Louisiana Privacy & Security Compliance Guide
Signed into law — not yet in effect
Louisiana Data Privacy Act (SB 386, Act 502 of 2026)
Takes effect January 1, 2027
The law takes effect January 1, 2027. Until July 31, 2027, the Attorney General must give 30 days' notice to cure before investigating; after that date there is no cure period.
The revenue test catches more businesses
Louisiana's law applies to any company doing business in the state with more than $25 million in annual revenue, even if it handles little Louisiana data. Other firms are covered at 75,000 consumers, households or devices.
- Offer opt-outs for targeted advertising and sales, and honor verified browser-based opt-outs sent by authorized agents.
- Get opt-in consent before processing sensitive data.
- If you sell sensitive or biometric data, post the required NOTICE statement.
- Collect only data reasonably necessary for the purposes you disclose.
Violations count as unfair trade practices under LUTPA. See every January 1, 2027 change or scan your site.
Louisiana at a Glance
4.6 million
Population
30 days until Jul 31, 2027
Cure Period
Up to $5,000 per violation
LUTPA penalty (intent to defraud)
Who Must Comply in Louisiana?
Louisiana Data Privacy Act (SB 386, Act 502 of 2026) (from January 1, 2027):
Businesses that do business in Louisiana and meet any one test: more than $25 million in annual gross revenue; buying, receiving, selling or sharing the personal information of 75,000+ consumers, households or devices a year; or earning 50%+ of annual revenue from selling personal information; nonprofits, colleges, HIPAA entities and financial institutions are exempt.
- Applies to businesses that collect personal data of Louisiana residents and meet the law's applicability thresholds — wherever the business is located
- Enforced by the Louisiana Attorney General
- Website essentials: an accurate privacy notice, working opt-out links, and consent before sensitive-data processing
Louisiana-Specific Requirements
Consumers gain rights to confirm, access, correct, delete and port their data, to opt out of targeted advertising, sale and significant-decision profiling, and to appeal. Sensitive data needs opt-in consent, and businesses that sell sensitive or biometric data must post a notice such as 'NOTICE: We may sell your sensitive personal data.' Opt-outs sent by an authorized agent through a browser setting or global device setting must be honored when they can be verified. Data minimization duties and data protection assessments for high-risk processing apply from January 1, 2027.
Recent Louisiana Privacy & Security Cases
SB 386 signed May 29, 2026 as Act 502 — Louisiana's first comprehensive consumer privacy law
Major Louisiana Business Centers
Key cities where privacy compliance is critical for business success:
- New Orleans
- Baton Rouge
- Shreveport
- Lafayette
- Lake Charles
Test Your Louisiana Website's Privacy & Security Compliance
Don't wait for regulators or hackers. Check your compliance status now.
Free Privacy Scan →Last reviewed November 6, 2026. See all upcoming privacy deadlines or compare every state. This page is general information, not legal advice.