Indiana

Indiana's child-exploitation statute defines "image" to include a computer-generated image, and separately reaches simulated sexual conduct involving a representation that appears to be a child under eighteen, where the representation is obscene, without requiring that the child depicted actually exist.

Producing, disseminating, or possessing with intent to disseminate such an image is child exploitation, a Level 5 felony (a Level 4 felony on aggravating circumstances such as the depicted conduct including force or a victim under twelve), and knowingly possessing or accessing such an image is possession of child pornography, a Level 6 felony (a Level 5 felony on the same aggravating circumstances).

This reaches an AI-generated depiction of a fictional child in an obscene sexual context on the same terms as any other computer-generated image. Both the computer-generated-image definition and the simulated-conduct language quoted here were added by House Enrolled Act 1363 (P.L.172-2022), effective July 1, 2022.

House Enrolled Act 1047 amended the definition of "intimate image" that runs through both Indiana's criminal distribution-of-an-intimate-image statute and its civil nonconsensual-pornography-disclosure statute to include a photograph, digital image, or video of a person that was created or modified by a computer software program, artificial intelligence, application, or other digital editing tool, so that an AI-generated or AI-altered depiction of a real, identifiable person in an intimate context is treated the same as an authentic one.

Distributing such an image without the depicted person's consent, when the distributor knows or reasonably should know the person does not consent, is a Class A misdemeanor, elevated to a Level 6 felony on a prior unrelated conviction.

A depicted individual who is identifiable and suffered harm may separately bring a civil action for disclosing nonconsensual pornography, recovering the greater of actual and emotional-distress damages or statutory damages up to $10,000 per defendant, plus any of the defendant's monetary gain, punitive damages, attorney's fees, and injunctive relief. Both amendments took effect July 1, 2024 under the act's own effective-date clause.

A new Indiana Code chapter on downcoding of health benefits claims bars a health insurer, HMO, or dental preferred-provider plan from using an automated process, system, or tool, including artificial intelligence, as the sole basis to downcode a claim based on medical necessity, without a covered individual's medical record first being reviewed by an insurer employee or contractor; it likewise bars a provider from submitting a claim through such an automated tool without human review.

The insurer must disclose, in an easily accessible and readable manner, whenever artificial intelligence is used to make an adverse determination on a prior authorization request or to downcode a claim. The chapter does not apply to the Medicaid program or a Medicaid managed care organization. Enacted as House Enrolled Act 1271, it took effect July 1, 2026 under the act's own effective-date clause.

If a campaign communication includes fabricated media, meaning audio, video, or an image that has been altered or artificially generated to convey a materially inaccurate depiction of a candidate that a reasonable person would not recognize as altered, the person who paid for the communication must include a disclaimer stating that elements of the media have been digitally altered or artificially generated.

The disclaimer requirements vary by medium: a printed or video disclaimer must be displayed continuously, and an audio disclaimer must be read at the start, the end, and every two minutes for a communication longer than two minutes.

A candidate depicted in noncompliant fabricated media may bring a civil action against the person who paid for or sponsored the communication, and against a disseminator who knowingly, intentionally, or recklessly removed the disclaimer, for actual damages, injunctive relief, and attorney's fees, on a clear-and-convincing-evidence standard.

The enrolled act declared an emergency and took effect upon passage; the Indiana General Assembly's own bill-actions record shows the Governor signed it March 12, 2024.

A data base owner must disclose a breach of the security of a system to an affected Indiana resident if the owner knows, should know, or should have known that the unauthorized acquisition has resulted in or could result in identity deception, identity theft, or fraud affecting that resident, without unreasonable delay and no later than 45 days after discovering the breach.

A data base owner disclosing to more than 1,000 consumers must also notify nationwide consumer reporting agencies, and any disclosure at all triggers a required notice to the Indiana Attorney General.

