Indiana CDPA requirements
Indiana's law took effect January 1, 2026 and closely tracks Virginia's. It applies to controllers handling data on 100,000 Indiana consumers, or 25,000 where more than half of revenue comes from selling personal data. Consumers may opt out of targeted advertising, sale, and profiling, and controllers need opt-in consent for sensitive data. There is no requirement to honor browser-level opt-out signals and no private right of action. The Attorney General enforces, with a permanent 30-day cure period and civil penalties of up to $7,500 per violation. For companies already compliant in Virginia the incremental work is small, provided the opt-out link on the site actually stops the tags it claims to control.
Indiana CDPA articles and analysis
IAB Multi-State Privacy Agreement (MSPA) Update 2026: What Advertisers Need to Know
A report out of Carnegie Mellon’s School of Public Policy found that “87% (216 million of 248 million) of the population in the United States...
Read More
U.S. Privacy Laws (and Key Provisions) That Take Effect or Become Enforceable in 2026
2026 is a turning point in U.S. privacy regulation: multiple new comprehensive state laws go live, enforcement provisions activate, and novel mechanisms (like the California...
Read More
Other US State Privacy Laws
See what your sites and apps actually send
Get a free site analysis: every tracker, mapped to the laws that apply to it.