Privacy laws are famous for two things: long titles and the magical ability to make normal people feel like they accidentally opened a 300-page appliance warranty. Indiana’s Consumer Data Protection Act, or CDPA, could have gone down that same road. Instead, Indiana’s Consumer Data Protection Bill of Rights does something surprisingly helpful: it translates the law into plain English and tells Hoosiers what their data rights actually look like in real life.
That matters because personal data is no longer some abstract tech-world buzzword. It is your shopping history, location data, email address, health-related details, browsing patterns, and the little digital crumbs you leave behind every time you click, stream, swipe, or abandon a cart at the last second. Indiana’s CDPA gives residents more control over that information and puts real obligations on certain businesses that collect and use it.
In other words, the law is not trying to cancel the internet. It is trying to stop the internet from acting like your personal information is free office candy.
What the Indiana CDPA Actually Is
Indiana’s Consumer Data Protection Act is the state’s comprehensive consumer privacy law. It took effect on January 1, 2026, and it applies to certain businesses that do business in Indiana or target products or services to Indiana residents. The law gives consumers a set of rights over their personal data and requires covered businesses, called “controllers,” to handle that data more responsibly.
The Indiana Attorney General’s Consumer Data Protection Bill of Rights is especially useful because it organizes those protections in a way regular people can actually understand. Instead of dumping a pile of statutory language on your kitchen table and wishing you luck, the Bill of Rights frames Indiana privacy protections around practical ideas: the right to know, the right to control, the right to protect, and the right to take action.
That structure turns the CDPA from a legal puzzle into something closer to a user manual. And honestly, every privacy law should come with one of those.
Who the Law Covers and Why That Matters
Consumers Covered by the CDPA
The Indiana CDPA protects Indiana residents acting in a personal, family, or household context. That means the law is aimed at ordinary consumer activity, not every scrap of data in every possible setting. If someone is acting as an employee or in a commercial context, they are generally outside the definition of “consumer” for purposes of this law.
That distinction is important. The CDPA is not a catch-all rule for all business information, all workplace information, and all human activity from dawn to bedtime. It is a consumer privacy law, and it stays in that lane.
Businesses Covered by the CDPA
The law does not apply to every mom-and-pop shop with a newsletter signup box and a dream. Generally, it applies to businesses that either control or process the personal data of at least 100,000 Indiana consumers in a calendar year, or control or process the personal data of at least 25,000 Indiana consumers while deriving more than 50% of gross revenue from the sale of personal data.
That threshold tells you a lot about Indiana’s approach. The state is aiming at organizations with meaningful data footprints, especially those making serious use of consumer information as part of their business model. Small businesses are not automatically off the hook on good privacy hygiene, but not all of them fall under this statute.
The law also includes notable exemptions. Indiana’s own guidance highlights exemptions for state entities, certain contractors acting for the state, financial institutions, HIPAA-covered entities, nonprofits, higher education institutions, and public utilities. So yes, the law is broad, but it is not trying to swallow the entire universe in one bite.
The Bill of Rights Turns Legal Jargon Into Real Rights
The best thing about Indiana’s Bill of Rights is that it makes the CDPA feel less like a secret society and more like a usable set of protections. Here is what those rights mean in everyday terms.
The Right to Know
Indiana residents have the right to confirm whether a covered business is processing their personal data. They also have the right to obtain a copy, or a representative summary, of personal data they previously provided to the business. The law also expects businesses to provide a reasonably accessible, clear, and meaningful privacy notice that explains how data is collected, used, shared, and disclosed.
This matters because privacy problems often start with confusion. People do not know what was collected, why it was collected, how long it is kept, or whether it was passed around like a plate of party snacks. The right to know is meant to fix that.
The Right to Control
Consumers can ask covered businesses to correct inaccuracies in personal data they previously provided. They can also request deletion of personal data, subject to certain exceptions, and ask for their data in a portable format that can be transferred without much drama.
This is where the CDPA stops being theoretical and starts being useful. If a company has the wrong email, wrong address, wrong account detail, or outdated information tied to you, correction matters. If you are done with a service and want your data deleted, deletion matters. If you want to move from one provider to another without being trapped in a digital hostage situation, portability matters.
The Right to Protect
This is the part people usually care about most, and for good reason. Indiana consumers can opt out of the processing of personal data for targeted advertising, the sale of personal data, and certain profiling activities. If a business uses your information to aim ads at you based on activity across nonaffiliated sites or apps, Indiana says you get a say. If the business sells personal data for monetary consideration, you get a say there too.
