Ind. Privacy Bill Clears Senate Panel Unanimously
Indiana should hasten to join other states with privacy laws, said state legislators and the attorney general’s office at a hearing livestreamed Thursday. Two Democrats raised concerns that an opt-out privacy bill based on Virginia’s law might not go far enough, but the Senate Commerce and Technology Committee voted 11-0 to clear the comprehensive data protection bill. SB-5’s low bill number shows it’s a priority this legislative session, said Chair Chip Perfect (R).
Sen. Liz Brown (R) pledged to revisit privacy if her bill doesn’t work as well as hoped once it becomes law. Brown will monitor Virginia and other states with laws, she said. "We're going to watch and see. And if we don't think this goes far enough, if we think somehow we've left enough gray area for loopholes, I promise to come back and visit this.”
“We are quickly reaching a point within the U.S. where a state that doesn’t have some sort of consumer privacy protection bill is going to start having more trouble attracting businesses … because they don't know where we’re going to land on that subject,” said Douglas Swetnam, Indiana AG office section chief-data privacy and identity theft. The AG office, with sole enforcement authority as proposed, has the expertise to administer the bill's provisions, he said.
Sen. Andrea Hunley (D) voiced discomfort with the bill not including a private right of action, saying she’s not sure she wants to waive that right. Hunley agreed it’s important to get protection right away but wants to make sure there’s at least a commitment to return to the subject later. Speaking as a Black woman, she said, “government hasn’t always served us well, and so I have reservations about putting … all of this faith in the AG’s office” to enforce the bill.
“We have no protection right now” in Indiana or nationwide, stressed Brown. “I appreciate your concern that you want a private cause of action. The problem right now is you have no cause of action." Most state privacy bills lack an individual right to sue, noted Swetnam.
It’s important to get a law made soon, said Perfect, the committee’s top Republican. “We have to walk before we run.” Ranking member Shelli Yoder (D) agreed the bill is a step forward but noted opposition from consumer privacy advocates. She suggested "finding ways ... to make it better” as the possible law ages.
How the bill might interact with Indiana’s abortion ban concerns Yoder, she said earlier. The Democrat asked what consequences there might be for a consumer who complained to the AG about a privacy violation on accessing abortion care that Indiana finds illegal. That’s outside the bill’s scope, said Swetnam, noting the AG office lacks criminal prosecution authority.
The Indiana Technology & Innovation Association supports SB-5 despite being neutral on last year’s version, said Executive Director Jennifer Hallowell. The group hopes Indiana and Virginia can be models for federal law, she said. The industry group supports AG enforcement with no private right of action, she said. The proposed Jan. 1, 2026, effective date, gives companies adequate time to prepare, Hallowell said. The Indiana Chamber of Commerce also supported the bill Thursday.
The committee received written opposition from the American Civil Liberties Union (ACLU), Consumer Reports (CR), Electronic Frontier Foundation (EFF) and the Electronic Privacy Information Center (EPIC). None had witnesses at the hearing. “SB 5 does not meet bare minimum standards to protect people's privacy and would legitimize a status quo that protects the big tech companies’ profits, and not people,” ACLU-Indiana Director-Advocacy Katie Blair wrote. Privacy legislation must at least “contain strong restrictions on the amount of personal information that can be collected and the ways in which it can be used,” including requiring opt-in consent and a private right of action, she said.
“It would do little to protect Indiana consumers’ personal information, or to rein in major tech companies like Google and Facebook,” wrote CR, EFF and EPIC. “The bill needs to be substantially improved before it is enacted; otherwise, it would risk locking in industry-friendly provisions that avoid actual reform.” Opt-in would be best, but the law should at least require companies to honor browser privacy signals for opting out and broaden opt-out rights to include all data sharing, the consumer advocates said. Clarify that companies may not charge higher prices to consumers who opt out, they said. Also, the groups said violators should not get a “right to cure.”