Louisiana Privacy Law

Louisiana is one of the few states whose constitution contains an express privacy guarantee, and its privacy statutes read accordingly. Article I, § 5 of the state constitution is invoked directly in R.S. 17:3914(A), which declares all personally identifiable student information protected as a right to privacy under the state and federal constitutions and backs that declaration with criminal penalties. The breach statute at R.S. 51:3071 goes further than most in the opposite direction as well: R.S. 51:3075 lets an individual sue for actual damages caused by a late notice, a private remedy few state breach laws contain. Act 502 of the 2026 Regular Session adds the Louisiana Data Privacy Act from January 1, 2027.

The Louisiana Data Privacy Act (LDPA)

Senate Bill 386 by Senator Patrick Connick was signed as Act 502 and enacts Chapter 20-B of Title 51, comprising R.S. 51:1780.1 through 1780.5, with effect from January 1, 2027. Its applicability test is drawn from California rather than from the Virginia model that most 2026 statutes follow: R.S. 51:1780.2(A) reaches a person or entity doing business in the state that satisfies any one of three thresholds turning on gross revenue, on the volume of personal information bought, received, sold or shared, or on the share of revenue derived from selling consumers’ personal information. The volume test counts “consumers, households, or devices”, a formulation that appears in California’s statute and in almost none of the others. Enforcement runs through R.S. 51:1780.5, which routes violations into the Unfair Trade Practices and Consumer Protection Law while expressly excluding that law’s private rights of action.

Status: Enacted but not yet in force — the law takes effect January 1, 2027.

Who Must Comply

The LDPA reaches a business that conducts business in the state, and has annual gross revenues in excess of $25 million, or annually buys, receives for commercial purposes, sells or shares for commercial purposes the personal information of 75,000 or more consumers, households or devices, or derives 50% or more of annual revenues from selling consumers’ personal information.

The exemption list at R.S. 51:1780.2(B) is unusually specific. Alongside state agencies and political subdivisions, financial institutions and Gramm-Leach-Bliley data, HIPAA covered entities and business associates, nonprofit organizations and institutions of higher education, it removes an electric public utility as defined in R.S. 45:121 and a person, association, partnership or corporation registered with the secretary of state as a conductor of public opinion polls under R.S. 14:325. The sensitive-data sale ban at R.S. 51:1780.4(P)(1) is narrower than the rest of the chapter: by its terms it applies to a person or entity described by R.S. 51:1780.2(A)(3), the category defined by deriving half or more of annual revenue from selling personal information

Consumer Rights Under the LDPA

Residents of Louisiana can confirm whether a business is processing their data and obtain a copy of it, require correction of inaccurate personal data, require deletion of personal data the business holds about them, obtain their data in a portable, readily usable format, opt out of targeted advertising, opt out of the sale of their personal data and opt out of profiling used for decisions producing legal or similarly significant effects.

Sensitive data is treated separately. Health, biometric, precise geolocation and demographic data may not be processed without opt-in consent, which means the default is no processing until the consumer agrees.

Sector-Specific Privacy Laws in Louisiana

Student information privacy (La. R.S. 17:3914)

Louisiana backs school data rules with criminal exposure rather than administrative penalties. Section 3914(G) provides that a person who violates any provision of the section is punished by imprisonment for not more than six months or a fine of not more than $10,000.00, and § 3914(F)(5) raises that to a fine of not more than $10,000.00 or imprisonment for not more than three years, or both, for a person who knowingly and wilfully violates the contracting requirements in subsection F. Subsection C(1) bars an official or employee of a local public school system from requiring the collection of eleven categories of information unless a parent or legal guardian volunteers it, among them political affiliations or beliefs of the student or the parent, mental or psychological problems of the student or the family, religious practices, family income, biometric information, gun ownership, a home Internet Protocol address and an external digital identity. Subsection C(2) bars providing personally identifiable student information to a school board member or any other person or entity outside the listed exceptions, and subsection C(2)(b)(i) bars the state Department of Education from sharing even de-identified assessment information with any person or entity located outside Louisiana other than for academic analysis or authorised research. Subsection F(3) requires vendor contracts to address breach planning, notification and remediation, information storage, retention and disposition, and disposal of all information from the contractor’s servers on termination. Subsection I extends the Part to charter schools, their governing authorities and education management organisations under contract to operate them.

Unfair Trade Practices and Consumer Protection Law (La. R.S. 51:1401 et seq.)