The law also gives special treatment to sensitive data. Sensitive data includes information such as racial or ethnic origin, religious beliefs, mental or physical health diagnosis, sexual orientation, citizenship or immigration status, identifying genetic or biometric data, precise geolocation, and the personal data of a known child. Indiana generally requires opt-in consent before covered businesses process that kind of data.
That is a major point. For ordinary data, many privacy laws rely on opt-out rights. For sensitive data, Indiana raises the bar. Businesses are expected to get consent first, not forgiveness later.
The Right to Take Action
If a controller refuses a valid request, the consumer has the right to appeal. Indiana’s guidance says the appeal process should be easy to access and similar to the method the consumer used for the original request. Consumers are entitled to receive a decision on the appeal within 60 days.
The CDPA also bars discrimination against consumers who exercise their rights. A covered business cannot punish someone for making a privacy request by denying goods or services, charging different prices in a way the law prohibits, or providing a lower quality of service just because the person chose to use their legal rights.
And if that still does not solve the problem, Indiana residents can file a complaint with the Attorney General. The Bill of Rights makes that next step clear, which is exactly what a good public-facing guide should do.
How Long Businesses Have to Respond
The response timeline is one of the most practical parts of the law. A covered business generally must respond to a consumer request without undue delay and no later than 45 days after receiving it. The law allows one 45-day extension when reasonably necessary, but the consumer has to be told within the original response period.
So, no, a company cannot toss your request into a mysterious corporate canyon and answer six months later with, “Oops, just saw this.” Indiana expects movement.
If a request is denied, the business must explain why and provide instructions on how to appeal. That detail matters because rights with no process are basically decorative.
What Businesses Must Do Under the Indiana CDPA
Indiana’s law is not just a list of consumer wishes taped to a refrigerator. It places concrete obligations on covered businesses.
Provide a Clear Privacy Notice
Controllers must provide a reasonably accessible, clear, and meaningful privacy notice. That notice should explain the categories of personal data collected, the purposes for processing, how consumers can exercise their rights, the categories of personal data shared with third parties, and the categories of those third parties.
If a business sells personal data or uses it for targeted advertising, that also has to be clearly disclosed. Translation: no hiding the weird stuff in microscopic gray text at the bottom of a 9,000-word policy no human has ever read voluntarily.
Practice Data Minimization and Purpose Limitation
Indiana’s framework follows the familiar privacy principle that businesses should collect only data that is adequate, relevant, and reasonably necessary for the disclosed purpose. They also should not process personal data for purposes that are incompatible with those disclosed purposes unless they obtain consent.
This sounds technical, but the idea is simple. If a company needs your email to send a receipt, that does not magically give it permission to build a sprawling profile of your habits, preferences, location, and 2 a.m. snack choices.
Use Reasonable Security Practices
Covered businesses are expected to maintain reasonable administrative, technical, and physical data security practices. Privacy compliance is not just about putting pretty words in a notice. It is also about protecting the data once you have it.
That is a big deal because a privacy policy that promises respect while your security program is held together by metaphorical duct tape is not much of a privacy program.
Sign Contracts With Processors
When a controller uses a processor, such as a vendor, service provider, cloud platform, or outside technology partner, the law requires a binding contract that sets out processing instructions, purpose, data type, duration, and responsibilities. Indiana is basically saying, “If someone else touches the data, put the rules in writing.” Which is good advice in privacy law and in life.
Conduct Data Protection Assessments
The CDPA requires data protection assessments for certain higher-risk processing activities, including targeted advertising, sale of personal data, processing sensitive data, and certain profiling activities that could present heightened risks. This is one of the clearest signs that Indiana expects businesses to think before they process, not just process first and schedule a panic meeting later.
Examples of How the CDPA Works in Real Life
Example 1: The Online Retailer
An Indiana resident shops for hiking boots online. Later, ads for hiking boots, hiking socks, hiking snacks, and apparently hiking-themed emotional support products start following them across other websites. Under the CDPA, if the retailer is covered, the consumer may have the right to opt out of targeted advertising tied to that behavior.
Example 2: The Fitness App
A wellness app tracks precise geolocation and biometric information to power certain features. Because that information can qualify as sensitive data, the app may need opt-in consent before processing it. That changes the compliance conversation from “Did we mention this somewhere?” to “Did we actually get valid consent?”
Example 3: The Automated Decision Tool
A company uses profiling to support important decisions tied to lending, housing, insurance, education, or employment-related outcomes. Indiana gives consumers opt-out rights around certain profiling activities, especially where automated decisions could have legal or similarly significant effects.
Example 4: The Parent Request
A parent wants to act on behalf of a child under 13 whose data is being processed by an online platform. Indiana’s Bill of Rights makes clear that parents or guardians can exercise rights on behalf of their children, and the processing of a known child’s sensitive data requires the proper level of consent.
