May 21, 2026
On May 20, 2026, the Louisiana legislature unanimously passed Senate Bill 386, the Louisiana Data Privacy Act, which would establish a comprehensive state consumer privacy framework that largely mirrors other state privacy laws such as those in Virginia, Texas, and Colorado, while incorporating some California-style thresholds and opt-out mechanics. If signed by the Governor, the law would apply to businesses operating in Louisiana that meet specified revenue or data-processing thresholds, including entities with more than $25 million in annual gross revenue, those processing the personal data of 75,000 or more consumers, households, or devices, or those deriving at least 50 percent of their annual revenue from selling personal data. The effective date would be January 1, 2027.
The bill grants Louisiana consumers core privacy rights, including the rights to access, correct, delete, and obtain portable copies of personal data, as well as opt out of targeted advertising, the sale of personal data, and certain automated profiling decisions producing legal or similarly significant effects. Controllers would be required to respond to verified consumer requests within 45 days, maintain appeal mechanisms, provide privacy notices, limit data collection to what is reasonably necessary, implement reasonable data security safeguards, and obtain consent before processing sensitive personal data. The bill also requires data protection assessments for higher-risk processing activities, including targeted advertising, profiling, sale of personal data, and processing of sensitive data.
Notably, S.B. 386 contains broad exemptions common to other state privacy statutes, including exemptions for GLBA-regulated financial institutions and data, HIPAA-covered entities and health data, FCRA-regulated activity, FERPA-covered data, employment data, nonprofits, higher education institutions, and state agencies. It also expressly prohibits the use of dark patterns to obtain consent and recognizes technology-based opt-out requests submitted through authorized agents, browser settings, or device-level signals, so long as the consumer affirmatively elects the setting.
Enforcement authority would rest exclusively with the Louisiana Attorney General. Violations would constitute unfair and deceptive trade practices, but the bill does not create a private right of action. The legislation includes a temporary cure period from January 1, 2027, through July 31, 2027, requiring written notice and an opportunity to cure before the Attorney General may initiate an investigation. Overall, S.B. 386 would place Louisiana in line with the growing number of states adopting broad consumer privacy statutes, while reinforcing controller accountability, consent requirements for sensitive data, and AG-led enforcement.