Failing to make a required disclosure is a deceptive act actionable only by the Attorney General, with a civil penalty of up to $150,000 per deceptive act, and a separate, narrower duty to implement reasonable safeguards and dispose of records properly carries its own $5,000-per-act penalty, also enforced only by the Attorney General. This is a separate, pre-existing statute from INCDPA. The cited sections were added by P.L.125-2006, Securities and Exchange Commission (SEC).6, and have since been amended piecemeal: Ind.

Code sections 24-4.9-3-1 and 24-4.9-4-1 by P.L.137-2009, and section 24-4.9-3-3 by P.L.171-2022; section 24-4.9-4-2 has not been amended since 2006. The provisions this entry describes came into force on different days.

Section 21(c) of IC 27-2-27 requires a licensee to notify the commissioner as promptly as possible but not later than three business days after a determination that a cybersecurity event involving nonpublic information in the licensee's possession has occurred, if either of two listed conditions applies.

Section 21(c)(1) reaches an insurer domiciled in Indiana, or a producer whose home state is Indiana, when the event has a reasonable likelihood of materially harming a consumer residing in Indiana or any material part of the licensee's normal operations.

Section 21(c)(2) reaches a licensee that reasonably believes the nonpublic information of at least 250 consumers residing in Indiana was affected, where notice of the event is required by another state, federal or local law or the event has a reasonable likelihood of materially harming a consumer residing in Indiana or a material part of the licensee's normal operations.

Section 21(d) requires a licensee, after learning that a cybersecurity event has or may have occurred, to provide as much as possible of the thirteen listed items of information in electronic form, as directed by the commissioner. Section 21(e) gives the licensee a continuing obligation to update and supplement initial and subsequent notifications to the commissioner regarding material changes to previously provided information.

Section 21(f) requires a licensee to comply with IC 24-4.9 and to provide the commissioner a copy of the consumer notice if the licensee is required to notify the commissioner under subsection (c). In IC 27-2-27, a licensee is a person that is licensed, authorized to operate or registered, or required to be, under title 27 of the Indiana Code and the rules adopted under it.

Section 26(b) of IC 27-2-27 treats a licensee that is subject to Health Insurance Portability and Accountability Act (HIPAA) and maintains an information security program under it as meeting the chapter, except for the notice requirements in section 21. Section 27 of IC 27-2-27 lets the insurance commissioner, after notice and hearing, suspend or revoke the license, certificate of authority or registration of a licensee that violates the chapter.

Section 29 of IC 27-2-27 provides that the chapter does not create a private right of action against any person. Section 1 of IC 27-2-27 provides that the chapter applies after June 30, 2021. P.L.130-2020 added the chapter to the Indiana Code.

INCDPA governs private-sector processing of Indiana residents' personal data. It applies to a person conducting business in Indiana, or producing a product or service targeted to Indiana residents, that during a calendar year controls or processes the personal data of at least 100,000 Indiana consumers, or of at least 25,000 Indiana consumers while deriving more than 50 percent of gross revenue from selling personal data.

A controller must limit collection to what is adequate, relevant, and reasonably necessary for the purposes disclosed to the consumer, and may not process personal data for an incompatible purpose without the consumer's consent. Article 15 also preempts local law: no city, county, or other local government may regulate a controller's or processor's processing of personal data.

INCDPA requires a controller to conduct and document a data protection impact assessment of each of these processing activities involving personal data: targeted advertising, the sale of personal data, profiling that presents a reasonably foreseeable risk of unfair or deceptive treatment, injury, an offensive intrusion or other substantial injury to consumers, the processing of sensitive data, and any processing that presents a heightened risk of harm to consumers.

Each assessment must identify and weigh the benefits of the processing to the controller, the consumer, other stakeholders and the public against the potential risks to the rights of the consumer, as mitigated by safeguards.

The Attorney General may request, pursuant to a civil investigative demand, that a controller disclose any such assessment relevant to an investigation, and the controller must make it available to the Attorney General, who may evaluate it for compliance with the controller responsibilities in chapter 4. Assessments are confidential and exempt from public inspection and copying, and disclosing one to the Attorney General does not waive attorney-client privilege or work product protection. The requirements apply to processing activities created or generated after December 31, 2025.

