In May 2026, lawmakers passed the Louisiana Data Privacy Act (LDPA), a consumer data privacy law built to protect the personal information of residents of the state.
It outlines obligations and rules entities must follow to collect, process, and use the personal information of Louisiana consumers.
You can learn how this law might impact your business in our comprehensive guide.
Key Takeaways
- The Louisiana Data Privacy Act outlines obligations and requirements businesses must follow to process personal information of Louisiana residents,
- Businesses must present Louisiana users with an adequate privacy policy,
- You must also obtain adequate consent for specific types of data processing.
- This new U.S. state data privacy law enters into force on January 1, 2027.
What Is the Louisiana Data Privacy Act (LDPA)?
The Louisiana Data Privacy Act is a new consumer data privacy law for the state of Louisiana that was officially signed in May 2026.
It grants Louisiana residents new rights and control over how entities collect, process, and use their personal data.
It also outlines obligations and requirements those entities must meet when performing any data processing.
When is the LDPA Effective?
The new Louisiana data privacy law becomes effective on January 1, 2027.
What Does the LDPA Cover?
The LDPA covers the personal data of residents of the state of Louisiana acting in an individual or household context.
Entities that want to collect data from Louisiana residents who meet the thresholds of this law must meet all legal requirements it outlines or are subject to fines and penalties.
What Are the Requirements of the Louisiana Data Privacy Act?
Some of the main requirements outlined by the LDPA that impact businesses and website owners include:
- Data collection limitations: Under the LDPA, you must limit data collection only to what is considered adequate, relevant, and reasonably necessary as it relates to the purposes for which you’re processing the data, as disclosed to the consumer. This means you need to explain (aka, disclose) to them what data you want to collect and why in some format, like a privacy policy.
- Security and safety measures: The law required covered entities to protect the confidentiality, integrity, and accessibility of all collected personal data by establishing administrative, technical, and physical data security practices that match the volume and nature of the personal data you collect.
- Obtain consent to process sensitive data: Covered entities cannot process sensitive data about consumers without obtaining their consent. The definition of ‘consent’ as it appears in the law is included in the table at the end of this guide.
- Disclosing the collection and or sale of sensitive data or biometric data: If you collect specific types of sensitive data, you must provide a disclosure or notice informing users that you may sell their sensitive data or biometric data.
- Rules around using data for targeted advertising: If you use consumer data to perform targeted advertising, you must disclose this to the consumer and explain how they can opt out. Using a properly configured cookie consent banner can help websites more easily align with this requirement.
- Contractual obligations between data controllers and processors: Data controllers and processors must both sign a contract outlining specific obligations regarding the data processing, including requiring the processor to delete or return all data when the contract ends, and cooperate with all parts of the law.
- Data Protection Assessments: Entities must perform DPAs if you perform targeted advertising, sell personal data, profile people, process sensitive data, or any other activities presenting a heightened risk of harm to consumers. A single assessment conducted by the entity to comply with other laws that have a similar scope and effect to the LDPA can be used.
How Will Consumers Be Impacted by the Louisiana Data Privacy Act?
Consumers are impacted by the LDPA because it grants them the following rights over their personal data:
- Right to know if a controller is processing their data,
- Right to access their data,
- Right to correct their data,
- Right to delete their data,
- Right to opt out of targeted advertising
- Right to opt out of the sale of their data
- Right to opt out of profiling
- Right to data portability
- Right to non-discrimination for following through on their privacy rights.
Consumers can submit requests to businesses to act on these rights, and those businesses must adequately respond within 45 days, with the possibility of another 45-day extension.
Who Does the Louisiana Data Privacy Act Apply To?
The LDPA applies to all residents of the state of Louisiana.
It does not apply to people in Louisiana acting in a commercial or employment context.
How Will Businesses Be Impacted by the Louisiana Privacy Law?
Along with the requirements outlined in the list above, the Louisiana Data Privacy Act also impacts businesses’ privacy policies and cookie policies.
How Will the LDPA Affect My Privacy Policy?
The Louisiana Data Privacy Act required covered entities to provide consumers with a reasonably accessible and clear privacy notice (aka, privacy policy) that explains all of the following information:
- What categories of personal data being processes, including any sensitive data,
- The purpose for the processing,
- Explanation of what rights consumers can exercise under this law, and how they can appeal the controller’s decision,
- The categories of personal data you sell to third parties,
- The categories of the third parties you sell personal data to,
- A description of the methods through which consumers can submit requests to follow through on their privacy rights.
If you collect sensitive data, you must include the following notice in the same manner as the privacy policy:
“NOTICE: We may sell your sensitive personal data.”
Similarly, if you engage in the sale of biometric data, you must present the following notice also in the same manner as your privacy policy and the other notice:
“NOTICE: We may sell your biometric data.”
How Will the LDPA Affect My Cookie Policy and Consent Management?
The LDPA may impact your website’s cookie policy and consent management in several ways.
This law gives consumers the right to opt out of targeted advertising, and you must explain to them how they’re able to do so.
This means you’ll need to present users with a cookie banner, keep logs of consumer consent choices, and properly honor those choices.
