Consumer Reports thanks Indiana legislators for their work to advance consumer privacy by considering SB 358. This bill would extend to Indiana consumers important rights: the right to know the information companies have collected about them, the right to delete that information, and the right to stop the disclosure of certain information to third parties, with additional rights for children and teens.
Privacy laws should set strong limits on the data that companies can collect and share so that consumers can use online services or apps safely without having to take any action, such as opting in or opting out. We recommend including a strong data minimization requirement that limits data collection and sharing to what is reasonably necessary to provide the service requested by the consumer, as outlined in our model bill. A strong default prohibition on data sharing is preferable to an opt-out based regime which relies on users to hunt down and navigate divergent opt-out processes for potentially thousands of different companies. Consumer Reports has documented that some California Consumer Privacy Act (CCPA) opt-out processes are so onerous that they have the effect of preventing consumers from stopping the sale of their information.
However, within the parameters of an opt-out based bill, we make several recommendations to improve the privacy provisions of SB 358. For the full letter, please see the attached PDF.