Comprehensive state privacy law
Louisiana privacy law
Louisiana Data Privacy Act
Law as of October 28, 2026 Reviewed by Sergio Maldonado Elvira on 29 October 2026
- Citation
- La. R.S. 51:1780.1 to 1780.5 (Chapter 20-B of Title 51, enacted by Act No. 502 of the 2026 Regular Session)
- Enacted
- May 29, 2026. Act No. 502 of 2026 (SB 386, 2026 Regular Session), signed by the Governor 29 May 2026
- In force
- Enacted, in force January 1, 2027
- Effective dates
- January 1, 2027: whole act (Act 502, Section 2)
- January 1, 2027: data protection assessments required for processing activities as of this date, not retroactive (R.S. 51:1780.4(E)(7))
- January 1, 2027: 30-day notice-and-cure period runs from this date to 31 July 2027 (R.S. 51:1780.5(D))
- Enforcer
- Attorney General
- Private right of action
- No. Violations are unfair trade practices under the Unfair Trade Practices and Consumer Protection Law, but the private actions under R.S. 51:1409 and 1409.1 are expressly excluded (R.S. 51:1780.5(C)).
- Cure period
- 30 days. Ends July 31, 2027. From 1 January 2027 to 31 July 2027 the Attorney General must give written notice at least 30 days before starting an investigation; no investigation may begin if the person cures, gives a written statement with supporting documentation, and changes internal policy if needed. No cure period after 31 July 2027. (La. R.S. 51:1780.5(D))
- Rulemaking
- No. No rulemaking power; the Attorney General must post information on controller and processor duties and consumer rights (R.S. 51:1780.5(B)).
Amendments
No amendments recorded.
Topics
- ApplicabilityUnlike most state laws, Louisiana uses California-style thresholds. The Act applies to a person or entity doing business in Louisiana that has annual gross revenues over $25 million, or annually buys, receives, sells or shares for commercial purposes the personal information of 75,000 or more consumers, households or devices, or derives 50% or more of annual revenue from selling consumers' personal information. State agencies, GLBA financial institutions and affiliates, HIPAA covered entities and business associates, nonprofits, higher education, electric public utilities and registered pollsters are excluded, and many data types are exempt.
- Consumer rightsConsumers may confirm processing and access their data, correct it, delete it, obtain a portable copy of data they provided (if held digitally), and opt out of targeted advertising, sale and profiling for decisions with legal or similarly significant effects. Controllers must respond within 45 days, extendable once by 45 days, and answer appeals in writing within 60 days. Responses are free up to twice a year and controllers must offer at least two request methods. An authorized agent, including a browser setting or global device setting, may opt out on the consumer's behalf, subject to conditions.
- Sensitive dataControllers may not process sensitive data without consent, and a known child's sensitive data must be processed under COPPA. Sensitive data covers racial or ethnic origin, religious beliefs, mental or physical health diagnosis, sexuality, citizenship or immigration status, genetic or biometric identifiers, data collected from a known child (under 13) and precise geolocation within 1,750 feet. Controllers that sell sensitive or biometric data must post a set notice, and data sellers meeting the 50% revenue threshold need prior consent to sell sensitive data.
- Controller dutiesControllers must limit collection to what is adequate, relevant and reasonably necessary for disclosed purposes, keep reasonable security, and get consent for incompatible new purposes. The privacy notice must cover categories of data, purposes, how to exercise and appeal rights, categories of data sold and of buyers, and the request methods. Data protection assessments are required from 1 January 2027 for targeted advertising, sales, risky profiling, sensitive data and other high-risk processing. Opt-out signals sent through an authorized agent technology must be honoured if the controller can verify them, with several exceptions.
- ProcessorsProcessors must follow controller instructions and help with consumer requests, security and breach notification under Louisiana's breach law, and assessments. A contract must set out clear instructions, nature and purpose, data types, duration and both parties' rights and obligations. It must also require confidentiality, deletion or return after the service, compliance information, cooperation with assessments (or an independent assessment), and written flow-down contracts with subcontractors.
- EnforcementThe Attorney General enforces the Act. A violation is an unfair and deceptive trade practice under the Unfair Trade Practices and Consumer Protection Law, but private actions under that law are excluded. Under that law a court may impose civil penalties, up to $5,000 per violation where it finds intent to defraud, with an additional penalty where victims are elderly or disabled. From 1 January to 31 July 2027 only, the Attorney General must give 30 days' notice and allow a cure before investigating.
Sources
Law as of October 28, 2026.
Reviewed by Sergio Maldonado Elvira on 29 October 2026. Prepared from the official sources listed.
Official text of the Louisiana statute
Reference material, not legal advice.