What the Indiana CDPA Does Not Do
Good privacy analysis is not only about what a law includes. It is also about what it does not include.
First, the CDPA does not create a private right of action. Consumers generally cannot sue directly under the statute just because they believe a business violated it. Enforcement belongs to the Indiana Attorney General.
Second, Indiana provides a 30-day cure period. That means the Attorney General must generally give notice and an opportunity to cure before bringing an enforcement action. Businesses should not treat that as a free pass, but it does make the law more business-manageable than some stricter privacy regimes.
Third, Indiana does not require recognition of a universal opt-out mechanism. That is a meaningful difference from some other state privacy laws. So while Indiana gives residents opt-out rights, it does not currently force covered businesses to recognize a universal browser-based signal as the required method.
And finally, the CDPA does not create one magic delete button that wipes your information from every company in America at once. Indiana’s own guidance points out that consumers generally must submit requests to each company individually. Privacy law can be powerful, but it is not a wizard.
Why the Bill of Rights Is So Helpful for Consumers and Businesses
The raw statute is important, but the Bill of Rights is where the law becomes usable. Consumers get a plain-language roadmap for exercising rights. Businesses get a clearer picture of the expectations they have to meet. That public guidance helps reduce the classic privacy-law problem where everyone agrees “data rights matter,” but nobody is quite sure what button to click, what email to send, or what internal team actually owns the process.
For businesses, the Bill of Rights is also a warning label in the best sense. It shows exactly what regulators want consumers to understand. That means if your request process is clunky, your privacy notice is vague, or your consent flow is shaky, Indiana has already made it easier for consumers to spot the problem.
For consumers, the guidance turns privacy rights into something you can actually use after your coffee, not only after three semesters of law school.
Extended Practical Experience: What Living With Indiana’s CDPA Actually Feels Like
In practice, the experience of Indiana’s CDPA is less dramatic than headlines suggest and more operational than many people expect. For consumers, the first real encounter with the law often starts with a privacy notice, a cookie banner, or an account settings page that suddenly offers clearer choices. A person might realize a retailer knows too much, a health app is collecting more than expected, or a company has made it weirdly hard to update or delete account information. The CDPA turns that frustration into a process.
Usually, the first step is not a courtroom scene with dramatic music. It is a request form, an email address, or a portal. The consumer asks for access, correction, deletion, or an opt-out. The company may verify identity, which can feel slightly annoying but is also part of protecting the request from misuse. Then the waiting starts. Ideally, the response is organized, readable, and complete. Less ideally, it reads like it was drafted by a committee trapped in a beige conference room with only stale coffee and liability fears.
For businesses, the experience is even more revealing. Marketing teams discover that “targeted advertising” is not just a friendly growth strategy; it can trigger opt-out rights and assessment duties. Product teams learn that precise geolocation and biometric tools are not merely cool features; they may involve sensitive data and consent requirements. Legal teams learn, once again, that if nobody knows where the data lives, no one can answer a rights request with confidence. Privacy compliance suddenly stops being a side quest and becomes an operations project.
There is also a human experience behind the law that often gets overlooked. Parents may use the CDPA to understand how a platform handles their child’s data. Consumers who have been denied credit, filtered by profiling systems, or flooded with personalized ads may finally realize they are not powerless. Businesses that genuinely want to earn trust may find that clearer notices and smoother request handling improve customer confidence rather than hurt it.
And that may be the most practical lesson of all. Indiana’s CDPA is not just about penalties and checklists. It changes the daily experience of digital trust. A company that explains what it collects, respects sensitive information, answers requests on time, and offers real choices feels different from one that acts like privacy is an obstacle to be hidden behind a pop-up and a prayer. Over time, that difference becomes visible to consumers. The companies that treat privacy like a real relationship issue tend to build more trust. The ones that treat it like a legal speed bump usually end up with a bigger headache, a smaller reputation, and a much longer meeting with counsel.
Conclusion
Indiana’s Consumer Data Protection Bill of Rights does something valuable: it explains the CDPA in human language without watering down the law’s impact. Indiana residents get real rights to know, access, correct, delete, opt out, appeal, and protect sensitive data. Covered businesses get a clear message that privacy compliance means more than posting a policy and hoping nobody scrolls.
The bottom line is simple. Indiana’s CDPA is not the wildest privacy law in America, but it is a meaningful one. It gives Hoosiers more control, expects businesses to be more transparent, and makes data practices easier to challenge when they cross the line. That is a pretty solid upgrade for the digital age.
