Louisiana has joined the fast-growing list of states with a comprehensive consumer data privacy law. On May 29, 2026, Governor Jeff Landry signed Senate Bill 386 (Act No. 502), the Louisiana Data Privacy Act (the “LDPA”). The law takes effect January 1, 2027. If your company collects personal information from Louisiana residents, the clock is already running. Below is a plain-language guide to who the law covers, what it requires, and the practical steps businesses should take now.
Does the LDPA Apply to Your Business?
The LDPA applies to any person or entity that conducts business in Louisiana and meets at least one of these three thresholds:
- Annual gross revenue exceeding $25 million;
- Annually buys, receives, sells, or shares the personal information of 75,000 or more consumers, households, or devices; or
- Derives 50% or more of annual revenue from selling consumers’ personal information.
Louisiana, borrowing from California, makes revenue alone enough — meaning a company can be covered even if it processes very little Louisiana consumer data. Further, because the $25 million figure is not indexed to inflation, its reach will expand over time.
Who Is Exempt?
The LDPA carries a familiar set of entity-level exemptions. These include state agencies and political subdivisions of Louisiana, financial institutions and data governed by the Gramm-Leach-Bliley Act, HIPAA-covered entities, nonprofit organizations, institutions of higher education, electric public utilities, and, in a Louisiana-specific wrinkle, persons or entities registered with the Secretary of State as conductors of public opinion polls.
Because these exemptions depend on entity type and data category, a careful, fact-specific analysis is essential.
What Rights Do Consumers Gain?
Controllers, i.e., those individuals or companies who determine the purpose and means of processing personal data, must honor a now-standard set of consumer rights. Louisiana residents may:
- Confirm whether a business is processing their personal data and access it;
- Correct inaccuracies;
- Delete their personal data;
- Obtain a portable copy of the data they provided; and
- Opt out of processing of the personal data for purposes of targeted advertising, the sale of personal data, and certain profiling.
Controllers generally must respond to these requests within 45 days, with one 45-day extension when reasonably necessary. The LDPA also requires companies to honor browser-based opt-out preference signals, so consumers can exercise opt-out choices automatically rather than site by site.
What Businesses Must Do to Comply
Beyond responding to consumer requests, the LDPA imposes several affirmative obligations on covered businesses:
- Privacy notice. Controllers must publish a clear, accessible privacy notice describing the categories of data processed, the purposes for processing, how consumers exercise their rights, and, if applicable, the categories of data sold and the third parties who receive it.
- Sensitive-data consent. Businesses must obtain opt-in consent before collecting or processing “sensitive data,” a category that includes data revealing race, ethnicity, religion, health diagnoses, sexuality, citizenship or immigration status, genetic and biometric identifiers, precise geolocation, and data from children under 13.
- Data minimization. Controllers may collect only the personal data that is adequate, relevant, and reasonably necessary for the purposes they have disclosed.
- Data protection assessments. Businesses must conduct and document data protection assessments for higher-risk activities, including targeted advertising, the sale of personal data, certain profiling, and the processing of sensitive data.
How Is the Law Enforced?
The LDPA is enforced exclusively by the Louisiana Attorney General. There is no private right of action, so individual consumers cannot sue for violations. Instead, a violation is treated as an unfair and deceptive trade practice under Louisiana’s consumer protection law, and the Attorney General may pursue injunctive relief and civil penalties.
Businesses do get a limited grace period, but a narrow one. From January 1, 2027 through July 31, 2027, the Attorney General must give a company written notice and a 30-day opportunity to cure before initiating an investigation. After July 31, 2027, that cure right disappears.
Practical Steps to Take Now
With the effective date approaching, businesses that may be covered should not wait and can take the following steps now:
- Assess applicability. Determine whether the $25 million revenue trigger or either data threshold brings your company into scope and revisit that analysis as revenue increases.
- Map your data. Identify what personal and sensitive data you collect from Louisiana residents, why, and with whom you share or sell it.
- Update your privacy notice. Add the Louisiana-specific disclosures, including the required sensitive-data and biometric-data sale notices if they apply.
- Build the request workflow. Make sure your intake, verification, response, and appeal processes cover Louisiana residents within the statutory deadlines and recognize opt-out preference signals.
- Review vendor contracts. Confirm that agreements with service providers who process personal data on your behalf contain the processing terms the law requires.
January 1, 2027 is closer than it seems, and businesses that may be covered should start preparing now. With the LDPA, Louisiana joins a growing majority of states in regulating how companies collect, use, and share consumer data.