Consumer Laws in Indiana (2026): Your Rights, Their Rules

Most people have no idea how many protections they actually have. Seriously. Indiana has strong consumer laws on the books, and a brand-new data privacy law just kicked in this year. If a business has cheated you, lied to you, or misused your personal data, the law may be on your side.

Let’s break it down, step by step.

What Are Consumer Protection Laws?

Consumer protection laws are rules that businesses must follow when dealing with you. They stop companies from lying, tricking, or taking advantage of people. Think of them as your legal shield when you shop, sign contracts, or share your personal information.

Indiana has several of these laws. They cover everything from false advertising to your right to delete personal data held by companies. Some are old. One is brand new for 2026. All of them matter.

The Deceptive Consumer Sales Act: Indiana’s Main Protection

This is the big one. Honestly, this is the law most Hoosiers never hear about but should.

The Indiana Deceptive Consumer Sales Act (DCSA) protects you from unfair or dishonest business practices. A supplier cannot commit an unfair, abusive, or deceptive act in connection with a consumer transaction. This applies whether it happens before, during, or after the transaction.

Pretty broad, right? That’s the point.

What Counts as a Deceptive Act?

Wondering what exactly qualifies? A lot of things do.

Deceptive acts include lying about a product’s quality. They include false promises about delivery times. Making false claims about warranties or disclaimer of warranties is also prohibited. So is telling you that you’ll get a discount or rebate that actually depends on a future event that may never happen.

Car dealers, for example, can cheat consumers by misrepresenting a car’s condition, committing odometer fraud, selling a car with an unperformed recall, or failing to disclose that a car was previously a lemon buyback. These all count as deceptive acts under Indiana law.

Okay, pause. Read this carefully.

A deceptive act doesn’t have to be a big lie. Even small misrepresentations can count. Even leaving out important information can count. The law covers both explicit and implicit misrepresentations.

Curable vs. Incurable Deceptive Acts

This part trips a lot of people up. You’re not alone, it confuses most folks.

There are two types of deceptive acts under the DCSA. The first is an “uncured” deceptive act. An uncured deceptive act is one where the consumer gave proper notice to the supplier, and the supplier either failed to make an offer to fix the problem within 30 days or failed to actually fix it within a reasonable time.

The second type is an “incurable” deceptive act. An incurable deceptive act is one done by a supplier as part of a scheme or device with intent to defraud or mislead. These are more serious, and intent must be proven.

What You Can Do: Your Rights Under the DCSA

Here’s where things get good. You actually have real power here.

Read About: Home Security Camera Laws in Maryland (2026): Protect Your Home Without Breaking the Law

If you rely on an uncured or incurable deceptive act, you can bring a legal action to recover the actual damages you suffered, or $500, whichever is greater. So even small frauds can be worth pursuing.

Wait, it gets better.

If the court finds the deceptive act was willful, it can award extra damages of up to three times your actual damages, or $1,000, whichever is greater. And the DCSA lets you get your attorney’s fees paid by the other side if you win.

That last part is huge. It means you can go after a dishonest business even if you can’t afford a lawyer upfront.

You can also bring a class action against a supplier on behalf of a group of people who were all damaged by the same deceptive act. Strength in numbers, right?

The Notice Requirement: Don’t Skip This Step

Okay, this one’s important. Don’t skip it.

Before you can sue under the DCSA, you usually have to notify the business first. The law requires you to send written notice to the business fully explaining the nature of the deceptive act and the actual damage you suffered. You only have six months from when you discover the problem to send this notice. And if a year has passed, you’re too late, even if you didn’t discover the problem sooner.

Think of it like a formal complaint before legal action. The business gets a chance to fix the problem. If they refuse, then you can take them to court.

Indiana’s Lemon Law: Protection for Car Buyers

Bought a car that turned out to be a nightmare? There’s a law for that.

Indiana’s Lemon Law covers people who enter into an agreement or contract in Indiana for the transfer, lease, or purchase of a motor vehicle, for purposes other than resale or sublease.

A non-conformity under the Indiana Lemon Law involves a specific defect or combination of defects that substantially impairs the use, market value, or safety of a motor vehicle, or makes it non-conforming to the manufacturer’s warranty.

Sound complicated? It’s actually not.

In simple terms: if your car has a serious defect covered by its warranty, the manufacturer must fix it. If they can’t fix it after a reasonable number of tries, you could get a replacement car or a refund.

If the seller cannot conform the vehicle to its warranties after a reasonable number of repair attempts, the manufacturer must provide a replacement vehicle or accept the return of the vehicle in exchange for a refund of the full purchase price or lease cost. A reasonable allowance for consumer use of the vehicle will be subtracted from the refund.

Indiana’s Lemon Law is found at Indiana Code Section 24-5-13-1.

Brand New in 2026: The Indiana Consumer Data Protection Act

Hold on, this part is important.

Indiana’s comprehensive consumer privacy law, the Indiana Consumer Data Protection Act (ICDPA), took effect on January 1, 2026. This is a major new law. And most Indiana residents have no idea it exists.

Personally, I think this law is long overdue. Your personal data is genuinely valuable, and it has been collected and sold for years without your knowledge.

What Does the ICDPA Cover?

