Law / United States / 
Indiana
SB 17 (2024), age verification for adult oriented websites
In force since .
An adult content age verification (AV) rule binding private bodies.
- Audit expectation
- none
What it requires
- Applies to an adult oriented website where at least one third of the content is harmful to minors.
- Use a reasonable age verification method before granting access.no control in the NIST Privacy Framework
- Do not retain a user's identifying information after verification.NIST Privacy FrameworkCT.DM-P5
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- CT.DM-P5Data are destroyed according to policy.
- NIST CSF 2.0
- ID.AM-08Systems, hardware, software, services, and data are managed throughout their life cycles
- FINOS AIGF
- AIR-DET-004AI System Observability
- AIR-DET-021Agent Decision Audit and Explainability
Our reading of where this law's duties sit in each framework, and in the NIST Privacy Framework, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
If you get it wrong
Criminal exposureNo
Private right of actionYes
Penalties
Attorney General may seek an injunction and a civil penalty up to $250,000; parents may sue for damages and attorney fees.
Penalty structure
Attorney General civil penalty of not more than $250,000 per action against a noncompliant adult oriented website, plus an injunction and the Attorney General's reasonable investigation and litigation costs.
- Rule
- Fixed only
- As of
- Currency
- USD
- Fixed cap
- 250,000
Statutory damages
A parent or guardian of a minor who accessed a website that knowingly or intentionally violated the age-verification duty may elect either actual damages or damages of up to $5,000 (a ceiling, with no stated floor), plus injunctive relief, court costs, attorney's fees, and other litigation expenses. The same election and ceiling apply to a violation of the no-retention duty (Ind. Code sec. 24-4-23-13).
- As of
- Currency
- USD
Who enforces it
Enforcement body
Indiana Attorney General
Litigation
- Court
- U.S. Court of Appeals for the Seventh Circuit
- Docket
- Free Speech Coalition, Inc. v. Rokita, No. 1:24-cv-980
- Posture
- Preliminary injunction issued , lifted by the Seventh Circuit in August 2024. Following the Supreme Court's ruling in Free Speech Coalition v. Paxton upholding Texas's materially identical law, the Seventh Circuit remanded with instructions to rule for the state.
Settledness
- As of
- Open questions
- Which databases are 'regularly used by government agencies and businesses for the purpose of age and identity verification' under IC 24-4-23-7(2), and does a service that compares an individual's identifying information against a single such database count as an 'independent third party age verification service'?
- Does a commercially reasonable method that 'relies on public or private transactional data' under IC 24-4-23-7(3) include age estimation from a facial scan or similar signals, or only records of an exchange, agreement or transfer?
What it reaches
Age threshold
18
How the hook was established
express
What makes it apply
Data subject residence
Obligation class
Age verification, Retention
Verification methods
Gov ID, Transactional data, Third party service
Applicability criteria
- As of
- Combinator
- All of
- Criteria
- a publicly accessible website that publishes material harmful to minors, if at least one-third (1/3) of the images and videos published on the website depict material harmful to minors
What it makes you log
Log retention
- As of
- Basis
- Fixed
- Prohibits retaining
- Identifying information of the person seeking access to an adult oriented website, which the person that uses an age verification method, and any third party verification service it uses, may not retain unless retention is required by a court order
Logging duty
IC 24-4-23-10 requires an adult oriented website operator to use a reasonable age verification method to prevent a minor from accessing the site. It does not require a log or record of the check, and it names no audit. Section 13 instead bars keeping identifying information, and section 16 lets the attorney general issue civil investigative demands, a power over evidence of a violation rather than over a kept record.
- Kind
- None
- As of
What this law does
Requires an adult oriented website, as the chapter defines that term, to use a reasonable age verification method before granting access, and bars retention of a user's identifying information after verification. The Attorney General or a harmed parent may sue for injunctive relief and damages.
When LexLint raises it
When your app profile says your app publishes adult content.
Back to the example · Lint your app
Page updated .