Can you scan IDs in Indiana?
Indiana law does not regulate a business’s practice of scanning IDs or retaining information obtained from a scan.
There are some instances in which merchants are required to record information related to identity, such as scrap metal and automotive salvage sales. ID scanning can improve the ease and accuracy of record keeping in these scenarios.
Overview of Indiana ID Scanning Law
In the absence of any statute governing issues associated with a business’s practice of scanning IDs, a business is likely allowed to scan IDs and to retain information obtained from a scan, subject to applicable privacy laws.
Does Indiana offer affirmative defense for ID scanning?
Indiana does not reference affirmative defense for ID scanning in any applicable laws or statutes.
Indiana Code Title 7.1. Alcohol and Tobacco § 7.1-5-7-4.5
As used in this section, “ID card” means any of the following:
- A driver’s license.
- A photographic identification card issued under IC 9-24-16-1 or a similar card issued under the laws of another state or the federal government.
- A government issued document bearing an individual’s photograph.
(b) As used in this section, “permittee” means a person who holds a valid permit under this title, including an employee of a permittee.
(c) A permittee may retain an ID card that was provided to the permittee by a person as proof of age for making a purchase of an alcoholic beverage, if the permittee has:
- received alcohol server training under IC 7.1-3-1.5; and
- a reasonable belief that the ID card:
(A) has been altered or falsified; or
(B) was not issued to the person who provided the ID card to the permittee.
If the permittee retains an ID card, the permittee shall do the following:
- Issue a receipt to the person who provided the ID card. The receipt must state the date and the hour that the permittee retained the ID card.
- Not later than twenty-four (24) hours after the ID card is retained, provide:
(A) the ID card; and
(B) a written statement of the facts and circumstances surrounding the permittee’s retention of the ID card;
to a state or local law enforcement agency that has jurisdiction where the permit premises is located.
(e) If the law enforcement agency does not:
- initiate an investigation; or
- find that probable cause exists;
as to any violation of section 1, 3, or 4 of this chapter, the law enforcement agency shall release the ID card to the person who was issued the ID card.
A permittee is not subject to criminal liability or civil liability for retention of an ID card in accordance with this section. A permittee is not immune from civil or criminal liability for using force against a person in order to obtain an ID card.
Indiana Code § 9-32-9-29. Purchase of vehicle for scrap metal or parts.
(b) An automotive salvage recycler shall maintain the following information with respect to each motor vehicle purchase transaction without a certificate of title to which the automotive salvage recycler is a party for at least five (5) years after the date of the purchase transaction:
(8) The name, date of birth, and address of the person from whom the motor vehicle is being purchased.(9) A photocopy or electronic scan of one (1) of the following valid and unexpired forms of identification issued to the seller or the seller’s agent:(A) A driver’s license.(B) An identification card issued under IC 9-24-16-1, a photo exempt identification card issued under IC 9-24-16.5, or a similar card issued under the laws of another state or the federal government.(C) A government issued document bearing an image of the seller or seller’s agent, as applicable.
For purposes of complying with this subdivision, an automotive salvage recycler is not required to make a separate copy of the seller’s or seller’s agent’s identification for each purchase transaction involving the seller or seller’s agent but may instead refer to a copy maintained in reference to a particular purchase transaction.
Indiana Senate Bill 549. Health Record Information
Health record information. Amends the definition of “abandoned” for purposes of protection of health records possessed by a health care provider or a former health care provider. Permits the attorney general to file an action against a health care provider or former health care provider to recover incurred costs related to abandoned records. Applies current law concerning data base security to a health care provider or former health care provider who is a data base owner currently exempt from the law if the data base owner does not have or implement a plan to safeguard personal information after ceasing to be a covered entity under the federal Health Insurance Portability and Accountability Act.
Indiana Senate Bill 5. Consumer Data Protection
Enacts consumer data protection. The new article in the Indiana Code put in place multiple protections to ensure consumer privacy. Taking effect January 1, 2026 it sets forth the following within the new article: (1) Definitions of various terms that apply throughout the article. (2) Exemptions from the bill’s requirements concerning the responsibilities of controllers of consumers’ personal data. (3) The rights of an Indiana consumer to do the following: (A) Confirm whether or not a controller is processing the consumer’s personal data. (B) Correct inaccuracies in the consumer’s personal data that the consumer previously provided to a controller. (C) Delete the consumer’s personal data held by a controller. (D) Obtain a copy or representative summary of the consumer’s personal data that the consumer previously provided to the controller. (E) Opt out of the processing of the consumer’s personal data for certain purposes. (4) The responsibilities of controllers of consumers’ personal data. (5) The roles of controllers and processors with respect to a consumer’s personal data. (6) Requirements for data protection impact assessments by controllers of consumers’ personal data. (7) Requirements for processing de-identified data or pseudonymous data. (8) Limitations as to the scope of the new article. (9) The authority of the attorney general to investigate and enforce suspected or actual violations of the new article. (10) The preemption of local rules, regulations, and laws regarding the processing of personal data. Allows the attorney general to publish certain resources on the attorney general’s website.