The ICDPA gives you rights over your personal data held by businesses. The law outlines 15 protections for Indiana consumers, including the rights to delete personal data held by companies, opt out of targeted advertising and data sales, and request a copy of their information in a portable format. It also prohibits companies from discriminating against consumers who use those rights.

Read About: Life Jacket Laws in Indiana (2026): Rules That Could Save Your Life

Sensitive information, like health, biometric, immigration, religious, or precise location data, as well as all children’s data, cannot be processed without explicit consent.

These rights are real. You can actually use them.

Does This Law Apply to Every Business?

Not quite. There are thresholds.

The law applies to companies that do business in the state and annually either process data from at least 100,000 residents, or process data from at least 25,000 residents while deriving more than 50% of their annual revenue from the sale of personal information.

So this mainly targets larger data-handling companies. Small local businesses are generally not covered.

The ICDPA does not apply to nonprofit organizations, higher education institutions, or to entities regulated by HIPAA, meaning covered healthcare entities and their business associates are excluded.

Your Rights Under the ICDPA

Let’s break down what you can actually do.

Consumers have the right to know if a company is processing their data and to get a copy of the personal data they previously provided. Companies are also required to publish a privacy notice listing the categories of personal information they collect, process, and disclose.

Consumers have the right to correct inaccuracies in their personal data, request deletion of their data, opt out of processing for targeted advertising, and consent to the processing of sensitive personal data.

A company has 45 days to respond to your request. They may have an additional 45 days if they notify you within the first 45 days. If your request is denied, you have the right to appeal.

Penalties: What Happens When Businesses Break the Rules?

Now, here’s where things get serious.

For violations of the Deceptive Consumer Sales Act, the court can award increased damages for willful deceptive acts in an amount of three times the actual damages, or $1,000, whichever is greater. The court may also award reasonable attorney fees.

Any person who violates the terms of a court injunction must pay a civil penalty of not more than $15,000 per violation to the state. That’s not pocket change.

If a court finds that someone knowingly violated the DCSA, the Attorney General can recover a civil penalty of up to $5,000 per violation.

For the new data privacy law, the penalties are steep too. Violators could face injunctions and fines of $7,500 per incident, enforced by Indiana Attorney General Todd Rokita.

Businesses also have a 30-day cure period following notice of a violation under the ICDPA, unlike some states where violations are immediately actionable.

Special Circumstances and Exceptions

A few things worth knowing before you act.

The DCSA has some gaps. The private right of action under the DCSA does not apply to consumer transactions in real property, including construction defect claims, except for purchases of time shares and camping club memberships. If you were cheated in a home purchase or construction deal, you may need to use a different law.

Also, elderly consumers get extra protection. A senior consumer relying on an uncured or incurable deceptive act may bring an action to recover treble damages if appropriate. That means triple the usual amount.

A business has a defense if it can show the deceptive act resulted from a genuine mistake, even with reasonable procedures in place to avoid errors. In other words, honest mistakes can sometimes be a valid defense.

Read About: DUI Laws in Maryland (2026): What You Need to Know

How to Take Action

Most people don’t realize how strict these laws are. Now that you know, here’s what to do.

Step 1: Document everything. Save emails, receipts, contracts, and text messages. Write down dates and what was said. Evidence matters.

Step 2: Contact the business in writing. For DCSA claims, you must send written notice describing the problem and the harm it caused. Do this within six months of discovering the issue.

Step 3: File a complaint with the Indiana Attorney General. The Indiana Attorney General’s Consumer Protection Division mediates and investigates consumer complaints against businesses and takes legal action on behalf of the state against companies that violate Indiana’s Deceptive Consumer Sales Act.

Step 4: For data privacy complaints, consumers who believe a business has violated Indiana’s CDPA may submit a complaint to the Office of the Indiana Attorney General, including through the online portal available on the Attorney General’s website.

Step 5: Consider a lawyer. Many consumer protection attorneys work on contingency, meaning you pay nothing unless you win. The DCSA even shifts attorney fees to the business if you prevail.

Trust me, this works. The laws are there. You just have to use them.

Frequently Asked Questions

Can I sue a business myself under Indiana consumer law? Yes. Under the DCSA, you can sue a business directly and may recover at least $500, plus attorney’s fees if you win.

What if the business offers to fix the problem after I complain? You should consider the offer seriously. If you accept and the business makes things right, the case may be resolved. If they fail to actually fix it, you can still pursue legal action.

Does the new data privacy law let me sue a company directly? No. The ICDPA does not create a private right of action for violations. Only the Indiana Attorney General can enforce it. But you can file a complaint and the AG can take action on your behalf.

How long do I have to file a consumer protection complaint? The DCSA has a two-year statute of limitations, which starts running after the deceptive act occurs. However, you must send the business written notice within six months of discovering the problem or within one year of the act, whichever comes first.

What if a business claims it was just a mistake? Honest mistakes can sometimes be a defense under the DCSA. But if the business acted willfully or as part of a scheme to defraud, that defense won’t hold up.

Final Thoughts

You’re now ahead of most Indiana residents. These laws exist to protect you. But they only work if you know about them and use them.

If a business has cheated you, lied to you, or misused your data, you have real options. Document what happened. Write the business a notice. Contact the Attorney General’s office. And when in doubt, talk to a consumer protection lawyer.

Stay informed, know your rights, and don’t let dishonest businesses get away with it.