• by Wendy Davis  @wendyndavis, April 12, 2023

Indiana appears to be on the verge of passing a privacy law that would require companies to allow state residents to opt out of some forms of targeted advertising.

Senate Bill 5 specifically would allow consumers to reject ads targeted based on data collected over time and across nonaffiliated websites or applications. The bill wouldn't give consumers the right to opt out of ad targeting based on first-party data, including activity on company's affiliated websites or applications.

The bill also would not require companies to honor opt-out mechanisms like the Global Privacy Control --  a tool developed by privacy advocates that enables web users to opt out of the sale of their information on a universal basis.

Instead, businesses could require consumers to opt out of ad targeting company-by-company.

The measure also would let companies charge higher prices to people who opt out of receiving targeted ads.

Earlier this year, lawmakers in the Indiana Senate unanimously voted in favor of the bill. Last week, the House unanimously approved a slightly revised version. That tweaked version will now return to the Senate, which is expected to pass the bill -- possibly as early as this week.

Privacy advocates including Consumer Reports, the Electronic Frontier Foundation and Electronic Privacy Information Center previously voiced opposition to the bill.

The groups said in a January letter that a default ban on data sharing would protect privacy better than an opt-out system that “relies on users to hunt down and navigate divergent opt-out processes for potentially thousands of different companies.”

The organizations added that privacy laws with an opt-out approach should require companies to honor browser-based opt-out signals.

“In the absence of strong data minimization requirements, at the very least, consumers need tools to ensure that they can better exercise their rights, such as a global opt out,” the organizations wrote.

The advocates raised other objections, including to the provision that allows companies to charge higher prices to people who opt out of targeted advertising.

“Consumers should not be charged for exercising their privacy rights -- otherwise, those rights are only extended to those who can afford to pay for them,” the groups wrote.

Six other states have recently enacted privacy laws -- California, Colorado, Connecticut, Iowa, Utah and Virginia. All except Iowa require companies to let consumers reject some forms of pseudonymous online ad targeting.

If the Indiana law is enacted, it will take effect in January 2026.