Keypoint: The bill, which is based on Virginia’s Consumer Data Protection Act, now moves to the Indiana House.

As first reported by the IAPP’s Joe Duball, the Indiana Senate unanimously voted to pass SB 358 on February 1, 2022.

Indiana is the first state during the 2022 legislative session to pass a consumer privacy bill out of a chamber.

Prior to its passage, the bill took an interesting turn of events as the as-introduced version of the bill – which was conceptually similar to the California Privacy Rights Act and contained a private right of action – was replaced in the Senate Committee on Commerce and Technology with a bill that largely tracks the Virginia Consumer Data Protection Act. (See Joe Duball’s story here on the changes.)

Among other notable provisions, the version of the bill that passed the Indiana Senate does not contain a private right of action, does not require controllers to recognize universal opt out signals, contains a right to cure that does not sunset (as is the case with California and Colorado’s laws), and does not grant the Indiana Attorney General rulemaking authority.

If passed, the law would go into effect on January 1, 2025.

The bill now moves to the Indiana House.

[View source.]