Despite Congress’ failure to enact a national privacy law, several states have implemented their own privacy rules. Just this year, five states — including Indiana — have enacted their own law.
Nonetheless, it is important to note that not all of these state-level laws effectively uphold individuals’ privacy rights. Regrettably, the Hoosier state’s recently passed privacy law is among those.
When Senate Enrolled Act 5 raced out of the Indiana General Assembly last month, legislators took a victory lap, touting its passage as a momentous step forward for the privacy of Hoosiers. Narrowly construed, this is true. Beginning in 2026 consumers in Indiana will gain new data rights, including the right to access, correct, and delete certain personal information collected and processed by certain businesses, as well as the right to opt-out of certain disclosures of their personal data.
But a closer look reveals Indiana’s new privacy law does not actually put substantive restrictions on how businesses track and sell consumers’ personal information. Instead, it requires consumers to embark on the privacy equivalent of the game Crazy Taxi, zig-zagging wildly across the Internet if they want to protect themselves.
That’s because the bill requires that consumers “opt-out” if they do not want businesses to sell their information or target personalized advertisements to them. As a result, consumers who don’t want to be tracked across the Internet have to individually contact hundreds, if not thousands, of different companies to assert their new privacy rights. Many other state privacy laws include a universal opt-out provision, which allows consumers to opt-out of all data sales and targeted advertising with just one click. But Senate Enrolled Act 5 doesn’t have it.
The legislation also includes a number of loopholes that throttle its protections.
Under this bill, businesses like Facebook can argue that they “share” your personal information with third-parties, rather than “sell” it, to avoid honoring opt-out requests. Businesses can also still target advertisements to consumers even after they opt-out, so long as the advertisements are based on the business’ own data collection or data from one other source. That’s cold comfort, considering how much enormous tech companies like Google and Facebook know about us already.
Perhaps worst of all, companies can charge consumers extra or lower the quality of their offerings if consumers exercise their opt-out right. What kind of a right allows a business to discriminate against a consumer for using it?
Then, of course, comes the question of enforcement. Rather than allowing consumers to have their day in court with businesses that blatantly ignore the requirements of this new law, Senate Enrolled Act 5 expressly denies them that opportunity. Instead the law reserves such authority for the Attorney General’s Office, who is only allowed to bring cases after it allows business to “cure” compliance errors with no penalty. Few other laws contain such limitations on consumer redress.
It’s all enough to make one blow a gasket. But it’s not entirely surprising. If you look at who in Indiana is supporting the new law it gives a strong impression of the fox volunteering to guard the henhouse. Aside from its Big Tech proponents, public supporters of the bill included Salesforce, the Indiana Technology and Innovation Association, and the Indiana Chamber of Commerce.
If there is any silver lining here, it is that the legislature has plenty of time and potential sources of inspiration to fix this law before it goes into effect in two and half years.
Matt Schwartz is a Policy Analyst at Consumer Reports. This commentary previously appeared at indianacapitalchronicle.com. Send comments to [email protected].
