Privacy Law Library

Louisiana Data Privacy Act

LDPA

Comprehensive privacy · Children · Health · Genetic · Biometric · Location

Louisiana's comprehensive consumer privacy law, enacted by Act 502 of the 2026 Regular Session and effective January 1, 2027. It gives Louisiana residents rights to confirm, access, correct, delete, and port their personal data and to opt out of targeted advertising, sale, and significant-decision profiling, and it requires controllers to minimize data, secure it, get consent for sensitive data, publish a privacy notice, and conduct data protection assessments. Unlike most state models, applicability turns on a $25 million revenue threshold (CCPA-style) rather than only a consumer-count threshold.

Where
Louisiana
Citation
La. R.S. 51:1780.1 to 51:1780.5 (Acts 2026, No. 502, SB 386)
Status
Enacted, not yet in force
In force since
2027-01-01
Enforced by
Louisiana Attorney General
People can sue
No
Penalties
A violation is an unfair and deceptive trade practice under LUTPA (R.S. 51:1401 et seq.), with LUTPA private actions excluded; the Attorney General may seek injunctions and civil penalties under R.S. 51:1407 (up to $5,000 per violation where intent to defraud is found, plus up to $5,000 more for violations against elders or persons with disabilities). From January 1 to July 31, 2027, the AG must give 30 days' written notice and a chance to cure before investigating.
Applies to
  • Persons or entities that do business in Louisiana and meet at least one threshold: annual gross revenue over $25 million; annually buy, receive, sell, or share for commercial purposes the personal information of 75,000 or more consumers, households, or devices; or derive 50% or more of annual revenue from selling consumers' personal information
  • Processors acting on behalf of covered controllers
  • Entity exemptions: state agencies and political subdivisions, GLBA financial institutions and affiliates, HIPAA covered entities and business associates, nonprofit organizations, institutions of higher education, electric public utilities, and registered public opinion pollsters
  • Data exemptions include PHI and health records, human subjects research data, FCRA-regulated activity, DPPA, FERPA and Farm Credit Act data, and employment-context data

What a privacy notice must say

  • Provide a reasonably accessible privacy notice listing categories of personal data (including sensitive data), purposes, how to exercise and appeal rights, categories of data sold and third-party recipients, and request methods; post specific notices if sensitive or biometric data is sold.La. R.S. 51:1780.4(B) · From 2027-01-01
  • Clearly and conspicuously disclose any sale of personal data or processing for targeted advertising and how consumers can opt out.La. R.S. 51:1780.4(C) · Only if: If the controller sells personal data or engages in targeted advertising · From 2027-01-01

Rights it gives people

  • Consumers may confirm processing and access, correct, delete, and obtain a portable copy of their personal data, and opt out of targeted advertising, sale, and profiling in furtherance of decisions with legal or similarly significant effects.La. R.S. 51:1780.3(A)(2) · From 2027-01-01

Practices it requires

  • Obtain consumer consent before processing sensitive data (including precise geolocation, genetic or biometric data, health diagnosis, and immigration status); process a known child's data in accordance with COPPA.La. R.S. 51:1780.4(A)(2)(d); 51:1780.1(29) · From 2027-01-01
  • Entities deriving 50% or more of revenue from selling personal information may not sell sensitive data without the consumer's prior consent.La. R.S. 51:1780.4(P) · Only if: Data-seller threshold entities · From 2027-01-01
  • Offer two or more secure and reliable request methods, not require new account creation, and honor opt-outs sent by an authorized agent, including browser settings or global device signals, when the agent's authority can be verified.La. R.S. 51:1780.3(E) · From 2027-01-01
  • Respond to authenticated requests within 45 days (one 45-day extension with notice), free of charge up to twice a year, and provide an appeal process with a written decision within 60 days that points the consumer to the AG complaint mechanism if denied.La. R.S. 51:1780.3(B)-(C) · From 2027-01-01
  • Limit collection to what is adequate, relevant, and reasonably necessary for disclosed purposes; do not use data for incompatible purposes without consent; do not discriminate against consumers for exercising rights.La. R.S. 51:1780.4(A)(1)(a), (A)(2)(a)-(c) · From 2027-01-01

Security duties

  • Establish, implement, and maintain reasonable administrative, technical, and physical data security practices appropriate to the volume and nature of the personal data.La. R.S. 51:1780.4(A)(1)(b) · From 2027-01-01

Other duties

  • Conduct and document data protection assessments for targeted advertising, sales, risky profiling, sensitive data processing, and other heightened-risk processing, and produce them to the AG on a civil investigative demand.La. R.S. 51:1780.4(E) · Only if: Applies to processing activities on or after January 1, 2027 · From 2027-01-01
  • Controller-processor contracts must set processing instructions, nature, purpose, duration, and data types, and bind the processor to confidentiality, deletion or return, compliance information, assessments, and flow-down to subcontractors.La. R.S. 51:1780.4(D)(2) · From 2027-01-01

Sources

Checked against these sources on 2026-09-25 by research agent (Claude), primary sources.

Unverified: The codified text of R.S. 51:1780.1-1780.5 was not yet posted on legis.la.gov (Title 51 is updated only through the 2025 First Extraordinary Session as of 2026-09-15); obligations are cited from the enrolled bill. | Whether the AG has posted the controller/consumer information required by R.S. 51:1780.5(B) was not checked.

Research reference, not legal advice.