Louisiana Data Privacy Act (LDPA)

The Louisiana Data Privacy Act (LDPA), enacted as Senate Bill 386, was signed into law on May 29, 2026, and takes effect on January 1, 2027. Louisiana joins the growing number of US states enacting comprehensive consumer data privacy legislation.

What Is the LDPA?

The LDPA grants Louisiana residents rights over their personal data and imposes obligations on businesses that collect or process that data. It includes opt-in consent requirements for sensitive data and a limited cure period that expires July 31, 2027, signaling Louisiana's intent to move toward stricter enforcement over time.

Who Does the LDPA Apply To?

The LDPA applies to entities conducting business in Louisiana or targeting Louisiana residents that meet at least one of the following thresholds during the prior calendar year:

• Annual gross revenues exceeding $25 million; or
• Annual processing of personal data from 75,000 or more consumers, households, or devices; or
• Deriving 50% or more of annual revenue from selling consumer personal data.

Exempt entities include Louisiana state agencies, HIPAA-covered entities, GLBA-regulated financial institutions, nonprofits, higher education institutions, and electric utilities.

Consumer Rights Under the LDPA

Louisiana residents are entitled to:

• Right to confirm: know whether a business processes their personal data
• Right to access: request a copy of their personal data
• Right to portability: obtain a portable copy in a usable format
• Right to deletion: request deletion of their personal data
• Right to correction: request correction of inaccurate personal data
• Right to opt out: opt out of the sale of personal data, targeted advertising, and automated decision-making

Businesses must respond to verified consumer requests within 45 days of receipt. A single 45-day extension is permitted where reasonably necessary.

Sensitive Data

The LDPA requires affirmative opt-in consent before processing sensitive data. Sensitive data includes racial or ethnic origin, religious beliefs, mental or physical health diagnoses, sexual orientation, citizenship or immigration status, genetic or biometric data processed to uniquely identify an individual, precise geolocation data, and personal data of known children.

Enforcement

The LDPA is enforced exclusively by the Louisiana Attorney General. There is no private right of action. A 30-day cure period is available, but only through July 31, 2027. After that date, enforcement proceeds without a cure opportunity — a deliberate transition toward stricter enforcement compared to many peer state laws.

How UniConsent Supports LDPA Compliance

UniConsent provides the tools businesses need to meet LDPA requirements:

• Opt-in consent banners for sensitive data, configurable by state
• Opt-out mechanisms for targeted advertising, data sales, and automated decision-making
• Consumer rights request management
• Integration with websites, mobile apps, and tag managers

Get started with UniConsent or explore our features.

Other US State Privacy Laws

• CCPA: California Consumer Privacy Act, learn more at CCPA
• CPRA: California Privacy Rights Act, learn more at CPRA
• CPA: Colorado Privacy Act, learn more at CPA
• VCDPA: Virginia Consumer Data Protection Act, learn more at VCDPA
• UCPA: Utah Consumer Privacy Act, learn more at UCPA
• CTDPA: Connecticut Data Protection Act, learn more at CTDPA
• TDPSA: Texas Data Privacy and Security Act, learn more at TDPSA
• DPDPA: Delaware Personal Data Privacy Act, learn more at DPDPA
• NHPA: New Hampshire Privacy Act, learn more at NHPA
• MTCDPA: Montana Consumer Data Privacy Act, learn more at MTCDPA
• FDBR: Florida Digital Bill of Rights, learn more at FDBR
• NJDPA: New Jersey Data Protection Act, learn more at NJDPA
• INCDPA: Indiana Consumer Data Protection Act, learn more at INCDPA
• ICDPA: Iowa Consumer Data Protection Act, learn more at ICDPA

Compare different US State Privacy Laws