Did you know that over 75% of the most frequently visited U.S. websites share visitors’ personal data with third-party advertisers? Or that in 2024 alone, the protected health information of 276,775,457 individuals was exposed or stolen in healthcare breaches – averaging a staggering 758,288 records per day? These aren’t abstract numbers; they’re the stories of identity theft, financial ruin, and eroded trust that plague millions, including Hoosiers.
That is why we now have the Indiana Consumer Data Protection Act (CDPA), a groundbreaking law passed in 2023 that takes effect on January 1, 2026. As one of the first states to enact such comprehensive consumer data protections, Indiana is reclaiming control for its residents – the everyday folks navigating e-commerce, healthcare apps, and social feeds. The CDPA isn’t just legalese; it’s a shield against the invisible economy of data brokers and targeted ads that turn our lives into profit margins and now business owners have to comply with another state law and depend on Captain Compliance to help them do so.
Understanding the CDPA’s “Bill of Rights.” We unpack the 15 core rights, demystify key terms, explore how to wield these powers, and tackle FAQs. We’ll also delve into real-world impacts on consumers and businesses, with comparisons to trailblazers like California’s CCPA. Whether you’re a concerned parent safeguarding your child’s data or a small business owner bracing for compliance, this is your roadmap to a more private Indiana future.
Why now? With global cybercrime costs projected to hit $10.5 trillion annually by 2025 – a 10% year-over-year spike – and U.S. data breaches affecting 353 million individuals in a single year, the CDPA arrives at a pivotal moment. It empowers Hoosiers to demand transparency, correction, and deletion of their data, while nudging businesses toward ethical practices that avert breaches. As the Indiana Attorney General’s Office notes, this law benefits everyone: consumers dodge identity theft, and businesses sidestep the 60% failure rate for small firms post-breach. Let’s dive in.
Why Indiana Decided That They Needed a Data Privacy Law
The CDPA’s preamble paints a vivid picture of our data-saturated world. Companies hoover up Hoosiers’ personal data daily – from economic insights via shopping carts to health metrics from wearables and social signals from Instagram likes. This isn’t hyperbole; it’s the backbone of a $1 trillion global ad tech industry by 2030. Yet, as the preamble laments, this sharing often happens without knowledge or consent, fueling a shadowy ecosystem where our data is analyzed to dictate everything from loan approvals to job offers.
Indiana’s response? A law that flips the script. Enacted in 2023, the CDPA grants residents – dubbed “consumers” when acting in personal, family, or household capacities – unprecedented control. You can now confirm if your data is being processed, demand its correction or deletion, and opt out of sales or profiling. Enforcement falls to the Attorney General’s Office, with consumers able to file complaints directly.
But the preamble’s genius lies in its dual appeal. For consumers, it’s a bulwark against breaches: the average U.S. data breach costs $10.22 million in 2025, with healthcare hits topping $9.77 million. Identity theft alone siphoned $27.2 billion from victims in 2024, up 19% from prior years. For businesses, compliance isn’t a burden but a boon – implementing privacy standards slashes breach risks, which doom 60% of small enterprises within six months. Indiana’s law fosters trust, potentially boosting customer loyalty in a state where e-commerce thrives.
Consider a real Hoosier scenario: You’re browsing Indy-area florists online for a Mother’s Day bouquet. Cookies track your searches, building a profile sold to advertisers. Under the CDPA, you’ll soon opt out, ensuring your data doesn’t fuel unsolicited spam or worse, a breach exposing your payment info. This isn’t just protection; it’s empowerment in a data-driven society where 62% of EU users (a harbinger for U.S. trends) spot illegal content online but only 28% know how to report it. As breaches surge – over 4,100 disclosed in the U.S. last year alone, or 11 per day – Indiana’s preamble signals a commitment to informed choices, reducing leak odds and cyberattack fallout.
The law’s January 2026 kickoff gives ample prep time, but awareness is key. This Bill of Rights isn’t a dusty pamphlet; it’s a toolkit. If a violation looms, the Attorney General’s complaint portal awaits. In essence, the preamble isn’t rhetoric – it’s a rallying cry for Hoosiers to own their digital destiny.
Your Indiana Consumer Data Protection Bill of Rights: 15 Pillars of Privacy
At the heart of the CDPA beats its Bill of Rights – a crisp enumeration of 15 consumer safeguards. These aren’t optional perks; they’re enforceable entitlements against “controllers” (entities deciding data processing). Let’s unpack them, with real-life ties to make them stick.
- Right to Confirmation: Demand proof if a controller processes your data. Imagine querying your gym app: “Are you analyzing my workout logs?” They must affirm or deny.
- Right to Access: Once yearly, gratis, snag a copy or summary of data you provided. Not inferred insights – just your inputs, like address from a signup form. Delivered in 45-90 days.
- Right to Correction: Fix inaccuracies in your supplied data. If you listed “Indy” but meant “Indianapolis,” correct it pronto – vital for accurate health or financial records.
- Right to Deletion: Eradicate all your data held by the controller. Broader than correction, this nukes profiles from breaches’ crosshairs.
