Consumer Data Privacy
Louisiana Consumer Data Privacy Law: Thresholds, Consumer Rights & Deadlines
What Louisiana’s consumer data privacy law requires, maintained by Stauss PLLC. Last reviewed July 2026.
What You Need to Know
Louisiana is the 22nd state to enact a broad consumer privacy law, and it generally follows the Texas model. The important difference is applicability: the standard appears borrowed from the CCPA and turns on revenue and volume without reference to whether you process personal data — so it may reach businesses that would not expect to be covered, including business-to-business companies.
Official law text
Who the law applies to
| Threshold | Requirement |
|---|---|
| Annual gross revenue | Annual gross revenue in excess of $25 million |
| Consumers whose data is processed | Annually buys, receives for the business’s commercial purposes, sells, or shares for commercial purposes the personal information of 75,000 or more consumers, households, or devices 1.63% of state’s 4.6 million population |
| Revenue from sale of personal data | Derives 50% or more of annual revenue from selling consumers’ personal information. |
Consumer rights under Louisiana's law15
| Right | Provided? |
|---|---|
| Know | Yes |
| Access | Yes |
| Obtain list of third parties to which personal data was disclosed | No |
Data portabilitynoteRight applies only to data provided by the consumer to the controller. | Partial |
| Delete | Yes |
| Correct inaccuracies | Yes |
| Not be discriminated against for exercising rights | Yes |
| Opt-out of sale | Yes |
| Opt-out of targeted advertising/sharing | Yes |
| Opt-out of certain types of profiling | Yes |
| Opt-out of ADMT | No |
| Recognize opt-out signals | Yes |
| Revoke consent | No |
| Not process data in discriminatory manner | No |
| Appeal | Yes |
Categories treated as sensitive data8
- Racial or ethnic origin
- Religious beliefs
- Mental or physical health diagnosis
- Sexuality
- Citizenship or immigration status
- Genetic or biometric data for purposes of uniquely identifying an individual
- Personal data of known child
- Precise geolocation
note
Connecticut, Maryland, Oregon, and Virginia ban the sale of precise geolocation data.
How sensitive data must be treated3
- Obtain Consent to Process
- Must Provide Specific Disclosure
note
In Louisiana, if a controller engages in the sale of sensitive data, the controller shall post the following notice: “NOTICE: We may sell your sensitive personal data.” If a controller engages in the sale of biometric data, the controller shall post the following notice: “NOTICE: We may sell your biometric personal data.” - Conduct Data Protection or Risk Assessment
Requirements for minors' data1
- Process personal data of children under 13 in accordance with COPPA or parental/legal guardian consent
Activities that trigger a risk or impact assessment5
- Targeted advertising (“sharing”)
- Sale of personal data
- Processing of sensitive data
- Processing personal data for purposes of profiling where it presents reasonably foreseeable risk of unfair or deceptive treatment of, or unlawful disparate impact on, consumers; financial, physical, or reputational injury to consumers; physical or other intrusion upon the solitude or seclusion, or the private affairs or concerns, of consumers, where such intrusion would be offensive to a reasonable person; other subject injury to consumers
- Any processing activities involving personal data that present a heightened risk of harm to consumers
Other notable provisions9
- Definition of “Sale” Includes “Other Valuable Consideration”
- Opt-out Request Can Be Verified
- Data Processing Agreements
- Privacy Policy
note
Louisiana requires controllers that sell sensitive data to state in their privacy policy “We may sell your sensitive personal data.” Controllers that sell biometric data must state in their privacy policy “We may sell your biometric personal data.” - Implement Reasonable Data Security Measures
- Duty to Avoid Secondary Use
- Data Minimization
- Attorney General Enforcement
- Right to Cure
note
30 day right to cure that sunsets July 31, 2027.
Key dates2
| Date | What happens |
|---|---|
| January 1, 2027 | Louisiana's consumer data privacy law takes effect |
| July 31, 2027 | Louisiana's 30-day right to cure sunsets |
Questions about Louisiana’s privacy law?
Stauss PLLC advises companies on state privacy, AI, and data broker compliance.
Contact Stauss PLLCThis page is provided for general informational purposes only, is not legal advice, and does not create an attorney-client relationship. State laws change frequently; coverage reflects this tool’s most recent update. Contact Stauss PLLC to confirm how these requirements apply to your organization.