Louisiana DPA

Louisiana's Data Privacy Act, signed May 29, 2026 as Act 502, takes effect January 1, 2027. Its scope test borrows from California: a business doing business in Louisiana is covered if it has more than $25 million in annual revenue, handles the personal data of 75,000 consumers, households, or devices, or earns half its revenue from selling personal data. Consumers may access, correct, delete, and port their data and opt out of targeted advertising, sale, and significant profiling. Sensitive data requires consent, and data sellers need separate consent to sell it. Opt-outs sent through a browser setting or device signal must be honored as an authorized agent's request when the controller can verify residency. The Attorney General enforces violations as unfair trade practices, with no private right of action and a 30-day cure period that applies only through July 31, 2027. Revenue alone can bring a company into scope.