June 18, 2026
Law: Louisiana Data Privacy Act – Act 502 / Senate Bill 386
Signed into law: May 29, 2026
Effective date: January 1, 2027
Status: Enacted; not yet effective.
Louisiana has enacted a comprehensive consumer privacy law. On May 29, 2026, Governor Jeff Landry signed Senate Bill 386 into law as Act 502, establishing the Louisiana Data Privacy Act (“LDPA”). The law takes effect January 1, 2027.
The LDPA gives Louisiana consumers rights over their personal data and requires covered businesses to address privacy notices, consumer requests, sensitive-data consent, targeted advertising, data sales, processor contracts, security, and data protection assessments.
Businesses should begin with an applicability review. Louisiana’s coverage thresholds and several operational requirements differ from those in other state privacy laws.
Which Businesses are Covered?
The LDPA applies to a person or entity doing business in Louisiana that meets at least one of these thresholds:
-
Has annual gross revenue exceeding $25 million.
-
Annually buys, receives for commercial purposes, sells, or shares for commercial purposes personal information of 75,000 or more consumers, households, or devices.
-
Derives 50% or more of annual revenue from selling consumers’ personal information.
A business does not need to meet both a revenue threshold and a consumer-data threshold. Meeting any one threshold may bring it within scope, subject to exemptions.
A “consumer” is a Louisiana resident acting in an individual or household context. The definition excludes individuals acting in commercial or employment contexts.
What Exemptions Apply?
The law exempts specified organizations, including state agencies and political subdivisions, certain financial institutions and affiliates, HIPAA-covered entities and business associates, nonprofit organizations, institutions of higher education, electric public utilities, and registered conductors of public-opinion polls.
It also exempts specified information governed by other legal frameworks, including certain health, consumer-reporting, education, driver-information, and employment-related data.
An organization-level exemption and an exemption for particular information are different. Businesses should identify which exemption applies and whether other data or activities remain covered.
What Rights will Louisiana Consumers Have?
Subject to the law’s conditions and exceptions, consumers may:
-
Confirm whether their personal data is being processed and access it.
-
Correct inaccuracies.
-
Request deletion of data provided by or obtained about them.
-
Obtain a portable copy of certain data they previously provided.
-
Opt-out of targeted advertising, personal-data sales, and profiling used for decisions producing legal or similarly significant effects.
Controllers, the organizations deciding why and how personal data is processed, generally must respond within 45 calendar days. One additional 45-day extension is permitted when reasonably necessary, provided the consumer receives timely notice and an explanation.
Controllers must also provide an appeal process. Appeal decisions must be provided within 60 calendar days, and a denied appeal must include the online mechanism for submitting a complaint to the Louisiana Attorney General. Information in response to requests generally must be provided free of charge up to twice annually per consumer.
Request Methods and Technology-Based Opt-Outs.
The law generally requires two or more secure and reliable methods for submitting privacy requests. Consumers cannot be required to create a new account, although a controller may require use of an existing account. The statute also contains website requirements and a limited provision for certain exclusively online businesses.
Consumers may designate authorized agents to opt-out of targeted advertising or data sales, including through browser settings, extensions, website links, or device settings. Controllers must honor qualifying requests when the statutory conditions are met.
This is not an unconditional requirement to recognize every signal. The law includes verification requirements and exceptions, and qualifying technology must reflect an affirmative, freely given, unambiguous consumer choice rather than a default setting. Website operators should evaluate their signal-handling systems against Louisiana’s specific rules.
Sensitive Data Requires Consent.
Controllers generally must obtain consent before processing sensitive data. For sensitive data about known children, processing must comply with applicable Children’s Online Privacy Protection Act requirements.
Sensitive data includes specified information about race or ethnicity, religion, health diagnoses, sexuality, citizenship or immigration status, identifying genetic or biometric data, known children, and precise geolocation. A child is younger than 13; “known child” includes actual knowledge or willful disregard of age.
Consent must reflect a clear, affirmative, freely given, specific, informed, and unambiguous choice. Agreement obtained through dark patterns or acceptance of broad terms containing unrelated information does not qualify.
Special Notices Apply to Sensitive-Data Sales.
Louisiana requires specific notices when a controller sells sensitive or biometric personal data.
For sensitive personal data:
NOTICE: We may sell your sensitive personal data.
For biometric personal data:
NOTICE: We may sell your biometric personal data.
These notices must be posted in the same manner as the privacy notice. They do not replace applicable consent obligations.
A “sale” includes an exchange of personal data for monetary or other valuable consideration, subject to statutory exclusions. Businesses should therefore examine actual data-sharing arrangements rather than assume no sale occurs because they do not receive cash.
What Other Obligations Apply?
Covered controllers must address several core requirements:
-
Privacy notices: Explain data categories, including sensitive data; processing purposes; consumer rights and appeals; applicable data-sale categories and recipients; and request methods.
-
Data minimization: Limit collection to what is adequate, relevant, and reasonably necessary for disclosed purposes.
-
Purpose limitation: Obtain consent for processing that is neither reasonably necessary to nor compatible with the disclosed purpose.
-
Security: Maintain reasonable administrative, technical, and physical safeguards.
-
Processor contracts: Include required processing instructions, confidentiality, deletion or return, compliance information, assessment cooperation, and subcontractor provisions.
Controllers that sell personal data or conduct targeted advertising must clearly and conspicuously disclose those practices and explain how consumers can opt-out.
Data Protection Assessments are Required.
Controllers must conduct and document assessments for specified higher-risk processing, including targeted advertising, personal-data sales, sensitive-data processing, certain risky profiling, and other processing presenting a heightened risk of consumer harm.
Assessments must weigh processing benefits against risks to consumers and consider safeguards, reasonable consumer expectations, processing context, and other statutory factors. The Attorney General may obtain assessments through investigative processes; confidentiality protections apply, and disclosure does not waive applicable attorney-client privilege or work-product protection.
The assessment requirements apply to processing activities as of January 1, 2027, and are not retroactive. Businesses should not assume that ongoing processing is exempt merely because it began before that date.
Enforcement and the Temporary Cure Period.
The Louisiana Attorney General enforces the LDPA. Violations are treated as unfair and deceptive trade practices, but the law excludes the specified private rights of action otherwise available under Louisiana’s consumer-protection framework.
From January 1 through July 31, 2027, the law provides a temporary notice-and-cure process before an investigation. To qualify, the business must correct the violation within 30 days, provide written confirmation and supporting documentation, and make necessary policy changes to prevent recurrence.
That cure process expires after July 31, 2027. It is not a postponement of the January 1 compliance deadline.
Businesses with multi-state privacy programs should incorporate Louisiana into their existing systems while accounting for its distinct thresholds, notices, opt-out provisions, assessment requirements, and temporary cure process.
For operational guidance and structured compliance documentation tools, visit the CLIClaw Privacy Compliance Library.
© 2026 CLIClaw.com
This article is for information purposes only. This article provides general information and operational commentary. It is not legal advice. Applicability and compliance obligations depend on an organization’s activities, data practices, exemptions, and circumstances. It is not intended to be and should not be relied on as legal advice for any particular matter.