Indiana

Indiana's child-exploitation statute defines "image" to include a computer-generated image, and separately reaches simulated sexual conduct involving a representation that appears to be a child under eighteen, where the representation is obscene, without requiring that the child depicted actually exist.

Producing, disseminating, or possessing with intent to disseminate such an image is child exploitation, a Level 5 felony (a Level 4 felony on aggravating circumstances such as the depicted conduct including force or a victim under twelve), and knowingly possessing or accessing such an image is possession of child pornography, a Level 6 felony (a Level 5 felony on the same aggravating circumstances).

This reaches an AI-generated depiction of a fictional child in an obscene sexual context on the same terms as any other computer-generated image; the statute's own code history shows its most recent amendment in 2022, predating the current wave of AI-specific legislation, and the calendar date on which the simulated-image and computer-generated-image language quoted here first took effect is not confirmed.

House Enrolled Act 1047 amended the definition of "intimate image" that runs through both Indiana's criminal distribution-of-an-intimate-image statute and its civil nonconsensual-pornography-disclosure statute to include a photograph, digital image, or video of a person that was created or modified by a computer software program, artificial intelligence, application, or other digital editing tool, so that an AI-generated or AI-altered depiction of a real, identifiable person in an intimate context is treated the same as an authentic one.

Distributing such an image without the depicted person's consent, when the distributor knows or reasonably should know the person does not consent, is a Class A misdemeanor, elevated to a Level 6 felony on a prior unrelated conviction.

A depicted individual who is identifiable and suffered harm may separately bring a civil action for disclosing nonconsensual pornography, recovering the greater of actual and emotional-distress damages or statutory damages up to $10,000 per defendant, plus any of the defendant's monetary gain, punitive damages, attorney's fees, and injunctive relief. Both amendments took effect July 1, 2024 under the act's own effective-date clause.

If a campaign communication includes fabricated media, meaning audio, video, or an image that has been altered or artificially generated to convey a materially inaccurate depiction of a candidate that a reasonable person would not recognize as altered, the person who paid for the communication must include a disclaimer stating that elements of the media have been digitally altered or artificially generated.

The disclaimer requirements vary by medium: a printed or video disclaimer must be displayed continuously, and an audio disclaimer must be read at the start, the end, and every two minutes for a communication longer than two minutes.

A candidate depicted in noncompliant fabricated media may bring a civil action against the person who paid for or sponsored the communication, and against a disseminator who knowingly, intentionally, or recklessly removed the disclaimer, for actual damages, injunctive relief, and attorney's fees, on a clear-and-convincing-evidence standard.

The enrolled act declared an emergency and took effect upon passage; the Indiana General Assembly's own bill-actions record shows the Governor signed it March 12, 2024.

A data base owner must disclose a breach of the security of a system to an affected Indiana resident if the owner knows, should know, or should have known that the unauthorized acquisition has resulted in or could result in identity deception, identity theft, or fraud affecting that resident, without unreasonable delay and no later than 45 days after discovering the breach.

A data base owner disclosing to more than 1,000 consumers must also notify nationwide consumer reporting agencies, and any disclosure at all triggers a required notice to the Indiana Attorney General.

Failing to make a required disclosure is a deceptive act actionable only by the Attorney General, with a civil penalty of up to $150,000 per deceptive act, and a separate, narrower duty to implement reasonable safeguards and dispose of records properly carries its own $5,000-per-act penalty, also enforced only by the Attorney General. This is a separate, pre-existing statute from INCDPA. The cited sections were added by P.L.125-2006, Securities and Exchange Commission (SEC).6, and have since been amended piecemeal: Ind.

Code sections 24-4.9-3-1 and 24-4.9-4-1 by P.L.137-2009, and section 24-4.9-3-3 by P.L.171-2022; section 24-4.9-4-2 has not been amended since 2006. Indiana's codified history notes carry only a public-law-and-year citation, with no day-precise commencement date, so no effective date is recorded here.

INCDPA governs private-sector processing of Indiana residents' personal data. It applies to a person conducting business in Indiana, or producing a product or service targeted to Indiana residents, that during a calendar year controls or processes the personal data of at least 100,000 Indiana consumers, or of at least 25,000 Indiana consumers while deriving more than 50 percent of gross revenue from selling personal data.

A controller must limit collection to what is adequate, relevant, and reasonably necessary for the purposes disclosed to the consumer, and may not process personal data for an incompatible purpose without the consumer's consent. Article 15 also preempts local law: no city, county, or other local government may regulate a controller's or processor's processing of personal data.