- Right to Opt-Out: Block targeted ads, data sales, or profiling. Click “no thanks” to halt your browsing history fueling creepy shoe ads across sites.
- Right to Portability: Get data in a transferable format – think CSV exports for seamless switches from one banking app to another.
- Right to Appeal: If denied, challenge it. Controllers must respond in 60 days, or face escalation to the AG.
- Right Against Discrimination: No retaliation for exercising rights – no denied services or jacked prices for privacy fans.
- Right to Non-Discriminatory Processing: Data handling must align with anti-bias laws, preventing algorithmic redlining in loans or jobs.
- Right to Act for Children: Parents/guardians invoke rights for kids under 13.
- Right to Child Consent: No processing kids’ data sans parental nod – echoing federal COPPA.
- Right to Sensitive Data Consent: Opt-in required for racial origins, health diagnoses, biometrics, or precise geolocation. All kids’ data qualifies as sensitive.
- Right to Transparency: Privacy notices must detail categories processed, purposes, shared data, and recipients – no fine print fog.
- Right to Data Minimization: Collection limited to what’s “adequate, relevant, and necessary.” No hoarding for “just in case.”
- Right to Purpose Limitation: No repurposing without consent – if collected for shipping, not for ad profiling.
These rights form a fortress. Take profiling: Automated evaluations predicting your “reliability” for loans could embed biases, as seen in 2024’s credit scandals. Opting out ensures fairer shots. Or sensitive data: In Indiana’s diverse tapestry, protecting ethnic or religious info prevents targeted scams. Collectively, these 15 rights – free annually, with appeals – democratize data, echoing GDPR’s ethos but tailored for Hoosier life.
What the Indiana Privacy Law Really Means
The CDPA’s lexicon is precise, avoiding the vagueness that dooms lesser laws. Here’s the essentials:
- Child: Under 13 – triggering strict consents.
- Consent: Affirmative, informed opt-in – no pre-checked boxes.
- Consumer: Indiana residents in non-commercial roles; B2B? Exempt.
- Controller: Decision-makers on data fate – the “boss” of processing.
- Personal Data: Linkable info about you – emails, IPs, but not public records or de-identified aggregates.
- Processing: Any action – collect, store, analyze, delete. Processors execute for controllers.
- Profiling: AI-driven predictions on health, finances, behavior – opt-out to curb biases.
- Sale: Monetary exchanges with third parties, excluding affiliates or service fulfillers.
- Sensitive Data: High-stakes categories like genetics or geolocation; all child data included.
- Targeted Advertising: Cross-site ad tailoring based on history – not contextual ads like “buy milk” on a grocery site.
These definitions ground the law. Unlike CCPA’s broader “sale” (including shares for value), Indiana’s monetary focus eases some burdens. For businesses, clarity means fewer compliance traps; for consumers, it means targeted protections against the data economy’s underbelly.
Overview and Deep Dive: Mastering Your Rights Under the CDPA
The CDPA clusters rights into four buckets: Know, Control, Protect, and Take Action. This framework isn’t arbitrary – it’s a ladder from awareness to advocacy.
Right to Know
Start with transparency. Confirm processing via privacy notices (must be “accessible, clear, meaningful”). Access your data yearly – crucial post-breach, like the 2024 National Public Data hack exposing billions. Hypothetical: Your favorite Hoosier craft beer site? Query their notice; if vague, flag it.
Right to Control
Hands-on tweaks. Correct supplied data (e.g., wrong DOB risking insurance denials). Delete broadly – controllers must propagate to processors. Portability? Export fitness logs to a new app seamlessly, fostering competition.
Right to Protect
The heavy hitters. Opt-out of invasive uses: Targeted ads (cross-site stalking), sales (broker fodder), profiling (bias traps in hiring). Sensitive data demands opt-in – imagine blocking geotracking for a women’s health app. For kids, parental gates prevent predatory ads.
Right to Take Action
No fear of backlash. Discrimination? Illegal – equal service for all. Appeals ensure due process; denials trigger AG complaints.
These rights have teeth but limits: Unfounded requests? Feeable. Yet, they empower. In a state where small businesses abound, control reduces misuse risks. Businesses gain too: DPIAs (data protection impact assessments) mandated for high-risk processing, preempting fines up to $7,500 per violation.
Deep dive example: Opting out of profiling. Algorithms might deny you a mortgage based on “predicted unreliability” from shopping habits. Revoke consent, and decisions revert to human review – fairer, less biased. Or deletion: Post-breakup, wipe ex-shared streaming data to avoid awkward recommendations. The CDPA’s genius? It balances rights with practicality, ensuring Hoosiers aren’t data serfs.
Compared to CCPA, Indiana skips employee data coverage but mandates DPIAs – a proactive edge absent in California’s opt-out-heavy model. Virginia’s CDPA mirrors closely, but Indiana’s revenue threshold (50% from sales for 25,000 residents) snags more ad-tech firms.
