Louisiana Enacts Data Privacy Law Effective January 2027
Louisiana passed its Data Privacy Act, effective January 1, 2027.
Why it matters: This law requires businesses meeting certain thresholds to update data handling and consumer privacy practices. It adds to the growing patchwork of U.S. state privacy laws, impacting compliance strategies for multi-state operators.
- Signed into law by Gov. Jeff Landry on May 29, 2026.
- Takes effect January 1, 2027.
- Applies to businesses with over $25M revenue, or handling data of 75,000+ consumers, or earning 50%+ revenue from selling personal info.
- Grants consumers rights like access, correction, deletion, data portability, and opt-outs for targeted ads and data sales.
- Requires consent for processing sensitive data and imposes duties on data controllers and processors.
- Enforced exclusively by the Louisiana Attorney General as unfair or deceptive trade practices.
On May 29, 2026, Louisiana Governor Jeff Landry signed the Louisiana Data Privacy Act (LDPA) into law, making Louisiana the 22nd state to enact a comprehensive consumer data privacy statute and the third state in 2026, following Oklahoma and Alabama. The LDPA will take effect on January 1, 2027, imposing new requirements on businesses operating in the state that meet specific criteria.
The LDPA applies to entities doing business in Louisiana that either have annual gross revenues exceeding $25 million, handle the personal information of 75,000 or more consumers, households, or devices annually, or derive 50% or more of their annual revenue from selling consumers' personal data.
Consumers are granted significant rights under the LDPA, including access to their personal data, correction of inaccuracies, deletion, obtaining portable copies, and opting out of targeted advertising as well as the sale of their information. Additionally, the law requires explicit consent before processing sensitive data categories such as health, biometric, genetic, and geolocation information.
Data controllers and processors must adhere to principles like data minimization and purpose limitation, implement robust security safeguards, and provide clear privacy notices. Violations of the LDPA will be treated as unfair or deceptive trade practices and enforced exclusively by the Louisiana Attorney General's office.
Experts note that while the LDPA does not introduce novel compliance obligations, it parallels laws like Texas' and contributes to the increasingly complex and fragmented U.S. privacy regulatory environment. Organizations with multi-state operations will need to update policies and contracts to remain compliant as the effective date approaches.
For more on similar state laws, see analysis at Troutman Privacy and Inside Privacy.
By the numbers:
- May 29, 2026 — Date LDPA was signed into law
- January 1, 2027 — LDPA effective date
- $25 million — Revenue threshold for applicability
- 75,000 — Minimum number of consumers, households, or devices for applicability
- 50% — Revenue derived from selling personal information for applicability
What's next: Businesses affected should prepare to implement compliance measures by January 2027.