Louisiana
Louisiana Consumer Privacy Act (SB 386)
Louisiana’s consumer privacy law. It gives Louisiana residents rights over their personal data and sets rules for businesses that meet its size limits.
- Status
- Starts January 1, 2027
- Citation
- La. R.S. 51:1780.1 et seq. (Act 502 of 2026)
- Official text
- Read the law(opens in a new tab)
Who it covers
Businesses with revenue over $25 million, or data of 75,000+ Louisiana consumers, households or devices, or 50%+ of revenue from selling personal information.
What it asks of your website
- A privacy notice explaining what you collect, why, who you share it with and how people use their rights.
- Let people access, delete and correct their data, and opt out of targeted ads and the sale of their data.
- Get opt-in consent before using sensitive data (health, precise location, children’s data and more).
- Offer an appeal when you turn down a privacy request.
Who has to comply, from January 1, 2027
Louisiana’s privacy law (SB 386, Act 502 of 2026) was signed on May 29, 2026 and takes effect on January 1, 2027. It applies to businesses operating in Louisiana that meet any one of these: annual gross revenue over $25 million; personal information of 75,000 or more consumers, households or devices; or 50% or more of annual revenue from selling personal information.
Nonprofits are exempt, as are state agencies, colleges, financial institutions under Gramm-Leach-Bliley and HIPAA entities.
Visitors’ rights and your deadlines
- Rights to confirm and access, correct, delete, get a portable copy, and opt out of targeted advertising, sale and significant profiling. Parents can act for a known child.
- Respond within 45 days, extendable once by 45 more. Free up to twice a year.
- Appeals: answer within 60 days, with a way to contact the Attorney General.
Opt-out signals: allowed, not required
Louisiana lets a consumer name an authorized agent to opt out through a browser setting or extension or a device setting, as long as it isn’t a default. But a business doesn’t have to comply if, among other reasons, it can’t process the request. So the law doesn’t require honoring Global Privacy Control, though honoring it is simple.
Sensitive data and children
Sensitive data needs consent, and a known child’s data (under 13) must be handled under COPPA. Consent doesn’t count if it comes from accepting general terms, hovering over or closing content, or a dark pattern. Selling sensitive or biometric data needs an extra notice. Data protection assessments apply to processing from January 1, 2027.
Enforcement
The Attorney General enforces the law under Louisiana’s Unfair Trade Practices Act; there’s no private right of action. From January 1 to July 31, 2027, the Attorney General must give written notice and 30 days to cure. After that, there’s no cure right.
Where GoConsent helps
Privacy Policy builder
A Privacy Policy with a Notice at Collection, written from your settings and your latest scan, drafted to cover the points privacy laws describe. Review it with your lawyer.
Opt-outs and requests
Your Privacy Choices with a Marketing switch, “Opt out using your email”, and a Requests tab with deadlines and reminders.
Copy and delete requests (Pro)
Visitors ask for a copy of their information or for it to be deleted from Your Privacy Choices, with a 45-day deadline, a checklist and reminders.
Children’s Privacy Policy (Pro)
A children’s privacy notice page for sites that may collect information from children under 13.
A plain-English summary, last reviewed October 26, 2026. It isn’t legal advice, and some duties depend on how your business handles data, such as security programs and answering access requests. Read the official text and talk to a lawyer about your situation.
FAQ
Questions, answered
When does Louisiana’s privacy law take effect?
January 1, 2027.
Does Louisiana require honoring Global Privacy Control?
No. It allows browser and device settings to act as an authorized agent, but a business can decline if it can’t process them.
Is there a revenue threshold?
Yes, as one of three tests: annual gross revenue over $25 million is enough on its own.
Check your site against this law
GoConsent scans your site, tells you which laws likely apply and what to fix. Free, with no visit limits.
