Louisiana Privacy Law

The Louisiana Data Privacy Act was enacted as Senate Bill 386 of the 2026 Regular Session (Senator Patrick Connick and co-authors) and became Act 502 when Governor Jeff Landry signed it on May 29, 2026, according to the Louisiana Legislature's bill history. The bill passed the Senate 36-0 and the House 94-0, and the Senate concurred in the House amendments 34-0 on May 20, 2026. The act creates Chapter 20-B of Title 51 of the Louisiana Revised Statutes (La. R.S. 51:1780.1–1780.5) and takes effect on January 1, 2027 (Act 502, Section 2). It follows Oklahoma (March 2026) and Alabama (April 2026) as the third comprehensive state privacy law signed in 2026.

Louisiana borrowed its coverage test from California rather than Virginia. The act applies to a person or entity that does business in Louisiana and meets one or more of three thresholds: annual gross revenues in excess of $25 million; annually buying, receiving for commercial purposes, selling, or sharing the personal information of 75,000 or more consumers, households, or devices; or deriving 50 percent or more of annual revenues from selling consumers' personal information (La. R.S. 51:1780.2(A)). Because the revenue test is not limited to Louisiana revenue, any business above $25 million that does business in the state is covered. Entity-level exemptions are broad: state agencies and political subdivisions, financial institutions and their affiliates subject to Title V of the Gramm-Leach-Bliley Act, HIPAA covered entities and business associates, nonprofit organizations, public and private institutions of higher education, electric public utilities, and registered public-opinion pollsters.

Consumers may confirm and access their personal data, correct it, delete it (including data obtained about them from other sources), obtain a portable copy of data they provided, and opt out of targeted advertising, the sale of personal data, and solely automated profiling in furtherance of decisions with legal or similarly significant effects (La. R.S. 51:1780.3). Controllers must respond within 45 days, extendable once by 45 days, must answer requests free of charge up to twice a year per consumer, and must decide appeals within 60 days. Sensitive data — racial or ethnic origin, religious beliefs, mental or physical health diagnosis, sexuality, citizenship or immigration status, genetic or biometric identifiers, a known child's data, and precise geolocation within 1,750 feet — may not be processed without consent. Several features come directly from the Texas Data Privacy and Security Act: consumers may opt out through an authorized agent such as a browser setting, browser extension, or global device setting; controllers that sell sensitive or biometric data must post the notices "NOTICE: We may sell your sensitive personal data." and "NOTICE: We may sell your biometric personal data."; and data protection assessments are required for targeted advertising, sales, risky profiling, and sensitive data processing beginning January 1, 2027.

The Attorney General enforces the act, and a violation is an unfair or deceptive trade practice under the Louisiana Unfair Trade Practices and Consumer Protection Law (LUTPA), with the private rights of action in that law expressly excluded (La. R.S. 51:1780.5(C)). The act sets no penalty amount of its own. Under LUTPA, a court may impose a civil penalty and, where it finds the practice was entered into with intent to defraud, up to $5,000 per violation, plus up to an additional $5,000 per violation committed against an elderly person or a person with a disability (La. R.S. 51:1407(B)-(C)). From January 1 through July 31, 2027 only, the Attorney General must give written notice at least 30 days before opening an investigation, and may not investigate if the business cures the violation within those 30 days, confirms the cure in writing with supporting documentation, and changes internal policy where needed (La. R.S. 51:1780.5(D)).

Most state privacy laws enacted since 2021 copy Virginia's two consumer-count tests. Louisiana instead tracks the original California Consumer Privacy Act: under La. R.S. 51:1780.2(A), the act applies to a person or entity that does business in Louisiana and has annual gross revenues in excess of $25 million, or annually buys, receives for commercial purposes, sells, or shares the personal information of 75,000 or more consumers, households, or devices, or derives 50 percent or more of its annual revenues from selling consumers' personal information. Meeting any one test is enough.

The revenue test is the one that catches businesses off guard. It is not limited to revenue earned in Louisiana, so a national retailer, software company, or manufacturer with more than $25 million in total revenue that does business in Louisiana is covered even if it has relatively few Louisiana customers. The 75,000 count also counts households and devices, not just people. On the other side of the line, nonprofits and higher education institutions — public and private — are exempt entirely.

• Annual gross revenues in excess of $25 million — La. R.S. 51:1780.2(A)(1)
• 75,000 or more consumers, households, or devices bought, received, sold, or shared — § 1780.2(A)(2)
• 50% or more of annual revenues from selling personal information — § 1780.2(A)(3)
• No payment-transaction exclusion and no small-business size test

Louisiana's cure right lasts only from January 1 through July 31, 2027. During that window the Attorney General must notify a business in writing, at least 30 days before initiating an investigation, of the specific provisions it allegedly violated, and may not investigate if the business cures the violation within 30 days, provides a written statement that it did so, submits supporting documentation, and changes its internal policy where necessary (La. R.S. 51:1780.5(D)). From August 1, 2027, there is no statutory cure right at all. Businesses that intend to rely on the cure period should treat it as a transition aid, not a compliance strategy.