Louisiana (US)
Full entry AI-checked Checked 5 November 2026
Read this together with United States (federal), which also applies.
| Law | Citation | Status | In force from |
|---|---|---|---|
| Louisiana Data Privacy Act | Act 502 of 2026 (SB 386), La. R.S. 51:1780.1 to 1780.5 | Enacted, not yet in force | 1 January 2027 |
| Database Security Breach Notification Law | La. R.S. 51:3071 to 3077 | In force | 1 January 2006 |
| Protection of Children on Applications (app store law) | Act 185 of 2026 (HB 977), La. R.S. 51:1771 and following | Enacted, not yet in force | 1 July 2027 |
| Secure Online Child Interaction and Age Limitation Act | La. R.S. 51:1751 to 1756 (Act 456 of 2023, as amended) | In force | 1 July 2025 |
| Protection of Children’s Internet Data | La. R.S. 51:1761 to 1763 (Act 656 of 2024) | In force | 1 July 2025 |
- Louisiana Data Privacy Act: Signed on 29 May 2026. Takes effect on 1 January 2027.
- Database Security Breach Notification Law: Read with the Attorney General’s rule on notice to the office, LAC 16:III.701.
- Protection of Children on Applications (app store law): Replaces Act 481 of 2025, which never took effect. Sets age-signal and parental consent duties for app stores and developers.
- Secure Online Child Interaction and Age Limitation Act: Age checks and parental consent for under-16s on social media platforms with at least 5 million account holders. On 15 December 2025 a federal court permanently barred enforcement against ten named NetChoice members, including Meta, YouTube, Snap and X; it still binds other covered platforms.
- Protection of Children’s Internet Data: Social media platforms with over a million account holders may not show targeted ads to known minors under 18 or sell their sensitive data. The Attorney General enforces, with fines up to $10,000 per violation after a 45-day notice and cure.
Regulators
Section titled “Regulators”What builders must do
Section titled “What builders must do”Who it covers
Section titled “Who it covers”From 1 January 2027, applies to businesses that operate in Louisiana and either have annual gross revenue over $25 million, buy, receive, sell or share personal information of 75,000 or more consumers, households or devices a year, or earn at least half their revenue from selling it. Government, financial institutions and GLBA data, HIPAA covered entities, nonprofits, higher education, electric utilities and registered pollsters are exempt. Employee and business-contact data are out of scope.
Sources: legis.la.gov/legis/ViewDocument.aspx · legis.la.gov/legis/BillInfo.aspx
Lawful bases
Section titled “Lawful bases”No GDPR-style lawful bases. Give a clear privacy notice and honour rights to confirm and access, correct, delete, get a portable copy, and opt out of targeted advertising, sale and significant profiling. Reply within 45 days (one 45-day extension), free twice a year, and decide appeals within 60 days. Sensitive data needs opt-in consent, and selling it requires the notice “We may sell your sensitive personal data” (or biometric data).
Sources: legis.la.gov/legis/ViewDocument.aspx
Consent age for online services
Section titled “Consent age for online services”A child is under 13. A known child’s sensitive data must be processed in line with COPPA, and parents can use the child’s rights. The privacy act has no teen consent rule, but other laws protect minors (see children).
Sources: legis.la.gov/legis/ViewDocument.aspx
Children
Section titled “Children”Under the privacy act, a known child’s data is sensitive and follows COPPA. Social media platforms with over a million account holders may not show targeted ads to known minors under 18 or sell their sensitive data. From 1 July 2027, app developers must check users’ age categories through app store signals and rely on app store parental consent for minors. The 2023 social media age-check law can’t be enforced against the ten NetChoice members named in a December 2025 federal ruling, but still binds other covered platforms.
