Law / United States / 
Indiana
HEA 1408 (2026), social media accounts held by minors
A social media and minors rule binding private bodies.
- Age threshold
- 16
- How the hook was established
- express
- What makes it apply
- Data subject residence
- Verification methods
- Parental consent, Third party service, Self declaration
- Audit expectation
- none
What it requires
- Determine whether a user is an Indiana resident under 16.no control in the NIST Privacy Framework
- Obtain verifiable parental consent before creating an account for such a user.NIST Privacy FrameworkCT.PO-P1
- Configure the account of a user you know or have reason to know is an Indiana resident under 16 so that it cannot receive direct communications except from a linked account, cannot appear in search results except to a linked account, and cannot be shown content, recommendations, or advertising based on the user's patterns of use or the addictive features.NIST Privacy FrameworkCT.PO-P1
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- CT.PO-P1Policies, processes, and procedures for authorizing data processing (e.g., organizational decisions, individual consent), revoking authorizations, and maintaining authorizations are established and in place.
Our reading of where this law's duties sit in each framework, and in the NIST Privacy Framework, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
Who enforces it
Enforcement body
Indiana Attorney General
Settledness
- As of
- Open questions
- How is the average of 'two (2) hours per day or longer' computed for 'daily active users who are less than sixteen (16) years of age' under IC 24-16-2-5(a)(2), when the service may not know which of its users are under sixteen?
- Does a service 'function primarily to enable registered users to upload content, or access content uploaded or shared by other registered users' under IC 24-16-2-5(a)(1) when uploading and viewing user content is one function among several, as in a video, gaming or messaging service?
What it makes you log
Log retention
- As of
- Basis
- Fixed
- Prohibits retaining
- Information received from an individual to provide verifiable parental consent, which must be deleted immediately after registering the consent, except as needed to comply with another state or federal law or regulation
Logging duty
IC 24-16-3-1 and 24-16-4 require a social media provider to determine a user's age and residence with commercially reasonable means and to re-estimate age at set usage thresholds. Neither names a log or record of those determinations, and the article names no audit. Chapter 5 instead limits use of the information collected to register a parent's consent and requires its deletion immediately afterward.
- Kind
- None
- As of
What this law does
The act adds Indiana Code article 24-16 and binds a social media provider, defined as an online forum, website, or application that functions primarily to let registered users upload or access content, uses algorithms to select content for users, has an addictive feature such as continuously loading content or autoplay video, has a user base in which ten percent or more of the daily active users under 16 spend an average of two hours per day or longer on it, and is owned or operated by a person that generated at least one billion dollars in gross revenues worldwide in one or more of the three preceding years.
A provider that receives an account request from an Indiana resident must use commercially reasonable means, such as a neutral age screen, to determine the individual's age and state of residence, and may create the account of an individual under 16 only with verifiable parental consent from a parent or legal guardian.
The provider must configure the account of a registered user it knows or has reason to know is an Indiana resident under 16 so that the account cannot receive direct communications except from a linked account, cannot appear in search results except to a person holding a linked account, and cannot be shown content, recommendations, or advertising based on the adolescent's patterns of use, or the addictive features, and the adolescent may not change or bypass that configuration.
When LexLint raises it
When your app profile says your app operates a social platform.
Back to the example · Lint your app
Page updated .