Key Facts
Effective Date
January 1, 2026
Enacted
May 1, 2023
Enforcing Authority
Indiana Attorney General
Consent Model
Opt-out
Fulfillment Time
45 days
Applies To
For-profit entities in Indiana or targeting Indiana residents: 100,000+ consumers OR 25,000+ consumers and 50%+ revenue from selling PI
Overview
Indiana's INCDPA closely follows the Virginia VCDPA template, with a permanent 30-day cure period and GDPR-style data protection assessments. It takes effect January 1, 2026, and features a narrower health data definition than some other states.
What This Means for Your Website
- Opt-in consent is required for sensitive data processing of Indiana visitors
- Data protection assessments are needed for targeted advertising, profiling, and data sales
- Consumer requests must be fulfilled within 45 days (extendable by 45)
- A permanent 30-day cure period applies before enforcement action
Key Requirements
The Indiana AG enforces the INCDPA with penalties up to $7,500 per violation. The law follows the VCDPA template with data minimization requirements and consumer rights including access, correction, deletion, portability, and opt-out. Data protection impact assessments apply to processing created from June 2026 onward.
How ConsentStack Handles This
ConsentStack detects Indiana visitors and applies the INCDPA opt-out model with opt-in for sensitive data when the law takes effect in January 2026.
Penalties
Up to $7,500 per violation.
Maximum Fine
$7,500 per violation
Key Requirements
- Opt-in consent for sensitive data processing
- Data minimization: adequate, relevant, reasonably necessary
- Data protection assessments for targeted advertising and profiling
- Consumer rights: access, correct, delete, portability, opt-out
- 45-day response window extendable by 45 days
Notable Provisions
- Virginia VCDPA template
- Permanent 30-day cure period
- Narrower health data definition
- Data protection impact assessments from June 2026
US State Specifics
Cure Period
30 days
Private Right of Action
No
Global Opt-out Required
No
Sensitive Data Opt-in
Yes
Children Provisions
Under 13 data is sensitive requiring opt-in consent.
Other North America Regulations
CPRACalifornia, United States
The CPRA is the most comprehensive US state privacy law with a dedicated enforcement agency (CPPA). Cross-context behavioral advertising via cookies constitutes sharing personal information, triggering opt-out obligations. GPC signals must be honored as valid opt-out requests.CCPACalifornia, United States
The CCPA was the first comprehensive consumer privacy law in the United States, giving California residents the right to know what personal information businesses collect and to opt out of its sale. It established the opt-out consent model that most subsequent US state privacy laws adopted.PIPEDACanada
Canada's federal private-sector privacy law based on 10 fair information principles. Requires express consent for sensitive data and implied consent for less sensitive data. OPC guidance addresses cookies and online behavioral advertising. The CPPA replacement bill died January 2025; a new bill is expected.CIPACalifornia, United States
CIPA is a 1967 California chapter covering wiretapping, eavesdropping, and other privacy invasions, not a website-specific law. Since 2022, courts have applied two of its sections to website chat, analytics, and ad tools, and any visitor can sue directly for at least $5,000 per violation, no revenue threshold.Quebec Law 25Quebec, Canada
Quebec's Law 25 is the strictest privacy law in Canada and the closest North American equivalent to the GDPR. Consent must be clear, free, informed and requested for each purpose, and any technology that identifies, locates or profiles a visitor has to be disclosed. Its privacy-by-default rule carves out browser cookie settings, but non-essential cookies still need consent first.CPAColorado, United States
Colorado's CPA features the highest per-violation penalties among US state privacy laws at $20,000. Must honor GPC signals since July 2024. Participated in a joint GPC enforcement sweep with California and Connecticut in September 2025. The cure period was eliminated in January 2025.Frequently Asked Questions
Stay compliant with INCDPA
ConsentStack helps you implement Opt-out consent for Indiana, United States automatically.