An overview of the new Louisiana Data Privacy Act 

On May 29, 2026, Governor Jeff Landry signed the Louisiana Data Privacy Act (LDPA) into law, joining Louisiana in the select group of states with a comprehensive data privacy law. Bill 386 creates a new chapter of Title 51 of the Louisiana Revised Statutes and will take effect on January 1, 2027.

Scope and applicability

The LDPA applies to any person or entity that conducts business in Louisiana and meets at least one of the following:

• Has an annual gross revenue exceeding $25 million;
• Annually buys, “receives for commercial purposes,” sells, or shares the personal information of 75,000 or more consumers, households, or devices; or
• Derives 50% or more annual revenue from selling consumers’ personal information.

These thresholds are similar to the California Consumer Privacy Act (CCPA) and notably uses the undefined term “personal information” rather than the LDPA’s defined term “personal data.” Because the applicability test is based on revenue without reference to the volume of processed data, the new law may affect businesses in unexpected ways, including some business-to-business companies.

Additionally, the LDPA distinguishes itself from other state laws by applying only to entities that “do business” in Louisiana rather than “target” Louisiana residents, which may narrow the law’s reach. The law also includes both broad entity-level and data-level exemptions, including:

• State agencies
• GLBA-regulated financial institutions
• HIPAA-covered entities and business associates
• Nonprofits
• Higher education institutions
• Data involving regulated by HIPAA, FERPA, GLBA, and more

Consumer rights

The LDPA grants Louisiana residents the right to:   

• Access: confirm whether a controller processes their personal data and obtain a copy
• Correct: request correction of inaccurate personal data
• Delete: request deletion of personal data
• Opt out: opt out of the sale of personal data, targeted advertising, and profiling that produces significant legal or similarly significant effects
  • Processing of sensitive data will require op-in consumer consent
• Portability: obtain their data in a portal format where technically feasible

Data controllers must respond to consumer requests within 45 days. A single 45-day extension will be available. If a data controller declines to act on the request, then it might inform the consumer of the decision and the justification. The controller must also provide information on how to appeal the decision. Controllers are not required to comply with a rights request that they cannot authenticate. This authentication requirement extends to consumer opt-outs, too. Notably, the LDPA does not require controllers to provide consumers the ability to revoke previously given consent.

Businesses and privacy professionals should note that commentators differ on the universal opt-out signals. Several read the LDPA to require controllers to honor browser-based mechanisms like Global Privacy Control, while others read the law as it does not expressly mandate recognition of such signals.

Business obligations

Under the LDPA, controllers are required to provide a clear and reasonably accessible privacy notice disclosing the following:

1. The types of personal data processed;
2. The purpose of processing the data;
3. The categories of data sold to third parties;
4. The categories of third parties receiving the data; and
5. The methods for submitting rights requests.

The LDPA also imposes data minimization and purpose limitation obligations, requiring reasonable administrative, technical, and physical security safeguards. Controllers must conduct and document data protection assessments for higher-risk activities such as targeted advertising, the sale of personal data, certain profiling, and the processing of sensitive data. Processor contracts are required to include specified terms such as processing instructions, confidentiality obligations, data return or deletion procedures, audit rights, and subcontractor flow-down requirements. If requested in a civil investigative demand, a controller must make a data protection assessment available to the Louisiana Attorney General.

Enforcement

The LDPA is exclusively enforced by the Louisiana Attorney General with no private right of action. The Attorney General may seek injunctive relief and civil penalties of up to $5,000 per violation as violations constitute unfair and deceptive trade practices. The LDPA does not grant the Attorney General rulemaking authority.

Controllers will be granted a 30-day cure period from January 1, 2027 through July 31, 2027. However, the cure period sunsets on July 31, 2027, after which the Attorney General may pursue violations without offering an opportunity to cure.

AI Implications

Although the LDPA is not an AI-specific statute, it may still impact AI-driven processing, particularly systems businesses use for profiling and automated decision-making. Under the LDPA, consumers may opt out of profiling “in furtherance of a decision that produces a legal or similarly significant effect,” which has been understood to include decisions affecting financial services, housing, insurance, healthcare, education, employment, criminal justice, or access to basic necessities. Businesses that utilize AI or other algorithmic tools for these types of decisions will need to build processes that recognize and honor those consumer opt-outs.

Additionally, profiling that presents a reasonably foreseeable risk of harm is a trigger for the LDPA’s mandatory data protection assessment, which means that businesses should document how their AI or algorithmic models work and weigh the benefits of processing the data against the risk to consumers before deploying these models. Companies conducting business in Louisiana and utilize AI tools on Louisiana residents’ data should analyze their automated decision-making systems, confirm their privacy notices and assessment processes, and monitor for guidance ahead of the January 1, 2027 effective data.

McDonald Hopkins will continue to monitor developments and guidance from applicable regulators as we near the LDPA’s effective date.