INCDPA gives an Indiana consumer the right to confirm and access their personal data, correct inaccuracies, delete data, obtain a portable copy, and opt out of targeted advertising, the sale of personal data, and profiling that produces a legal or similarly significant effect, exercisable against the controller.

A controller must respond without undue delay and no later than 45 days after receipt, with one additional 45-day extension available when reasonably necessary, and must inform the consumer of a decline and the means to appeal it on the same 45-day timeline. This is the ordinary 45-plus-45 response model used across most states, not the shortened timeline Florida uses.

Section 1 of IC 16-39-1 applies to all health records except mental health records, which IC 16-39-2, IC 16-39-3 and IC 16-39-4 govern. Article 39 of title 16 does not apply to records regarding communicable diseases, which IC 16-41-8-1 governs, or to alcohol and other drug abuse patient records, which 42 CFR Part 2 governs.

Section 1(c) of IC 16-39-1 requires a provider, on written request and reasonable notice, to supply to a patient the health records possessed by the provider concerning the patient. Section 1(d) of IC 16-39-1 requires a provider, on a patient's written request and reasonable notice, to furnish the patient or the patient's designee a copy of the patient's health record used in assessing the patient's health condition.

Section 1(e) of IC 16-39-1 requires a provider to provide the requested health records within 30 days after the written request, unless within the first 30 days it seeks an extension of not more than 30 days and informs the patient in writing of the reasons and the date. Section 1(f) of IC 16-39-1 lets the state department impose a fine against a provider not to exceed $5,000 for not complying with the section.

Section 2 of IC 16-39-1 requires a provider, on a patient's written request and reasonable notice, to provide the patient or the patient's designee access to, or a copy of, the patient's x-ray image at no cost.

Section 4 of IC 16-39-1 requires a patient's written consent for release of the patient's health record to include the name of the person requested to release the record, the recipient, the purpose, a description of the information, the signature and date, a statement that the consent can be revoked, and the date or event on which it expires.

Section 5 of IC 16-39-1 lets a provider who is a health care professional withhold requested information from the patient if the provider reasonably determines it is detrimental to the patient's physical or mental health or likely to cause the patient to harm the patient or another. Section 339 of IC 16-18-2 defines the state department as the department established by IC 16-19-1-1.

Section 1 of IC 16-19-1 establishes the Indiana department of health, which may officially be known as the Indiana department of health or the state department of health. The provisions this entry describes came into force on different days.

The Indiana Attorney General has exclusive authority to enforce INCDPA, with a civil penalty of up to $7,500 per violation plus recoverable investigation expenses. Before suing, the Attorney General must give a controller or processor 30 days' written notice identifying the specific provisions violated; if the violation is cured within that period and the controller or processor provides a written attestation of the cure, the Attorney General may not initiate an action.

This cure right is mandatory, not discretionary, and carries no sunset date anywhere in Article 15, unlike Maryland's, New Jersey's, and Minnesota's time-limited or discretionary cure provisions. The chapter creates no private right of action.

In chapter 24 of article 4 of title 24 of the Indiana Code, consumer genetic testing means a service in which a person provides an individual with a means of submitting a sample of the individual's biological material directly to the person, performs or causes to be performed genetic testing on it, and returns the results directly to the individual.

The chapter excludes genetic testing of a health care provider's patient that is requested by the provider for diagnosis, treatment or prevention and is subject to Health Insurance Portability and Accountability Act (HIPAA), testing required by a court order, testing for a law enforcement investigation, testing at the request of a coroner or medical examiner, and research subject to the federal human subject protection rules.

A consumer genetic testing provider is a person that, in the ordinary course of business, offers consumer genetic testing or collects, uses or analyzes genetic data that results from a consumer genetic testing product or service and is provided by a consumer, in exchange for consideration. Section 8 of the chapter bars a provider from performing genetic testing on an individual's biological material unless it has given the individual a written disclosure of its privacy policy.

