Regulations › US states › Louisiana
LDPA
Louisiana Data Privacy Act
WhenTakes effect 1 January 2027
Who enforces itState Attorney General (no private right of action)
Who it applies toBusinesses that process personal data of the state's residents above the law's thresholds. Thresholds, exemptions and sensitive-data rules differ by state.
ThresholdsApplies to businesses with over $25 million in annual revenue, or handling data of 75,000+ con…
Universal opt-outAuthorized agents may opt consumers out through browser settings or global device settings
Cure periodFrom January 1 to July 31, 2027, the AG must give 30 days' notice before investigating
Request deadlineControllers must respond within 45 calendar days, extendable once by 45 days
Maximum penaltyUnder LUTPA, civil penalties of up to $5,000 per violation
Private actionNo private right of action
Every requirement we score, with the rule in plain words and the section it comes from. Darker means more demanding. See every law side by side →
Who it covers
Thresholds
2
Applies to businesses with over $25 million in annual revenue, or handling data of 75,000+ consumers, households or devices, or earning 50%+ of revenue from data sales.La. R.S. 51:1780.2(A) · source ↗
Enacted as SB 386 (2026 Reg. Sess.), Act 502, signed by Gov. Landry May 29, 2026; codified at La. R.S. 51:1780.1 to 1780.5. Scored 2 because the revenue test applies alone.
Exemptions
0
Entity-level exemptions for GLBA financial institutions, HIPAA covered entities and business associates, nonprofits, higher education and utilities.La. R.S. 51:1780.2(B)-(C) · source ↗
Sensitive data and minors
Sensitive data
1
Processing sensitive data requires consent; businesses earning 50%+ of revenue from data sales also need prior consent to sell it.La. R.S. 51:1780.1(29), 51:1780.4(A)(2)(d), (P) · source ↗
Children and teens
1
A child is under 13 (COPPA); a known child's data is sensitive and needs COPPA parental consent. No teen tier.La. R.S. 51:1780.1(5), (17); 51:1780.2(E) · source ↗
Data minimization
1
Collection must be adequate, relevant and reasonably necessary to disclosed purposes; incompatible processing needs consent.La. R.S. 51:1780.4(A)(1)(a), (A)(2)(a) · source ↗
Consumers' rights
Rights
2
Confirm and access, correct, delete, portability, and opt out of targeted ads, sale and significant profiling.La. R.S. 51:1780.3(A)(2) · source ↗
Request deadline
2
Controllers must respond within 45 calendar days, extendable once by 45 days.La. R.S. 51:1780.3(B)(2) · source ↗
Appeals
2
Controllers must offer an appeal and decide it in writing within 60 days; on denial they must give the AG online complaint mechanism.La. R.S. 51:1780.3(C) · source ↗
Universal opt-out
1
Authorized agents may opt consumers out through browser settings or global device settings; controllers must honor them only if identity, authority and residency can be verified.La. R.S. 51:1780.3(E)(5)-(6) · source ↗
Qualified duty with exceptions, not a GPC-style mandate.
Business duties
Assessments
2
Assessments are required for targeted ads, sale, risky profiling, sensitive data and other heightened-risk processing; the AG may obtain them by demand.La. R.S. 51:1780.4(E) · source ↗
Applies to processing activities as of January 1, 2027.
Processor contracts
2
Contract with instructions, data types, duration, confidentiality, return or deletion, assessments and written subcontractor flow-down; an independent assessor report is an alternative.La. R.S. 51:1780.4(D) · source ↗
Privacy notice
2
Standard notice contents plus separate notices if the controller may sell sensitive data or biometric data.La. R.S. 51:1780.4(B)-(C) · source ↗
Loyalty programs
1
Different prices or features allowed for opt-outs within bona fide loyalty, rewards, premium, discount or club card programs.La. R.S. 51:1780.4(A)(3) · source ↗
De-identified data
3
Deidentified data needs safeguards, a public commitment and contract flow-down; pseudonymous data is exempt from certain duties if kept separate; recipients must be monitored.La. R.S. 51:1780.4(F), (O) · source ↗
Enforcement
Who enforces
1
Attorney General enforces violations as unfair and deceptive trade practices under LUTPA.La. R.S. 51:1780.5(A)-(C) · source ↗
Cure period
2
From January 1 to July 31, 2027, the AG must give 30 days' notice before investigating; a documented cure prevents investigation.La. R.S. 51:1780.5(D) · source ↗
Cure period sunsets after July 31, 2027.
Maximum penalty
1
Under LUTPA, civil penalties of up to $5,000 per violation.La. R.S. 51:1780.5(C); 51:1407 · source ↗
The Act sets no amount; the $5,000 LUTPA figure is from WilmerHale and La. R.S. 51:1407 was not read directly.
Private action
0
No private right of action; LUTPA private suits under R.S. 51:1409 and 1409.1 are expressly excluded.La. R.S. 51:1780.5(C) · source ↗
Rulemaking
0
No rulemaking authority.La. R.S. 51:1780.1 to 1780.5 · source ↗
No rulemaking provision found.
Scores are our reading on the published rubric, checked 18 October 2026. Not legal advice.
Regulations library
Every US state privacy law, on one map
24 states have a comprehensive privacy law in the library, alongside the EU, UK, US federal and global laws: 102 in all, each explained in plain words with its sources. Select a state to see what applies there.
- In force
- Coming into force
- Sector laws