Indiana Children’s Privacy Laws (2026)

HB 1408 / HEA 1408 (2026); Public Law 100

Enacted, not yet effective · Social media · effective 2027-01-01 · binds operators, platforms

Ages: under 16

Requires: Covered social media providers (platforms built mainly for sharing user content that use algorithms analyzing user data to select content, have an addictive feature such as infinite scroll, reaction or share counts, autoplay or live streaming, belong to a group with at least $1B in worldwide gross revenue in any of the past three years, and have 10% or more of under-16 daily active users averaging two hours a day or longer) must use commercially reasonable means, such as a neutral age screen, to determine an account requester's age and state of residence, and may open an account for an Indiana resident under 16 only with verifiable parental consent. Accounts the provider knows or has reason to know belong to Indiana users under 16 must be locked so the teen cannot change them: direct messages and search visibility limited to linked accounts, no content, recommendations or ads based on the teen's usage patterns, and no addictive features; the consenting parent must be offered a separate password to the account to monitor and limit the teen's time and access the account. Providers must re-determine Indiana account holders' ages after 25 and 50 hours of use in a six-month period, every further 100 hours and whenever they collect demographic data (optional once an account has been held 10 consecutive years), and must terminate an under-16 account opened without parental consent unless, within 30 days of notice, a parent consents or a transactional-data age check shows the holder is 16 or older. Enforced by the AG as a deceptive act under the Deceptive Consumer Sales Act. Note: HEA 1408 is an education omnibus ('Education matters') whose other sections took effect 2026-07-01, so July-1 new-law roundups cite HEA 1408; the social-media article tracked here, IC 24-16, takes effect 2027-01-01.

Litigation: None found. No challenge to IC 24-16 appears on NetChoice's Litigation Center or CCIA's litigation page, and a RECAP docket search of the Indiana federal district courts and the Seventh Circuit found none. The article's duties begin 2027-01-01.

Entry last reviewed 2026-10-01

SB 5 (2023)

In force · Privacy law (minors) · effective 2026-01-01 · binds operators

Ages: Known children under 13

Requires: Personal data collected from a known child (under 13) is sensitive data, and a controller may not process a known child's sensitive data except in accordance with the federal Children's Online Privacy Protection Act (COPPA); a controller or processor that complies with COPPA satisfies any parental-consent obligation under the Act. A known child's parent or legal guardian may exercise the child's consumer rights on the child's behalf. The Act sets no separate heightened opt-in band for teens aged 13-17 (it follows the Virginia VCDPA model).

Entry last reviewed 2026-10-01