Section 9 of the chapter bars a provider from testing beyond what the individual requested, using the biological material for another purpose, giving a third party access, retaining the material or identifiable data for more than 30 days, or marketing based on the results unless the provider has received the individual's freely given, specific, informed and unambiguous consent.

Section 9(c) of the chapter provides that consent is not freely given, specific, informed and unambiguous if it is provided by the individual's inaction, by acceptance of general or broad terms of service, by closing, muting, pausing or hovering over content, or through an interface designed to subvert user choice.

Section 10(a) of the chapter requires a provider to implement commercially reasonable security measures to protect the biological material and the resulting data from unauthorized access, destruction, use, modification or disclosure. Section 10(a) of the chapter requires a provider to comply with a revocation of consent not later than 30 days after the individual communicates it, including by destroying the biological material and the resulting data.

Section 10(b) of the chapter bars a provider from providing data, other than deidentified data, resulting from genetic testing to an insurer, to a person that provides information to insurers for underwriting or rating of risks, or to a person that employs the individual, regardless of the individual's consent to third-party access.

Section 11 of the chapter gives the attorney general exclusive authority to enforce the chapter, by an action for an injunction and a civil penalty not to exceed $7,500 for each violation. Section 11(d) of the chapter requires the attorney general to give a provider 30 days written notice of the alleged violation before bringing an action, and bars the action if the provider cures the violation and gives an express written statement within that period.

Section 11(f) of the chapter provides that nothing in the section may be construed as providing the basis for a private right of action for violations of the chapter or any other law. Public Law 233 of 2025 added the chapter to the Indiana Code. House Bill 1521 of the 2025 session became Public Law 233, and the Governor signed it on May 6, 2025.

Section 2 of IC 22-9-14 bars a person from discriminating against an individual on the basis of the individual's solicitation and use of consumer genetic testing services or on the basis of the results of genetic testing performed by a consumer genetic testing provider.

Section 2 of IC 22-9-14 lists denying the individual access to the person's goods or services, charging the individual a different rate for them, and suggesting that the individual will be subject to either measure as forms of the discrimination it bars. Section 1 of IC 22-9-14 applies the definitions in IC 24-4-24 throughout the chapter. Public Law 233 of 2025 added the chapter to the Indiana Code.

Subsection (d) of section 2 of IC 16-39-5 bars an insurance company other than a life insurance company from obtaining the results of any genetic screening or testing without a separate written consent by an individual at the time of application for insurance or at any other time.

Subsection (d) of section 2 of IC 16-39-5 requires the consent form to indicate in at least 10 point boldface type that the individual need not consent to releasing the results of any genetic testing or screening, and to be approved by the commissioner before use.

Subsection (e) of section 2 of IC 16-39-5 provides that an insurance company other than a life insurance company is not liable if it inadvertently receives the results of genetic testing or screening without the separate written consent, but may not use the results in violation of IC 27-8-26. No day on which the provisions this entry describes came into force has been located.

Section 1 of IC 27-8-26 applies the chapter to accident and sickness insurance policies issued, delivered or renewed in Indiana, health maintenance organization contracts, health care plans of a state or local governmental entity that cover services on a self-insurance basis, and self-funded employee welfare benefit plans.

Section 1 of IC 27-8-26 excludes accident-only, credit and disability income insurance, coverage issued as a supplement to liability insurance, worker's compensation, automobile medical payment insurance and life insurance.

Section 5 of IC 27-8-26 bars an insurer processing an application for health care services coverage, or determining insurability, from requiring genetic screening or testing, considering information from it adversely, inquiring into its results, or deciding adversely on entries about its results. Section 6 of IC 27-8-26 bars an insurer from asking an applicant for the results of genetic screening or testing, or questions designed to ascertain the results.

Section 7 of IC 27-8-26 bars an insurer from canceling, refusing to issue, refusing to renew or refusing to enter into a contract for health care services coverage based on the results of genetic screening or testing. Section 8 of IC 27-8-26 bars an insurer from delivering, issuing, renewing or executing a contract for health care services coverage in Indiana that limits benefits or establishes premiums based on the results of genetic screening or testing.