Sources: legis.la.gov/legis/Law.aspx · legis.la.gov/legis/Law.aspx · legis.la.gov/legis/ViewDocument.aspx · govinfo.gov/content/pkg/USCOURTS-lamd-3_25-cv-00231/pdf/USCOURTS-lamd…
Cookies and similar technologies
Section titled “Cookies and similar technologies”No cookie-consent rule. From 2027, controllers must disclose sales and targeted advertising and offer opt-outs. People can opt out through an authorised agent, including a browser setting or device-wide signal. A controller must act on it if it can verify the person and the agent, but may refuse if the request is unclear, it can’t verify Louisiana residency, it can’t process such requests, or it doesn’t honour them under other states’ laws. A signal can’t be on by default.
Sources: legis.la.gov/legis/ViewDocument.aspx
Electronic marketing
Section titled “Electronic marketing”Adds to CAN-SPAM and the TCPA. Louisiana keeps its own Do Not Call list through the Public Service Commission. Telephone solicitors must register with the commission and buy the list, and may not call numbers on it or on the national registry. Fines reach $1,500 per violation, or $3,000 if the person called is over 65. Most sales calls are barred during a declared state of emergency.
Sources: legis.la.gov/legis/Law.aspx · legis.la.gov/legis/Law.aspx · legis.la.gov/legis/Law.aspx
Breach notification
Section titled “Breach notification”Tell affected Louisiana residents in the most expedient time possible and no later than 60 days after discovering the breach, unless an investigation finds no reasonable likelihood of harm (keep that record for five years). Tell the Attorney General’s Consumer Protection Section in writing within 10 days of notifying residents, listing the names of all affected residents; late notice can be fined up to $5,000 per violation, each day counting separately. Give the Attorney General written reasons for any delay within the 60 days.
Sources: legis.la.gov/legis/Law.aspx · ag.louisiana.gov/Page/DataBreach
Registration and fees
Section titled “Registration and fees”No data protection registration or fee, and no data broker registry. Telephone solicitors register with the Public Service Commission (see marketing).
Sources: legis.la.gov/legis/ViewDocument.aspx · legis.la.gov/legis/Law.aspx
Data protection officer
Section titled “Data protection officer”No duty to appoint a data protection officer.
Sources: legis.la.gov/legis/ViewDocument.aspx
International transfers
Section titled “International transfers”Louisiana law doesn’t restrict sending personal data outside the state or the US. Federal rules are in us-federal.
Sources: legis.la.gov/legis/ViewDocument.aspx
Impact assessments
Section titled “Impact assessments”Do and document a data protection assessment for targeted advertising, selling personal data, risky profiling, sensitive data and other high-risk processing. It applies to processing from 1 January 2027 and isn’t retroactive. The Attorney General can demand it through a civil investigative demand, and it stays confidential.
Sources: legis.la.gov/legis/ViewDocument.aspx
Automated decisions and AI
Section titled “Automated decisions and AI”People can opt out of profiling (solely automated evaluation of things like their finances, health or behaviour) used for decisions with legal or similarly significant effects, such as on lending, housing, insurance, health care, education, jobs, criminal justice or basic necessities. Risky profiling also needs a data protection assessment.
Sources: legis.la.gov/legis/ViewDocument.aspx
Penalties
Section titled “Penalties”The Attorney General enforces. A violation is an unfair trade practice under the state consumer protection law, with injunctions and court-imposed civil penalties, up to $5,000 per violation where there was intent to defraud, plus up to $5,000 more against elderly or disabled people. From 1 January to 31 July 2027 only, the business gets 30 days’ notice to cure before an investigation. No private right of action. From 1 July 2027, app stores and developers face fines up to $10,000 per violation after a 45-day notice and cure, plus fees.
Sources: legis.la.gov/legis/ViewDocument.aspx · legis.la.gov/legis/Law.aspx · legis.la.gov/legis/ViewDocument.aspx
History
Section titled “History”| Date | Change |
|---|---|
| 5 November 2026 | First entry. Checked against official sources with AI assistance, then corrected after an independent AI-assisted review. |
Report a change
Section titled “Report a change”If a law, a date or a figure here has changed, open an issue with the official source. The data lives in laws/full/us-la.yaml.