• by Wendy Davis  @wendyndavis, May 2, 2023

Indiana Governor Bill Holcomb on Monday signed a privacy law that will require companies to allow state residents to opt out of some forms of targeted advertising.

Holcomb's move means Indiana is now the seventh state to enact comprehensive privacy legislation, joining California, Utah, Virginia, Colorado, Connecticut, and Iowa. Lawmakers in two other states -- Montana and Tennessee -- passed privacy bills in recent weeks, but those measures haven't yet been signed.

Indiana's Senate Bill 5, slated to take effect in January of 2026, will enable people to reject ads targeted based on data collected over time and across nonaffiliated websites or applications.

The law doesn't give consumers the right to opt out of ad targeting based on first-party data, including activity on company's affiliated websites or applications.

It also doesn't require companies to honor opt-out mechanisms like the Global Privacy Control --  a tool developed by privacy advocates that lets people opt out of the sale of their information on a universal basis, as opposed to opting out site-by-site.

In addition, the Indiana measure allows companies to charge higher prices to people who opt out of receiving targeted ads.

Some privacy advocates opposed the bill, arguing it wasn't strong enough. Consumer Reports, the Electronic Frontier Foundation and Electronic Privacy Information Center said earlier this year that a default ban on data sharing would protect privacy better than an opt-out system. The organizations also argued that bills with an opt-out framework should include a mandate that companies honor universal opt-out signals.

On Tuesday, Consumer Reports called on state lawmakers to revise the bill before it takes effect, including by adding a provision requiring companies to allow consumers to opt out through universal mechanisms like the Global Privacy Control.