Section 9 of IC 27-8-26 lets an insurer consider the results of genetic screening or testing if the applicant or the individual seeking renewal voluntarily submits them and they are favorable. Section 10 of IC 27-8-26 requires the commissioner to enforce the chapter. Section 11 of IC 27-8-26 makes a violation of the chapter an unfair and deceptive act or practice in the business of insurance under IC 27-4-1-4.

Section 0.1 of IC 27-8-26 provides that the chapter applies to all applications and policies for accident and sickness insurance delivered, issued for delivery, renewed or executed after December 31, 1997. Section 6 of IC 27-4-1 lets the commissioner, after a hearing, order a civil penalty of not more than $25,000 for each act or violation of the chapter, or of not more than $50,000 if the person knew or reasonably should have known of the violation.

Section 3(c) of IC 16-39-5 provides that the original health record of the patient is the property of the provider and may be used by the provider without specific written authorization for legitimate business purposes, including claims, collection of accounts, litigation defense, quality assurance, peer review, and scientific, statistical and educational purposes.

Section 3(d) of IC 16-39-5 requires a provider to protect the confidentiality of the health record at all times in a use under subsection (c), and permits disclosure of the patient's identity only when disclosure is essential to the provider's business use or to quality assurance and peer review.

Section 3(e) of IC 16-39-5 lets a provider or the Indiana archives and records administration disclose a health record to another provider or to a nonprofit research organization for a scientific, statistical or educational project, and requires each party that receives information to protect the confidentiality of the record and not to disclose the patient's identity except as the article allows.

Section 3(f) of IC 16-39-5 lets a provider disclose a health record to an Indiana hospital trade association for a data aggregation project, and permits disclosure of a patient's identity to the association only when the disclosure is essential to the project. Section 3(j) of IC 16-39-5 makes a person who recklessly violates or fails to comply with subsections (e) through (h) guilty of a Class C infraction, with each day a violation continues a separate offense. The provisions this entry describes came into force on different days.

INCDPA classifies racial or ethnic origin, religious belief, a health diagnosis made by a health care provider, sexual orientation, citizenship or immigration status, genetic or biometric data processed to uniquely identify a specific individual, a known child's data, and precise geolocation data as sensitive data requiring the consumer's consent before processing, except that a known child's sensitive data may instead be processed under COPPA's consent framework.

'Biometric data' means data from automatic measurement of an individual's biological characteristics used to identify them, such as a fingerprint, voiceprint, or retina or iris image, but the definition carries a blanket, unconditional exclusion for a physical or digital photograph, a video or audio recording, or any data generated from either, with no clawback for data generated to identify someone.

A faceprint or voiceprint extracted from a recording therefore falls outside both biometric data and sensitive data under Indiana law, regardless of the purpose for which it was extracted; only a biometric identifier captured directly, such as from a live scanner, triggers this consent duty.

Section 35-43-2-3(b) provides that a person who knowingly or intentionally accesses a computer system, computer network, or any part of either without the consent of the owner or the owner's licensee commits computer trespass, a Class A misdemeanor. This is phrased as lack of the owner's consent, with no separate exceeds-authority prong. The same article separately punishes, at section 35-43-1-8, knowing and intentional unauthorized disruption or denial of computer system services.

House Enrolled Act 1360 adds new IC 5-14-3-2(d), defining data scraping to mean use of an automated system to extract data from websites and other Internet accessible sources. New IC 5-14-3-3.3 authorizes, but does not require, a public agency to build a records-request portal using a CAPTCHA or an equivalent mechanism for ensuring that a requestor is a human, to require verification of a requestor's physical address, and to have the portal indicate whether the requestor is an Indiana resident.

New IC 5-14-3-8.1 lets an agency give priority to Indiana residents and to civic, journalistic, academic, or personal-use requests, while delaying or surcharging requests identified as originating from out-of-state entities or automated systems. New IC 5-14-3-11 requires an agency to report suspected automated, phishing, or data-scraping requests to the state Public Access Counselor through a standardized mechanism. The enrolled act carries a July 1, 2026 effective date on every section.

