Law / United States / 
Indiana
House Enrolled Act 1360 (2026), data scraping definition and public-records anti-bot portal authorization
House Enrolled Act 1360 (2026), amending Ind. Code §§ 5-14-3, 5-14-4
In force since .
A crawl signals rule binding government bodies.
- Audit expectation
- none
What it requires
- If you send automated requests to an Indiana government public-records portal, expect the agency may require you to pass a CAPTCHA or equivalent human-verification mechanism before it processes your request.
- An Indiana agency may prioritize in-state, civic, journalistic, academic, or personal-use requesters over an out-of-state or automated requester, and may delay or surcharge a request it identifies as automated.
- An Indiana agency may report your automated requesting activity to the state Public Access Counselor if it suspects phishing or data scraping.
These lines are LexLint's reading of the law's text. Also read by: Office of the Indiana Public Access Counselor (guidance, recorded ).
Who enforces it
Settledness
- As of
- Guidance link
- https://www.in.gov/pac/files/Overview_of_APRA_Changes_under_HEA_1360.pdf
- Guidance body
- Office of the Indiana Public Access Counselor
- Open questions
- Does a requester who writes each public records request by hand but compiles the responses with an automated tool fall within 'use of an automated system to extract data from websites and other Internet accessible sources' under IC 5-14-3-2(d)?
- Does 'Internet accessible sources' in IC 5-14-3-2(d) reach a requester's automated reading of the agency's own public website?
- What makes a public records request a 'cybersecurity risk' request that an agency may deny under IC 5-14-3-3.3(b), when the code does not define cybersecurity risk?
What it makes you log
What the log must hold
Input reference, Decision basis
Logging duty
A public agency must report to the public access counselor, through a standardized mechanism the counselor prescribes, any public records request it suspects of being automated, data scraping or phishing. Within seven days of declining a request under section 3.3(b), it must also notify the counselor of the request and the reason it declined. Neither section names a log or record, so the duty is implicit: an agency cannot report a suspect request or state its reason without having kept a record of it. Section 3.3(a)(4) lets an agency's request portal track and report suspect submissions automatically, which is a permitted feature and not a duty. The counselor's own duty, under IC 5-14-4-10(8) as amended by the act, is to coordinate with public agencies to track the volume and nature of requests and identify patterns of automated, phishing or data-scraping requests; it names no examination of an agency's own record. Neither section states how long a record is kept.
- Kind
- Implicit
- As of
- Provision
- Ind. Code § 5-14-3-11 and § 5-14-3-3.3(c), as added by P.L.97-2026
- Trigger
- crawl_access
Why the legislator wanted it
The Office of the Public Access Counselor presents the agency reports as the input to the counselor's tracking of automated, phishing and data-scraping requests.
- As of
- Quote
- Specifically, the counselor must track the number and type of requests received and flag patterns tied to automation, phishing, or data scraping. IC 5-14-4-10(8). To support this, public agencies must report certain information to OPAC throughout the year and submit a full annual report each June.
- Source link
- https://www.in.gov/pac/files/Overview_of_APRA_Changes_under_HEA_1360.pdf
- Source kind
- Regulator guidance
- Purpose
- regulator_supervision
What this law does
House Enrolled Act 1360 adds new IC 5-14-3-2(d), defining data scraping to mean use of an automated system to extract data from websites and other Internet accessible sources. New IC 5-14-3-3.3 authorizes, but does not require, a public agency to build a records-request portal using a CAPTCHA or an equivalent mechanism for ensuring that a requestor is a human, to require verification of a requestor's physical address, and to have the portal indicate whether the requestor is an Indiana resident.
New IC 5-14-3-8.1 lets an agency give priority to Indiana residents and to civic, journalistic, academic, or personal-use requests, while delaying or surcharging requests identified as originating from out-of-state entities or automated systems. New IC 5-14-3-11 requires an agency to report suspected automated, phishing, or data-scraping requests to the state Public Access Counselor through a standardized mechanism. The enrolled act carries a effective date on every section.
When LexLint raises it
When your app profile says your app crawls the web.
Back to the example · Lint your app
Page updated .