Indiana Consumer Data Protection Act, sensitive data and biometric data definitions

Ind. Code §§ 24-15-2-4, 24-15-2-28, 24-15-4-1(5)

A citation is an address, not a summary. The first part names the law; what follows narrows it to the exact section, article or paragraph.

What follows is LexLint's own research summary of this law, not legal advice.

In force 9 months, effective 1 January 2026.

A sensitive categories rule binding private bodies.

As of 27 August 2026.

What it requires

Obtain an Indiana consumer's consent before processing sensitive data, including genetic or biometric data collected to uniquely identify the individual, or process a known child's sensitive data only under COPPA's consent framework.
Do not treat an identifier derived solely from a photograph, video, or audio recording as INCDPA biometric data. The definition excludes any data generated from such a recording, with no exception for data generated to identify someone.
Treat a voiceprint or faceprint captured directly, for example from a live biometric scanner, as sensitive data requiring consent, and treat one extracted from a recording as ordinary personal data instead.

What it reaches

Excludes recording-derived identifiersYes

What this law does

Drafted with AI from the cited sources under the direction of UnGovr staff. UnGovr holds editorial responsibility for this page.

INCDPA classifies racial or ethnic origin, religious belief, a health diagnosis made by a health care provider, sexual orientation, citizenship or immigration status, genetic or biometric data processed to uniquely identify a specific individual, a known child's data, and precise geolocation data as sensitive data requiring the consumer's consent before processing, except that a known child's sensitive data may instead be processed under COPPA's consent framework.

'Biometric data' means data from automatic measurement of an individual's biological characteristics used to identify them, such as a fingerprint, voiceprint, or retina or iris image, but the definition carries a blanket, unconditional exclusion for a physical or digital photograph, a video or audio recording, or any data generated from either, with no clawback for data generated to identify someone.

A faceprint or voiceprint extracted from a recording therefore falls outside both biometric data and sensitive data under Indiana law, regardless of the purpose for which it was extracted; only a biometric identifier captured directly, such as from a live scanner, triggers this consent duty.

When LexLint raises it

processes_biometrics
processes_voice
crawls_web
trains_models

Read the law

official Indiana statute text, Indiana Code Article 15, Indiana General Assembly

Every line above is drawn from the primary source linked here, read on the date shown. This is a research summary, not legal advice.

Back to the example · Lint your app