79%
of Indiana's 19 requirements are already met by California (CA). Here is what ICDPA adds, biggest gaps first.
AppealsConsumers' rightsBig gap
CA0 No statutory appeal process for denied requests.
ICDPA adds2 Controllers must offer an appeal, answer within 60 days, and on denial give a way to contact the Attorney General.
Ind. Code § 24-15-3-1(d) · source ↗
ThresholdsWho it coversGap
CA0 For-profit businesses with gross revenue over $26,625,000 (2025 adjusted), or buying/selling/sharing data of 100,000+ consumers or households, or 50%+ revenue from selling/sharing.
ICDPA adds1 Applies to businesses processing data of 100,000+ Indiana consumers, or 25,000+ consumers with over 50% of gross revenue from data sales.
Ind. Code § 24-15-1-1(a) · source ↗
Sensitive dataSensitive data and minorsGap
CA0 Broad sensitive personal information list, including neural data, IDs and financial log-ins; consumers get a right to limit use rather than opt-in consent.
ICDPA adds1 Processing sensitive data requires opt-in consent.
Ind. Code §§ 24-15-2-28, 24-15-4-1(5) · source ↗
De-identified dataBusiness dutiesGap
CA2 Deidentified data requires reasonable measures, a public commitment not to reidentify, and contract flow-down to recipients.
ICDPA adds3 Deidentified data needs safeguards, a public no-reidentification commitment and contract flow-down; pseudonymous data is exempt from certain rights if kept separate.
Ind. Code §§ 24-15-2-12, 24-15-7-1, 24-15-7-2 · source ↗
Already covered by CA: Exemptions, Children and teens, Data minimization, Rights, Request deadline, Universal opt-out, Assessments, Processor contracts, Privacy notice, Loyalty programs, Who enforces, Cure period, Maximum penalty, Private action, Rulemaking.
A gap means ICDPA is more demanding than CA on that requirement, on our 0 to 3 scale (how we score). Read the cited section before acting. Not legal advice.
