• by Wendy Davis  @wendyndavis, February 3, 2022

Lawmakers in Indiana's Senate this week approved a privacy bill that would give state residents the right to opt out of behaviorally targeted advertising.

If the measure also clears the House, Indiana will join California, Virginia and Colorado in requiring companies to allow people to reject some forms of online advertising.

Indiana Senate Bill 358 would broadly allow consumers to learn what personal information about them is held by companies, request its deletion, and opt out of some uses of that data.

One specific provision would give people the right to opt out of targeted advertising -- meaning ads based on inferences about people gleaned from their activities over time across nonaffiliated websites or applications.

That opt-out right would not extend to ads based on first-party data, or to contextual ads based on people's current searches, website visits or app use.

The bill also would not allow consumers to sue over violations. Instead, the state attorney general would have sole responsibility for enforcement.

Advocacy group Consumer Reports says the bill should be strengthened.

“Indiana SB 358, which just passed the Senate, doesn’t do enough to protect consumers’ privacy,” Consumer Reports' tech policy analyst Maureen Mahoney tweeted this week.

Among other proposed changes, Consumer Reports says lawmakers should require companies to honor global opt-out signals, such as commands that consumers can send through their browsers.

“This could help make the opt-out model more workable for consumers, but unless companies are required to comply, it is unlikely that consumers will benefit,” Mahoney said in a letter sent to Indiana lawmakers last month.

Colorado's new privacy law will require companies to honor opt-out requests made through browser settings or other global mechanisms; that provision won't take effect until 2024.

In California, regulations passed by the state attorney general require companies to comply with requests through the Global Privacy Control -- a tool that, when activated, transmits an opt-out request to all websites.

If Indiana's bill passes, it will take effect in 2025.