Indiana’s new privacy law is not road ready

Despite Congress’ failure to enact a national privacy law, several states have implemented their own privacy rules. Just this year, five states — including Indiana — have enacted their own law.

Nonetheless, it is important to note that not all of these state-level laws effectively uphold individuals’ privacy rights. Regrettably, the Hoosier state’s recently-passed privacy law is among those.

When Senate Enrolled Act 5 raced out of the Indiana General Assembly last month, legislators took a victory lap, touting its passage as a momentous step forward for the privacy of Hoosiers. Narrowly construed, this is true. Beginning in 2026 consumers in Indiana will gain new data rights, including the right to access, correct, and delete certain personal information collected and processed by certain businesses, as well as the right to opt-out of certain disclosures of their personal data.

But a closer look under the hood reveals Indiana’s new privacy law does not actually put substantive restrictions on how businesses track and sell consumers’ personal information. Instead, it requires consumers to embark on the privacy equivalent of the game Crazy Taxi, zig-zagging wildly across the Internet if they want to protect themselves.

That’s because the bill requires that consumers “opt-out” if they do not want businesses to sell their information or target personalized advertisements to them. As a result, consumers who don’t want to be tracked across the Internet have to individually contact hundreds, if not thousands, of different companies to assert their new privacy rights. Many other state privacy laws include a universal opt-out provision, which allows consumers to opt-out of all data sales and targeted advertising with just one click. But Senate Enrolled Act 5 doesn’t have it.

The legislation also includes a number of loopholes that throttle its protections.

Loopholes

Under this bill, businesses like Facebook can argue that they “share” your personal information with third-parties, rather than “sell” it, to avoid honoring opt-out requests. Businesses can also still target advertisements to consumers even after they opt-out, so long as the advertisements are based on the business’ own data collection or data from one other source. That’s cold comfort, considering how much enormous tech companies like Google and Facebook know about us already.

Perhaps worst of all, companies can charge consumers extra or lower the quality of their offerings if consumers exercise their opt-out right. What kind of a right allows a business to discriminate against a consumer for using it?

Then, of course, comes the question of enforcement. Rather than allowing consumers to have their day in court with businesses that blatantly ignore the requirements of this new law, Senate Enrolled Act 5 expressly denies them that opportunity. Instead the law reserves such authority for the Attorney General’s Office, who is only allowed to bring cases after it allows business to “cure” compliance errors with no penalty. Few other laws contain such limitations on consumer redress.

It’s all enough to make one blow a gasket. But it’s not entirely surprising.

The legislation largely follows the lead of Virginia’s privacy law. That law has some important protections, but it fails to give consumers the practical options they need to exercise their rights, thanks to pressure from industry lobbyists. And if you look at who in Indiana is supporting the news law it gives a strong impression of the fox volunteering to guard the henhouse. Aside from its Big Tech proponents, public supporters of the bill included Salesforce, the Indiana Technology and Innovation Association, and the Indiana Chamber of Commerce. The strategy is clear: pass weak legislation to preempt any stronger efforts from gaining traction.

If there is any silver lining here, it is that the legislature has plenty of time and potential sources of inspiration to fix this law before it goes into effect in two and half years.

Last year, a bipartisan group of legislators in Congress negotiated the American Data Privacy and Protection Act, which, though it did not make it to the finish-line, would do a far better job of protecting consumers than Senate Enrolled Act 5. On the state level, existing laws in California, Connecticut, Colorado, and Montana, as well as Consumer Reports’ own Model Bill, all contain stronger protections that Indiana lawmakers could borrow from.

Hoosiers concerned about their privacy and the power of Big Tech should urge lawmakers to use their long pit-stop to soup up the law before it goes into effect. As of now, this vehicle barely has enough horsepower to get off the lot.