For example, you’ll need to ensure your site does not deploy any targeted advertising cookies on users’ browsers if they opt out.
The law also requires you to obtain consent from users to collect their sensitive data, so cookies that track biometrics or precise geolocation should not be deployed unless you use a solution like a cookie banner with a link to an updated cookie policy to get their express permission first.
Who Must Comply with Louisiana’s New Privacy Law?
The Louisiana Data Privacy Act applies to any entity that does business in Louisiana or targets residents of the state and has a gross revenue of more than $25 million and meets either of the following thresholds:
- Annually buys, receives for commercial purposes, sells, or shares for commercial purposes the personal information of 75,000 or more consumers, households, or devices; or
- Derives 50% or more of your annual revenues from the selling of consumer personal information.
Who is Exempt from the Louisiana Data Privacy Act?
The following entities are exempt from the LDPA:
- State agencies or political subdivisions of the state,
- Financial institutions subject to following the GLBA,
- Covered entities governed by HIPAA,
- Nonprofit organizations,
- Institutions of higher education,
- Electric public utilities,
- A person, association, partnership, or corporation registered with the secretary of state as a conductor of public opinion polls.
How Can Businesses Prepare for the Louisiana Data Privacy Act?
To prepare for the Louisiana Data Privacy Act, businesses should follow these 8 steps:
- Update your privacy policy to ensure it meets all notification requirements outlined by the law.
- Update your cookie policy to ensure it’s accurate and reflects all cookies used by your site, including those used for targeted ads.
- Ensure your cookie consent banner is properly configured for Louisiana residents so they can opt out of targeted advertising and the sale of their data.
- If you want to collect sensitive data, implement a manner to obtain consent from the Louisiana consumer.
- Add the disclosures to your privacy notice, website, and all other relevant places if you collect biometric data or sensitive information.
- Implement proper security measures to protect all data you collect from unauthorized access.
- Create and sign contracts between controllers and processors according to the details outlined in the law.
- Perform data protection assessments for specific types of data processing.
How Will the Louisiana Data Privacy Act Be Enforced?
The Attorney General will enforce the LDPA.
Violating the LDPA will be considered an unfair and deceptive trade practice under the Unfair Trade Practices and Consumer Protection Law.
Consumers do not have a private right of action.
What Are the Fines and Penalties Under the Louisiana Data Privacy Act?
Maximum fines under the LDPA could reach as high as $7,500 per incident.
Louisiana Data Privacy Act Key Terms and Definitions
To help you more fully understand the details of this guide, the table below lists some key terms from the LDPA along with their definitions exactly as they are written in the text of the law itself.
| Key Terms | Definition |
| Consent | When referring to a consumer means a clear affirmative act signifying a consumer’s freely given, specific, informed, and unambiguous agreement to process personal data relating to the consumer.
The term includes a written statement, including a statement written by electronic means, or any other unambiguous affirmative action. The term does NOT include:
|
| Consumer | An individual who is a resident of this state acting only in an individual or household context.
The term does not include:
|
| Controller | An individual or other person that, alone or jointly with others, determines the purpose and means of processing personal data. |
| Personal Data | Any information, including sensitive data, that is linked or reasonably linkable to an identified or identifiable individual. The term does not include deidentified data or publicly available information. |
| Process/Processing | An operation or set of operations performed, whether by manual or automated means, on personal data or on sets of personal data, such as the collection, use, storage, disclosure, analysis, deletion, or modification of personal data. |
| Processor | A person that processes personal data on behalf of a controller. |
| Sale of personal data | The exchange of personal data for monetary or other valuable consideration by the controller to a third party.
The term does NOT include:
|
| Sensitive Data | A category of personal data. The term includes any of the following:
|
| Targeted advertising | Displaying to a consumer an advertisement that is selected based on personal data obtained or inferred from that consumer’s activities over time and across nonaffiliated websites or online applications to predict the consumer’s preferences or interests.
The term does NOT include an advertisement that is:
|
How Will Termly Help Businesses with the Louisiana Data Privacy Act?
Termly will help businesses more easily align with laws like the LDPA by updating our products and services before Louisiana’s new law enters into force.
Our comprehensive privacy policy generator already helps businesses around the world comply with more the 20 privacy laws, including all currently in-force U.S. state level laws.
Our legally backed Consent Management Platform also enables websites to adequately manage user consent for cookies and other trackers, including third party cookies used for analytics purposes or targeted advertising.
Termly tools are incredibly easy to set up. Sign up for free today!
Natasha Piirainen is a privacy writer with a Bachelor’s Degree in English and Philosophy from Wheaton College and over 10 years of professional experience in research-driven content development.
Read all posts by Natasha Piirainen
Reviewed by Masha Komnenic CIPP/E, CIPM, CIPT, FIP
Masha Komnenic is a legal counsel and Termly’s Director of Global Privacy, who received her law degree from Belgrade University. She specializes in implementing, monitoring, and auditing business compliance with privacy regulations (HIPAA, PIPEDA, ePrivacy Directive, GDPR, CCPA, POPIA, LGPD).
Read all posts reviewed by Masha Komnenic CIPP/E, CIPM, CIPT, FIP
Generate a FREE Privacy Policy
