Indiana Consumer Data Protection Act (INCDPA)
A practical compliance guide for website owners. Learn what Indiana's privacy law requires and how to implement it on your site.
Who Must Comply
Conducts business in Indiana or targets Indiana residents AND controls/processes personal data of 100K+ consumers, OR controls/processes data of 25K+ consumers and derives 50%+ of gross revenue from selling personal data
What Your Website Must Do
| Requirement | Status |
|---|---|
| Cookie consent banner | Recommended |
| Do Not Sell link | Required |
| Do Not Share link | Not required |
| Honor GPC browser signals | Recommended |
| Universal opt-out mechanism | Not required |
| Sensitive data opt-in consent | Required |
Required Links & Notices
The INCDPA requires the following links or notices to be visible on your website:
- 1Privacy Policy
Enforcement & Penalties
Key Things to Know
Indiana's privacy law takes effect January 1, 2026, giving businesses time to prepare. It follows the Virginia model with standard opt-out rights for targeted advertising and sale of personal data.
Permanent cure period: Like Utah and Iowa, Indiana maintains a permanent 30-day cure period that does not sunset. This makes it one of the more business-friendly state privacy laws.
Standard thresholds: Indiana uses the common 100K consumer / 25K consumer + 50% revenue thresholds seen in many state laws.
How to Configure LegalBanner for INCDPA
- 1
Create your site
Sign up for free and add your website domain in the dashboard.
- 2
Set consent mode to "Opt-out"
In Settings, select the consent mode that matches Indiana's requirements.
- 3
Install the snippet
Add the one-line script tag to your website. The banner, opt-out links, and GPC support are automatic.
- 4
Generate your Privacy Policy
Use the built-in policy wizard to generate a INCDPA-compliant privacy policy.
Set up INCDPA compliance in 5 minutes
LegalBanner handles Indiana privacy requirements automatically — cookie banner, opt-out links, and GPC support included.
Frequently Asked Questions
When does the Indiana INCDPA take effect?
The INCDPA takes effect January 1, 2026. Businesses should begin preparing now to ensure compliance by the effective date.
Does Indiana require a cookie consent banner?
No. Indiana does not require opt-in cookie consent. You must provide opt-out mechanisms for targeted advertising and sale of personal data.
Does Indiana require honoring GPC signals?
No. Indiana does not require businesses to honor GPC or universal opt-out mechanisms.
What are the penalties for INCDPA violations?
Up to $7,500 per violation, enforced by the Indiana Attorney General. There is a permanent 30-day cure period.
How does Indiana compare to other state privacy laws?
Indiana is similar to Virginia and Iowa — moderate consumer rights, no GPC requirement, permanent cure period. It is more business-friendly than California, Colorado, or Connecticut.