Privacy
Louisiana Data Privacy Act
The act applies to a person or entity that does business in Louisiana and meets one or more of these thresholds: annual gross revenues over $25 million; annually buying, receiving, selling, or sharing for commercial purposes the personal information of 75,000 or more consumers, households, or devices; or deriving 50 percent or more of annual revenues from selling consumers' personal information. It does not apply to state agencies and political subdivisions, Gramm-Leach-Bliley financial institutions, HIPAA covered entities and business associates, nonprofit organizations, institutions of higher education, electric public utilities, or registered public opinion pollsters. Governor Jeff Landry signed it on May 29, 2026, and it takes effect January 1, 2027.
What the website needs
- A controller must provide a reasonably accessible and clear privacy notice listing the categories of personal data processed (including sensitive data), the purpose of processing, how consumers can exercise their rights and appeal, the categories of personal data sold to third parties and the categories of third parties, and the methods for submitting requests (R.S. 51:1780.4(B)(1)).
- A controller that sells sensitive personal data must post the notice "NOTICE: We may sell your sensitive personal data." in the same manner as its privacy notice, and one that sells biometric data must post "NOTICE: We may sell your biometric personal data." (R.S. 51:1780.4(B)(2) and (3)).
- A controller that sells personal data or processes it for targeted advertising must clearly and conspicuously disclose that processing and how to opt out (R.S. 51:1780.4(C)).
- A controller must offer two or more secure and reliable methods for submitting rights requests, may not require a new account, and must provide a request mechanism on its website if it maintains one; an exclusively online controller with a direct consumer relationship only has to provide an email address (R.S. 51:1780.3(E)).