IC 24-15-2-19(b) defines personal data to exclude de-identified data, aggregate data, or publicly available information.

IC 24-15-2-26 defines publicly available information as information that is lawfully made available through federal, state, or local government records, or that a business has a reasonable basis to believe is lawfully made available to the general public through widely distributed media, by the consumer to whom the information pertains, or by a person to whom the consumer has disclosed it, unless the consumer has restricted the information to a specific audience.

The exclusion removes information lawfully made available through government records or widely distributed media from the definition of personal data itself, rather than exempting it by a separate carve-out.

IC 24-15-1-1(a) applies the Act to a person conducting business in Indiana or targeting Indiana residents that, during a calendar year, controls or processes personal data of at least 100,000 Indiana consumers, or of at least 25,000 Indiana consumers while deriving more than half of its gross revenue from selling personal data. Enforcement is Attorney-General-only; there is no private right of action.

A licensee must develop, implement, and maintain a comprehensive, written information security program that is based on its risk assessment and contains administrative, technical, and physical safeguards for nonpublic information and its information systems. A licensee's risk assessment must include implementing information safeguards for the threats it identifies and assessing the effectiveness of their key controls, systems, and procedures at least one time each year.

A licensee must establish a written incident response plan designed to promptly respond to, and recover from, any cybersecurity event. Each insurer domiciled in Indiana must submit to the commissioner, not later than April 15 each year, a written statement certifying that it is in compliance with sections 16 through 20 of the chapter.

A licensee is exempt from sections 16 through 20 if it has fewer than fifty employees, less than five million dollars in gross annual revenue, or less than ten million dollars in year-end total assets. If a licensee violates the chapter, the insurance commissioner may, after notice and hearing, suspend or revoke the license, certificate of authority, or registration of the licensee. The chapter does not create a private right of action against any person. The chapter applies after June 30, 2021.

A public entity means a political subdivision, state agency, school corporation, or state educational institution. Not later than December 31, 2027, each public entity must adopt a policy governing use of technology resources by its employees, a cybersecurity policy, and a training program that is mandatory for its employees. Not later than December 31 of each odd-numbered year, a public entity must submit its cybersecurity policy to the Office of Technology.

A public entity that engages a third party to assess its cybersecurity policy must provide the results of the assessment to the Office of Technology. A public entity that connects to the technology infrastructure of the state after July 1, 2027 must have completed a cybersecurity assessment within the three year period before the connection. The provisions this entry describes came into force on different days.

The chapter applies to a community water system with a population of five hundred or more, a publicly owned treatment works, or a Class III or Class IV semipublic facility that uses a computerized system to monitor and control its processes from a central location. An entity must conduct a cybersecurity vulnerability assessment at least once per calendar year.

Beginning in 2026, not later than December 31 of each even-numbered year, an entity must submit a certification to the department via a secured portal. Before September 1 of each year, an entity must give the Office of Technology the name and contact information of its primary reporter of a cybersecurity incident. An assessment must use an assessment tool or framework approved by the department and the Office of Technology.

A data base owner, a person that owns or licenses computerized data including personal information of an Indiana resident, must implement and maintain reasonable procedures, including taking any appropriate corrective action, to protect and safeguard that personal information from unlawful use or disclosure.

A data base owner must also not dispose of or abandon records or documents containing unencrypted and unredacted personal information of Indiana residents without shredding, incinerating, mutilating, erasing, or otherwise rendering it illegible or unusable. A data base owner that maintains its own data security procedures under a listed federal privacy or security regime, and complies with that regime's own reasonable-procedures requirement, is exempt.

A current or former health care provider that claimed the Health Insurance Portability and Accountability Act (HIPAA)-based exemption remains bound for personal information, including health records, if its own compliance plan does not require, or is not implemented to provide, that protection once the provider stops being a HIPAA covered entity.

