Louisiana Residents Get New Rights Over Their Personal Data in January. Who Is Left Out?

Who knows more about your family's habits: you, or the companies that collect your data?

Starting January 1, 2027, Louisiana residents get legal tools to find out and push back. SB386, the Louisiana Data Privacy Act, passed both chambers without a single no vote.

You can confirm whether a covered business holds your personal data, and you can see what it holds. You can correct it, delete it, and get a portable copy. You can opt out of three uses: targeted advertising, the sale of your data, and profiling that produces legal or similarly significant effects on you. A parent or guardian can exercise these rights for a known child.

Businesses need your consent before they process sensitive data, and for a known child they must follow the federal children's online privacy law, COPPA. They must limit what they collect, keep it reasonably secure, publish a privacy notice, and treat you the same after you exercise your rights. A business that does targeted advertising, sells data, profiles consumers, or processes sensitive data must complete a data protection assessment.

The law reaches businesses that meet at least one threshold: more than $25 million in gross revenue, data on 75,000 or more consumers, households, or devices, or at least half of their revenue from selling personal information.

Where a business is registered does not matter. A company incorporated in Delaware or Nevada is covered if it does business in Louisiana and meets one of those thresholds. The 75,000 count covers Louisiana consumers: the law defines a consumer as a resident of this state. The attorney general enforces the Act against covered businesses wherever they are headquartered.

It exempts state agencies and political subdivisions, financial institutions covered by federal banking privacy law, HIPAA-covered entities, nonprofit organizations, colleges and universities, electric utilities, and registered public-opinion pollsters.

Only the attorney general can enforce the Act. A violation counts as an unfair trade practice under Louisiana law, and the private lawsuit provisions of that law do not apply. From January 1 through July 31, 2027, a business gets 30 days to fix a problem before enforcement. The Act also carries a First Amendment savings clause.

Two provisions deserve attention. The state writes privacy rules for private businesses and exempts its own agencies and local governments from them. And the attorney general can demand a company's internal data protection assessments through a civil investigative demand, which puts sensitive business records in state hands during an investigation.

IPS supports SB386. It gives families real control over their data, lets parents act for their children, and keeps enforcement with the attorney general, which spares businesses a wave of private lawsuits. The nonprofit exemption keeps churches and ministries organized as nonprofits outside its reach.

Sen. Patrick Connick (R) sponsored SB386 with ten Senate coauthors and one House coauthor. It passed the Senate 36-0 and the House 94-0, and the Senate agreed to the House amendments 34-0. Governor Jeff Landry signed it May 29, 2026, as Act 502.

In January, Louisiana law will treat your data as yours. The agencies that hold the same kind of data about you are outside this Act.

This is our read of the law. We encourage you to read it yourself and reach your own conclusions.