Indiana Consumer Data Protection Act (SEA 5, 2023; IC 24-15): profiling opt-out and data protection impact assessments

Summary

Indiana's comprehensive consumer privacy law (Senate Enrolled Act 5 of 2023, IC 24-15), in force since January 1, 2026, applies to persons doing business in Indiana or targeting its residents that control or process personal data of at least 100,000 Indiana consumers in a calendar year, or of at least 25,000 and derive over half of gross revenue from selling personal data. Consumers may opt out of processing for targeted advertising, sale, and profiling in furtherance of decisions that produce legal or similarly significant effects; profiling is defined as solely automated processing. Controllers must conduct and document a data protection impact assessment for profiling that presents a reasonably foreseeable risk of unfair or deceptive treatment, unlawful disparate impact, or financial, physical or reputational injury, for processing created or generated after December 31, 2025. The act does not apply to financial institutions and their affiliates or to data subject to Title V of the Gramm-Leach-Bliley Act. The Attorney General has exclusive enforcement authority, with a civil penalty of up to $7,500 per violation and a 30-day notice-and-cure step before any action; there is no private right of action. The Attorney General published a Consumer Data Protection Bill of Rights describing the profiling opt-out.

Key dates

1. May 1, 2023Enacted
2. January 1, 2026Takes effect
3. October 16, 2026Checked against sources
4. October 21, 2026Checked against sources

Developments are added when the record is reviewed. Next review: October 16, 2027.

Evidence

Each passage is quoted from its source. The quoted passages are re-checked against the live pages every month.

1. IC 24-15 IS ADDED TO THE INDIANA CODE AS A NEW ARTICLE TO READ AS FOLLOWS [EFFECTIVE JANUARY 1, 2026]: ARTICLE 15. CONSUMER DATA PROTECTION

   Supports: Instrument and effective date

   controls or processes personal data of at least one hundred thousand (100,000) consumers who are Indiana residents

   Supports: Threshold

   (C) profiling in furtherance of decisions that produce legal or similarly significant effects concerning the consumer.

   Supports: Profiling opt-out

   "Profiling" means any form of solely automated processing performed on personal data to evaluate, analyze, or predict personal aspects

   Supports: Profiling definition

   The processing of personal data for purposes of profiling, if such profiling presents a reasonably foreseeable risk of: (A) unfair or deceptive treatment of, or unlawful disparate impact on, consumers; (B) financial, physical, or reputational injury to consumers

   Supports: Impact assessment for risky profiling

   Any financial institutions and affiliates, or data subject to Title V of the federal Gramm-Leach-Bliley Act

   Supports: Financial institution exemption

   a civil penalty not to exceed seven thousand five hundred dollars ($7,500) for each violation under this article

   Supports: Penalty

   The attorney general has exclusive authority to enforce the provisions of this article.

   Supports: Enforcement

   Nothing in this article shall be construed as providing the basis for a private right of action

   Supports: No private right of action

   Senate Enrolled Act No. 5 (2023) Indiana General Assembly Primary source

2. On May 1, 2023, Indiana Governor Eric Holcomb signed into law Senate Enrolled Act No. 5

   Supports: Signing date

   Indiana Becomes the Seventh State to Enact a Comprehensive Data Privacy Law (10 May 2023) White & Case Reporting or analysis

3. Starting January 1, 2026, we will enforce Indiana's new Consumer Data Protection Act (CDPA).

   Supports: In force and enforced from January 1, 2026

   The right to opt out of profiling gives Hoosiers the ability to choose whether their personal data can be processed to evaluate and predict behavior and preferences to support legal and other significant decisions related to financial and lending services

   Supports: AG description of profiling opt-out

   Indiana Consumer Data Protection: Consumer Bill of Rights Indiana Office of the Attorney General Primary source