INCDPA gives an Indiana consumer the right to confirm and access their personal data, correct inaccuracies, delete data, obtain a portable copy, and opt out of targeted advertising, the sale of personal data, and profiling that produces a legal or similarly significant effect, exercisable against the controller.

A controller must respond without undue delay and no later than 45 days after receipt, with one additional 45-day extension available when reasonably necessary, and must inform the consumer of a decline and the means to appeal it on the same 45-day timeline. This is the ordinary 45-plus-45 response model used across most states, not the shortened timeline Florida uses.

The Indiana Attorney General has exclusive authority to enforce INCDPA, with a civil penalty of up to $7,500 per violation plus recoverable investigation expenses. Before suing, the Attorney General must give a controller or processor 30 days' written notice identifying the specific provisions violated; if the violation is cured within that period and the controller or processor provides a written attestation of the cure, the Attorney General may not initiate an action.

This cure right is mandatory, not discretionary, and carries no sunset date anywhere in Article 15, unlike Maryland's, New Jersey's, and Minnesota's time-limited or discretionary cure provisions. The chapter creates no private right of action.

INCDPA classifies racial or ethnic origin, religious belief, a health diagnosis made by a health care provider, sexual orientation, citizenship or immigration status, genetic or biometric data processed to uniquely identify a specific individual, a known child's data, and precise geolocation data as sensitive data requiring the consumer's consent before processing, except that a known child's sensitive data may instead be processed under COPPA's consent framework.

'Biometric data' means data from automatic measurement of an individual's biological characteristics used to identify them, such as a fingerprint, voiceprint, or retina or iris image, but the definition carries a blanket, unconditional exclusion for a physical or digital photograph, a video or audio recording, or any data generated from either, with no clawback for data generated to identify someone.

A faceprint or voiceprint extracted from a recording therefore falls outside both biometric data and sensitive data under Indiana law, regardless of the purpose for which it was extracted; only a biometric identifier captured directly, such as from a live scanner, triggers this consent duty.

Section 35-43-2-3(b) provides that a person who knowingly or intentionally accesses a computer system, computer network, or any part of either without the consent of the owner or the owner's licensee commits computer trespass, a Class A misdemeanor. This is phrased as lack of the owner's consent, a single-prong test with no separate exceeds authority prong, closer in structure to several peer states' single-prong wording though those use authorization rather than consent as the operative noun.

The same chapter separately punishes, at section 35-43-1-8, knowing and intentional unauthorized disruption or denial of computer system services. No Indiana appellate decision squarely construes section 35-43-2-3 against a scraper of an open public page.

IC 24-15-2-19(b) defines personal data to exclude de-identified data, aggregate data, or publicly available information.

IC 24-15-2-26 defines publicly available information as information that is lawfully made available through federal, state, or local government records, or that a business has a reasonable basis to believe is lawfully made available to the general public through widely distributed media, by the consumer to whom the information pertains, or by a person to whom the consumer has disclosed it, the same three-way structure several peer states use.

As in those states, the exemption excludes scraped government-record and public-media personal data from the statute's scope by definition rather than by carve-out. IC 24-15-1-1(a)(1) applies the Act to a person conducting business in Indiana or targeting Indiana residents that, during a calendar year, controls or processes personal data of at least 100,000 consumers. Enforcement is Attorney-General-only; there is no private right of action.

A data base owner, a person that owns or licenses computerized data including personal information of an Indiana resident, must implement and maintain reasonable procedures, including taking any appropriate corrective action, to protect and safeguard that personal information from unlawful use or disclosure.

A data base owner must also not dispose of or abandon records or documents containing unencrypted and unredacted personal information of Indiana residents without shredding, incinerating, mutilating, erasing, or otherwise rendering it illegible or unusable. A data base owner that maintains its own data security procedures under a listed federal privacy or security regime, and complies with that regime's own reasonable-procedures requirement, is exempt.

A current or former health care provider that claimed the Health Insurance Portability and Accountability Act (HIPAA)-based exemption remains bound for personal information, including health records, if its own compliance plan does not require, or is not implemented to provide, that protection once the provider stops being a HIPAA covered entity.

A knowing or intentional failure to comply is a deceptive act, actionable only by the Indiana Attorney General, and a related series of acts or omissions in violation of this section constitutes one deceptive act.

Requires an adult oriented website, where at least one third of content is harmful to minors, to use a reasonable age verification method before granting access, and bars retention of a user's identifying information after verification. The Attorney General or a harmed parent may sue for injunctive relief and damages.

Requires covered social media providers, those using algorithmic content feeds with at least $1 billion in global revenue, to determine whether a user is an Indiana resident under 16 and to obtain verifiable parental consent before creating an account, and to lock safety settings limiting direct messages, search visibility, and targeted advertising for minor accounts.