A knowing or intentional failure to comply is a deceptive act, actionable only by the Indiana Attorney General, and a related series of acts or omissions in violation of this section constitutes one deceptive act. No day on which the provisions this entry describes came into force has been located.

A person who disposes of the unencrypted, unredacted personal information of a customer without shredding, incinerating, mutilating, erasing, or otherwise rendering the information illegible or unusable commits a Class C infraction. The offense is a Class A infraction if the person disposes of the unencrypted, unredacted personal information of more than one hundred customers or has a prior unrelated judgment for a violation of the section.

To dispose of personal information means to discard or abandon the personal information of a customer in an area accessible to the public. A customer is a person who has received, or contracted for, the provision of goods or services from another person holding the person's personal information, or who provides personal information to another person in connection with a transaction with a nonprofit corporation or charitable organization.

A person is an individual, a partnership, a corporation, a limited liability company, or another organization. Personal information has the meaning set forth in IC 24-4.9-2-10 and includes information stored in a digital format. That definition covers a Social Security number that is not encrypted or redacted, and an individual's name together with a driver's license number, state identification card number or credit card number that is not encrypted or redacted.

Personal information is redacted if it has been altered or truncated so that not more than five digits of a Social Security number are accessible. The chapter does not apply to the executive, judicial, or legislative department of state government or any political subdivision.

It also does not apply to a person that maintains and complies with a disposal program under the USA Patriot Act, Executive Order 13224, the Driver's Privacy Protection Act, the Fair Credit Reporting Act, the Financial Modernization Act of 1999 or the Health Insurance Portability and Accountability Act, if applicable.

A person in the business of waste collection is outside the chapter except to the extent the person holds a customer's personal information directly in connection with the business of waste collection. No day on which the provisions this entry describes came into force has been located: the codified text carries only a public-law-and-year citation, P.L.125-2006, with no day.

The chapter applies to a community water system with a population of five hundred or more, a publicly owned treatment works, or a Class III or Class IV semipublic facility that uses a computerized system to monitor and control its processes from a central location. When an actual or reasonably suspected cybersecurity breach occurs, an entity must report the incident to the Office of Technology not later than twenty-four hours after discovery if the incident impacts the operations of the entity.

If the incident does not impact the operations of the entity, the report is due not later than two business days after discovery.

A state agency other than a state educational institution, and a political subdivision, must report any cybersecurity incident to the Office of Technology without unreasonable delay and not later than two business days after discovery. The reporting duty excludes a department of public utilities established under section 8-1-11.1 of the Indiana Code and an entity subject to the water and wastewater cybersecurity chapter.

Each such entity must give the Office of Technology the name and contact information of its primary reporter of a cybersecurity incident before September 1 of each year. Nothing in the section requires reporting that conflicts with federal privacy laws or is prohibited due to an ongoing law enforcement investigation.

Requires an adult oriented website, as the chapter defines that term, to use a reasonable age verification method before granting access, and bars retention of a user's identifying information after verification. The Attorney General or a harmed parent may sue for injunctive relief and damages.

The act adds Indiana Code article 24-16 and binds a social media provider, defined as an online forum, website, or application that functions primarily to let registered users upload or access content, uses algorithms to select content for users, has an addictive feature such as continuously loading content or autoplay video, has a user base in which ten percent or more of the daily active users under 16 spend an average of two hours per day or longer on it, and is owned or operated by a person that generated at least one billion dollars in gross revenues worldwide in one or more of the three preceding years.

A provider that receives an account request from an Indiana resident must use commercially reasonable means, such as a neutral age screen, to determine the individual's age and state of residence, and may create the account of an individual under 16 only with verifiable parental consent from a parent or legal guardian.

The provider must configure the account of a registered user it knows or has reason to know is an Indiana resident under 16 so that the account cannot receive direct communications except from a linked account, cannot appear in search results except to a person holding a linked account, and cannot be shown content, recommendations, or advertising based on the adolescent's patterns of use, or the addictive features, and the adolescent may not change or bypass that configuration.