Is Indiana's Consumer Data Protection Act in Effect in 2026?

Yes. Indiana's Consumer Data Protection Act (ICDPA) took effect January 1, 2026, making Indiana one of three states — alongside Kentucky and Rhode Island — whose comprehensive privacy laws became enforceable on that same date. Marketers running targeted or retargeting campaigns that reach Indiana residents are now subject to its opt-out and disclosure requirements.

Who the Law Covers

The ICDPA applies to any business that conducts business in Indiana or targets products or services to Indiana residents and that, during the prior calendar year, either controlled or processed personal data of at least 100,000 Indiana consumers, or controlled or processed data of at least 25,000 consumers while deriving more than 50% of gross revenue from selling personal data. Smaller advertisers below those thresholds aren't directly covered, though agencies managing data on behalf of larger clients may still need to comply. The law was signed by Governor Eric Holcomb on May 1, 2023, giving businesses more than two and a half years of lead time before enforcement began.

What Rights Consumers Get

According to the Indiana Attorney General's own Consumer Data Protection Bill of Rights, residents can opt out of three practices that matter directly to advertisers: the sale of personal data for monetary consideration, targeted advertising based on activity tracked across unaffiliated websites or apps, and certain profiling. Consumers can also access, correct, delete, and request a portable copy of their data, and they can appeal a business's refusal to honor a request.

Targeted Advertising Gets a Specific Definition

The law defines targeted advertising narrowly as displaying an ad selected using personal data gathered from a consumer's activity over time and across nonaffiliated websites or apps to predict interests. First-party advertising based on a business's own site activity, or contextual advertising that doesn't rely on cross-site tracking, falls outside that definition — a distinction worth checking against your own ad stack before assuming you're exempt.

Enforcement Is Narrower Than It Looks

Only the Indiana Attorney General can enforce the ICDPA — there's no private right of action, so individual consumers can't sue a business directly over a violation. Before pursuing penalties, the AG must give written notice, and the business gets a 30-day window to cure the violation. If it isn't cured, the AG can seek civil penalties of up to $7,500 per violation.

How It Fits the January 2026 Wave

Indiana, Kentucky, and Rhode Island all activated comprehensive privacy frameworks on January 1, 2026, pushing the total number of states with an operative comprehensive privacy law well past a dozen. Each follows the same general Virginia-style template — opt-out rights, a cure period, AG-only enforcement — but the consumer and revenue thresholds differ slightly state to state, so clearing one state's bar doesn't automatically clear another's.

Bottom Line

If your campaigns use third-party or cross-site data to target Indiana residents and you meet the volume thresholds, confirm your opt-out mechanism and data-sale disclosures now — the 30-day cure period is a grace window for fixing a flagged violation, not a reason to wait until one gets flagged.

Sources: Indiana Office of the Attorney General, Consumer Data Protection Bill of Rights; Mondaq, "What's in the Indiana Consumer Data Protection Act"; Baker McKenzie, "Indiana Passes Comprehensive Privacy Law.