State Privacy Law Comparison Chart
To contextualize Indiana’s CDPA within the U.S. patchwork, here’s a comparison table with key comprehensive state laws (as of December 2025). Data sourced from IAPP trackers and legal analyses.
| State/Law | Effective Date | Threshold | Key Rights (Access/Correct/Delete/Opt-Out) | Sensitive Data | DPIAs Required? | Enforcement |
|---|---|---|---|---|---|---|
| Indiana (CDPA) | Jan 1, 2026 | 100k residents OR 25k + >50% revenue from sales | Yes/Provided data only/Yes/Targeted ads, sales, profiling | Opt-in consent | Yes (for targeted/sale/profiling) | AG only; up to $7,500/violation |
| California (CCPA/CPRA) | Jan 1, 2020 / Jan 1, 2023 | $25M revenue OR 100k consumers/devices OR >50% revenue from sales/sharing | Yes/Yes (all data)/Yes/Targeted ads, sales/sharing, profiling | Opt-in for sensitive | Risk assessments (not full DPIAs) | AG + private right; up to $7,500 |
| Virginia (VCDPA) | Jan 1, 2023 | 100k residents OR 25k + >50% revenue from sales | Yes/Provided data only/Yes/Targeted ads, sales, profiling | Opt-in consent | No | AG only; up to $7,500 |
| Colorado (CPA) | Jul 1, 2023 | 100k residents OR 25k + >25% revenue from sales | Yes/Yes (all data)/Yes/Targeted ads, sales, profiling | Opt-in for sensitive | Yes | AG; rulemaking; up to $20k/violation |
| Utah (UCPA) | Dec 31, 2023 | $25M revenue + (100k residents OR 25k + >50% from sales) | Yes/No/Yes/Targeted ads, sales (no profiling opt-out) | No opt-in (opt-out only) | No | AG only; up to $7,500 |
| Connecticut (CTDPA) | Jul 1, 2023 | 100k residents OR 25k + >25% revenue from sales | Yes/Yes (all data)/Yes/Targeted ads, sales, profiling | Opt-in consent | Yes | AG; up to $7,500 |
How to Exercise Your Rights: A Step-by-Step Blueprint for Indiana Residents
Exercising rights shouldn’t feel like decoding hieroglyphs. The CDPA mandates “safe and reliable” submission methods – think online portals mirroring your usual interactions. If you’re a business wondering how to handle these new requests we suggest you look at our data subject request software.
- Scope Check. Verify applicability: Targets Indiana biz with 100,000+ resident data processors or 25,000+ with 50% revenue from sales. Exempt: Nonprofits, HIPAA entities, utilities.
- Access Request. Hit the privacy notice (footer links galore) for forms/emails. Verify identity sans new accounts.
- Correct/Delete. Formalize via designated channels; 45-day response (extendable to 90).
- Opt-Out. Click mechanisms for ads/sales/profiling; notices must disclose if active.
- Appeal Denials. 60-day turnaround; AG escalation if stonewalled.
- Complain. AG’s online portal: https://www.in.gov/attorneygeneral/consumer-protection-division/file-a-complaint/.
Tips: Document everything. Use incognito for tests. For kids, specify guardianship. Businesses: Train staff, automate responses. This process demystifies privacy, turning overwhelm into agency.
FAQs: Answering Your Indiana Privacy Law Questions
The document’s FAQs are gold; let’s expand.
- Compliance Timeline?
- January 1, 2026 – ample for audits.
- Who Complies?
- Threshold-hit entities; exemptions abound.
- Gov/Nonprofits?
- Out.
- Controller vs. Processor?
- Decider vs. doer – e.g., retailer vs. shipper.
- Not Personal Data?
- Public/de-identified info.
- Universal Delete?
- No – per-controller requests.
- Response Time?
- 45-90 days.
- Purchase Needed?
- Nope – any data holder.
- Fees?
- Rare, for excessives.
- Denials?
- Legal exceptions like investigations; appeal always.
- Child Rights?
- Parental proxy.
- Proxy for Adults?
- Legal auth only.
- Kids’ Data?
- COPPA-aligned consent.
- Notice Location?
- Prominent, accessible.
- Service Impact?
- None.
- Violation?
- AG complaint.
These clarify pitfalls, like no blanket deletes – a nod to feasibility.
Impacts: Winners and Challenges for Hoosiers and Businesses
Consumers win big: Reduced breach risks (241-day average detection? Unacceptable), empowered choices. A UC Berkeley-esque study might show 70% awareness gaps bridged by CDPA’s DROP-like tools (though Indiana lacks centralized opt-out yet).
Businesses: Compliance costs, but ROI via trust. DPIAs curb fines; minimization slashes storage bills. Indiana’s long runway (vs. CCPA’s rush) aids – Deloitte pegs registry fees low, but audits loom. Challenges: Multi-state patchwork, but harmonization trends.
CDPA Compliance Software Company
Now you can automate all of these requirements for the new Indiana privacy law with the help of Captain Compliance. The CDPA isn’t perfect – no universal delete, state silos persist – but it’s a leap. As 2026 dawns, audit your data shadows. Businesses: DPIA now. Consumers: Notice-spot, opt-out aggressively. File complaints; shape enforcement. In Indiana’s heartland, this law isn’t bureaucracy – it’s bedrock for a fairer digital frontier.
