Indiana Privacy Bill Approved By Legislature

This month, the Indiana legislature passed the country's seventh state-level comprehensive consumer privacy bill. It passed through the Indiana House unanimously and is expected to go to the governor for signature, having already been approved by the state senate. The law is similar to other state privacy laws such as Virginia's. It will not take effect until 1/1/2026, which is a long time in the field of privacy law developments.

Why It Matters

If signed, the new Indiana privacy law would not change the nature of privacy compliance for most companies that already have a privacy program. It builds on the now-familiar combination of limiting corporate use of data for certain tasks while also providing consumers with the right to control their personal data. Among other things, the pending law would require data protection impact assessments and an opt-out mechanism for targeted advertising and sale of data.  

The new law's real impact is to show (1) increasingly convincingly, that privacy has come of age in the US even without a federal law, and (2) that targeted advertising is an area that really disturbs policy-makers. Companies that employ trackers and other tools to target and re-target ads are encouraged to review those tools and understand whether their service providers are collecting information beyond what is needed to serve ads on the company's behalf.