Indiana Consumer Data Protection Act (ICDPA) Reference Guide

Indiana’s act covers a person doing business in the state or offering products or services targeted to residents if, in a calendar year, it controls or processes personal data of at least 100,000 consumers. The second route is at least 25,000 consumers and more than 50% of gross revenue from selling personal data. Indiana Code: IC 24-15-2-1 Indiana Attorney General: coverage FAQ

Government bodies, certain financial and health entities, nonprofits, higher education and public utilities are among the stated exceptions. Some data types are separately excluded. Counsel should assess the specific organization and transfer. Indiana Code: IC 24-15-2

The volume is based on statutory consumers in the relevant calendar year. Pageviews cannot establish consumer count or the share of revenue from sales.

Indiana residents may confirm processing, receive eligible data, correct certain provided data, delete personal data and obtain a portable copy. They may opt out of targeted advertising, sale, and profiling used for decisions with legal or similarly significant effects. Controllers generally respond within 45 days and may extend by 45 days if necessary with timely notice. Indiana Code: IC 24-15-3 Indiana Attorney General: rights and timing

A controller needs consent to process sensitive data, with distinct rules for known children, and must provide a meaningful privacy notice, reasonable security and applicable processor contracts and assessments. Legal counsel decides how a particular dataset and recipient should be classified. Indiana Code: IC 24-15-4–5 Indiana Attorney General: sensitive data

Indiana’s sale definition concerns exchange of personal data for monetary consideration, with exceptions for processors, affiliates and other circumstances. Targeted advertising is a separate opt-out purpose. A pixel may fall within targeted advertising even where a particular transfer is not a monetary sale. Indiana Code: definitions and consumer rights Indiana Attorney General: opt-out guide

Inventory every tag, cookie and endpoint, including scripts coded directly into the site. Record what an eligible opt-out changes, and give the legal team the recipient and contract information needed to interpret the data flow.

The ICDPA gives consumers direct opt-out rights and requires a secure, reliable way to submit requests. Its text does not expressly require a universal GPC browser signal to be accepted as every Indiana opt-out. A business serving several states may still recognize GPC under other laws or a shared privacy architecture. Indiana Code: IC 24-15-3–4 Indiana Attorney General: how to exercise rights

Test consent rejection and GPC in separate browser sessions, then compare the results. For Indiana-specific evidence, run the site’s own consumer request route too, then compare which classified marketing and sale flows continue.

The Indiana Attorney General has exclusive ICDPA enforcement authority. Before an enforcement action, the statute provides 30 days’ written notice identifying alleged violations and an opportunity to cure with the required assurance. The Attorney General may seek an injunction and civil penalties up to $7,500 per violation. The statute creates no private right of action under the ICDPA itself. Indiana Code: IC 24-15-10

Counsel decides the organization’s scope, the data and vendor classifications, and which notices and contracts are required. The technical team makes those decisions work in the browser and in downstream platforms.

Use separate browser sessions to compare the site’s initial behavior, its response to a direct opt-out, and its response to Global Privacy Control where relevant to your review. Record the page URL, test time, browser settings and exact choice made so the result can be reproduced.

Inspect cookies and network requests before and after each choice. Record which requests continue, their destinations and the controls involved. Browser evidence can help diagnose an implementation; it cannot establish statutory applicability, the legal purpose of every transfer or organization-wide compliance.

Legal interpretation, applicability, exemptions, notices, vendor contracts, rights-request procedures, sensitive-data obligations and organizational governance belong with qualified privacy counsel.

This guide uses Indiana General Assembly’s current Title 24 and the Indiana Attorney General’s consumer guidance. Section labels guide readers to the relevant parts of article 24-15; legal interpretation remains with qualified counsel.

Prepared by Etalon Editorial Team. Last reviewed September 27, 2026. Material corrections may be sent to contact@etalondata.com.

Etalon is not a law firm and does not provide legal advice. A passing scan or certificate does not guarantee that an organization satisfies every legal obligation.

Technical testing records observable website behavior. Your legal and privacy team remains responsible for scope, exemptions, vendor classification, notices, requests, sensitive data, contracts and governance.