Indiana Senate Bill 17

Overview

Indiana Senate Bill 17 (SB 17) establishes age verification requirements for access to adult-oriented websites containing material deemed harmful to minors. The law requires businesses operating such websites to implement reasonable age verification methods to prevent minors from accessing restricted content. Additionally, the bill outlines penalties for non-compliance and ensures that businesses cannot retain users’ age verification data beyond the verification process.

The bill was passed to enhance online child protection and hold website operators accountable for preventing minors from accessing harmful content.

Regulation Summary

Timeline

March 13, 2024 – Indiana Senate Bill 17 was signed into law.
July 1, 2024, law went into effect requiring all adult-oriented websites to comply with its verification mandates.

What Businesses Are Affected

Adult-oriented website operators that host a significant portion of content deemed harmful to minors.
Businesses providing online services containing explicit material.
Third-party age verification providers ensuring compliance with the Act.

Exemptions

News websites and news services publishing general information.
Cloud service providers that do not create or publish restricted content.
Internet service providers and search engines that only facilitate access but do not host content.

Responsibilities for Businesses

Implement a Reasonable Age Verification Method, such as:
- A mobile credential (e.g., state-issued digital ID).
- Independent third-party age verification services using official databases.
- Public or private transactional data verification methods.
Ensure secure data handling, preventing retention of user identity beyond verification.
Prevent minor access by restricting entry to age-restricted content.

Specific Responsibilities for Website Owners

Verify the age of users attempting to access restricted content.
Prevent access to minors by using secure verification methods.
Ensure compliance with data privacy laws by not storing verification data.
Use commercially reasonable security measures to protect users' data.

Additional Requirements

Transactional data may be used to verify user age if it meets security and reliability standards.
Age verification providers must comply with security requirements.
Websites must clearly disclose verification policies to users.

Individual Rights

Right to Data Protection: Individuals’ personal information used for age verification must be protected and not retained beyond the verification process.
Right to Data Deletion: Users can request the deletion of personal data used for age verification after the process is completed.
Parental Legal Action: Parents or guardians have the right to take legal action if a minor accesses restricted content due to non-compliance with age verification requirements.
Right to Seek Damages: Individuals may seek damages if their verification data is improperly stored or mishandled.

Enforcement

The Indiana Attorney General may pursue legal action against non-compliant websites.
Civil penalties of up to $250,000 for failing to implement required age verification.
Legal action by parents or guardians if a minor accesses restricted content.
Up to $5,000 in damages per violation for storing or mishandling user verification data.
Injunctions may be issued to block access to non-compliant websites within Indiana.
Penalties increase with repeated violations and intentional disregard for compliance.