advertising and explain how consumers can opt out. Several other states do require signal recognition, including California and Colorado.

Signals like GPC let consumers set their preferences once and have them communicated to every website or app they visit. Honoring them voluntarily can help businesses that operate in several states apply a consistent approach to opt-out requests.

Updates to the INCDPA

The Indiana General Assembly has amended the INCDPA once since it was enacted. The amendment added a new entity exemption.

House Bill 1587: Insurance-Fraud Organizations

House Bill 1587 (Public Law 236-2025), signed on May 6, 2025, added an exemption for 501(c)(4) organizations that are established to detect or prevent insurance-related crime or fraud and are subject to a memorandum of understanding with a statewide law enforcement agency.

What Happens If a Business Violates the INCDPA?

The Indiana Attorney General enforces the INCDPA, and businesses that fall short of its requirements may face legal consequences. The details of how enforcement works are set out below.

Enforcement Under the INCDPA

The Indiana Attorney General has exclusive authority to enforce the INCDPA, and the law has no private right of action. Consumers can report suspected violations, including denied requests, to the Attorney General’s office.

The Attorney General can issue a civil investigative demand when it has reasonable cause to believe a person has violated, is violating, or is about to violate the Act. Before bringing an action, the Attorney General must give the business 30 days’ written notice identifying the specific provisions it alleges were or are being violated.

Enforcement Activity

Ahead of the effective date, the Attorney General released a Consumer Data Protection Bill of Rights on November 25, 2025, explaining consumer rights and how to file complaints. The office said it would rely on consumer complaints and its own reviews of company practices. The Attorney General has not publicly announced a formal enforcement action under the INCDPA as of November 2026.

Cure Period Under the INCDPA

A business that receives the Attorney General’s notice has 30 days to cure the alleged violations.

If the business cures them within the 30 days and gives the Attorney General an express written statement that the violations have been cured and that steps have been taken to prevent further violations, the Attorney General cannot bring an action.

The Attorney General can sue if the business continues the violation after the 30 days or breaches its written statement. Unlike in states such as Colorado and Montana, where the cure period has ended, Indiana’s 30-day cure period has no end date.

Fines and Penalties Under the INCDPA

If a controller or processor does not cure within 30 days, the Attorney General can bring an action in the state’s name seeking an injunction to restrain violations and a civil penalty of up to USD 7,500 for each violation. The Attorney General can also recover reasonable expenses incurred in investigating and preparing the case, including attorney’s fees.

How Consent Infrastructure Supports INCDPA Requirements

Indiana asks businesses for clear notice, a working opt-out, and consent for sensitive data. Consent infrastructure, such as a consent management platform (CMP), can help deliver all three.

Under the INCDPA, controllers can usually collect and process personal data without prior consent. Consent is required to process sensitive data, and for known children under 13, controllers must follow COPPA.

Three requirements matter most to visitors:

• A clear privacy notice that covers the items the INCDPA requires
• A way to opt out of targeted advertising, the sale of personal data, and certain profiling
• Clear and conspicuous disclosure of any sale or targeted advertising, with instructions for opting out

A CMP can help on each front. Usercentrics Web CMP and App CMP can detect the cookies and other tracking technologies in use on websites and apps, present notices and choices in a banner, and show visitors which data categories, services, and third parties are involved. Consent records can also support an organization’s documentation of visitors’ choices.

A company operating across the U.S. or abroad may need to meet several privacy laws at once. Geotargeting helps by presenting the right notice and choices based on each visitor’s location, in the visitor’s preferred language. That can support privacy compliance efforts under the INCDPA, other U.S. state laws, and regulations such as the GDPR, which sets stricter consent requirements than U.S. state privacy laws.

Preparing for the INCDPA

Organizations that meet the INCDPA’s thresholds have been subject to it since January 1, 2026. Businesses that already meet the requirements of other state privacy laws, especially Virginia’s, have likely done much of the work, though each law has its own provisions. As always, a privacy by design approach benefits all operations, whether for regulatory purposes or not.

Meeting the INCDPA’s requirements mainly involves four checks:

• Applicability: Does the business meet either consumer-count test, and does an exemption apply?
• Privacy notice: Does it cover the required items, including how to exercise rights, how to appeal, and how to opt out of sale and targeted advertising?
• Requests and consent: Is there a 45-day response process, a 60-day appeal process, and consent collected before sensitive data is processed?
• Contracts and assessments: Do processor contracts include the required terms, and are DPIAs documented for processing activities created or generated after December 31, 2025?

A CMP can help with cookie and tracking notices and opt-outs. The INCDPA has been amended once since it was enacted, and further updates are possible as technology and consumer expectations change. Qualified legal counsel or the organization’s data protection officer (DPO) can help confirm specific obligations.

Protecting customer privacy proactively can strengthen customer relationships over time, and clear, respectful consent experiences can support higher-quality first-party data for audience building and measurement.

Usercentrics does not provide legal advice, and information is provided for educational purposes only. We always recommend engaging qualified legal counsel or privacy specialists regarding data privacy and protection issues and operations.