This is the statute the state’s privacy laws route into, and it is administered by the Attorney General’s Consumer Protection Section. R.S. 51:1405(A) declares unfair methods of competition and unfair or deceptive acts or practices in the conduct of any trade or commerce unlawful, and R.S. 51:3074(J) makes a violation of the breach chapter an unfair act or practice under that subsection. The Data Privacy Act does the same at R.S. 51:1780.5(C), which provides that any violation of Chapter 20-B constitutes an unfair and deceptive trade practice under R.S. 51:1401 et seq. but expressly excludes the private rights of action in R.S. 51:1409 and 1409.1. The same subsection directs that any monies received in connection with the Attorney General’s enforcement of the privacy chapter be used for consumer protection efforts or to promote consumer protection and education. R.S. 51:1780.5(B) adds a publication duty: the Attorney General posts on the office’s website information relating to the responsibilities of controllers and processors and to consumer rights under the chapter.

Data Breach Notification in Louisiana

The Database Security Breach Notification Law sits at R.S. 51:3071 through 3077 and pairs an outer deadline with an escape valve. Section 3074(E) requires notice in the most expedient time possible and without unreasonable delay but not later than sixty days from discovery; where notice is delayed for law enforcement reasons or because measures are needed to determine the scope of the breach, the person or agency provides the Attorney General written reasons for the delay within that sixty-day period, on receipt of which the Attorney General allows a reasonable extension. Section 3074(I) supplies a harm exception: notice is not required where, after a reasonable investigation, the person or business determines there is no reasonable likelihood of harm to Louisiana residents, provided a copy of the written determination and supporting documentation is retained for five years from the date of discovery and furnished to the Attorney General within thirty days of a written request. Personal information under § 3073(4)(a) reaches six elements paired with a name, including a passport number and biometric data, both added by Acts 2018, No. 382. Substitute notice under § 3074(G)(3) becomes available where notice would cost more than $100,000 or the affected class exceeds 100,000 persons. Two further sections are unusual: § 3075 permits a civil action to recover actual damages resulting from a failure to disclose in a timely manner, and § 3077 provides that the Chapter does not take effect until rules are promulgated by the Attorney General’s office.

Residents must be notified in the most expedient time possible and without unreasonable delay, but not later than 60 days from discovery of the breach. Under LAC 16:III.701 notice to the Attorney General’s Consumer Protection Section is timely if received within 10 days of distribution of notice to Louisiana citizens, and must include the names of all affected citizens. Complaints are taken by the Louisiana Attorney General, which enforces the statute.

How the LDPA Is Enforced

Both privacy statutes are enforced as unfair trade practices. Neither the breach chapter nor the Data Privacy Act carries its own penalty schedule. R.S. 51:3074(J) provides that a violation of the breach Chapter constitutes an unfair act or practice under R.S. 51:1405(A), and R.S. 51:1780.5(C) provides that any violation of the Data Privacy Act constitutes an unfair and deceptive trade practice under R.S. 51:1401 et seq. The difference between them is what survives that routing: the breach chapter leaves the private action in R.S. 51:3075 intact, while the Data Privacy Act strips out the private rights of action in R.S. 51:1409 and 1409.1 by name.

The Attorney General’s breach reporting regulation. R.S. 51:3077 conditioned the whole Chapter on rulemaking, and the rule the Attorney General promulgated is LAC 16:III.701, effective March 2007 and promulgated in accordance with R.S. 51:3071 et seq. It requires written notice detailing the breach to the Consumer Protection Section, including the names of all affected Louisiana citizens, mailed to the Louisiana Department of Justice at 1885 N. Third Street in Baton Rouge. It treats notice as timely if received within ten days of distribution of notice to Louisiana citizens, sets a fine of up to $5,000 per violation for untimely notice, and deems each day notice is not received a separate violation. The office also operates an online Database Security Breach Reporting Form that accepts initial and supplemental notices.

Recent Enforcement in Louisiana

State of Louisiana v. Roblox Corporation — unfair trade practices petition, 21st Judicial District Court. The Attorney General’s office has published its petition against Roblox Corporation, filed by Attorney General Liz Murrill in the 21st Judicial District Court for the Parish of Livingston. The petition invokes the office’s authority under R.S. 51:1405 and 51:1407 to penalise conduct constituting unfair or deceptive trade practices, and seeks restitution or disgorgement, civil penalties, attorneys’ fees and costs, injunctive relief and actual damages. Its principal allegations concern the facilitation of child sexual abuse material and the exploitation of minors on the platform, but the pleading also carries a data-handling count: it alleges that the Children’s Online Privacy Protection Act prohibits companies like the defendant from collecting, using or disclosing the personal information of children under thirteen without verifiable parental consent, and that the defendant chose not to implement safeguards to comply. The petition further alleges that the platform relies on self-reported birthdays for age verification despite having access to biometric age-verification software, and that before November 2024 parental protections were off by default when a child created an account. The prayer asks the court to enjoin the defendant from engaging in any activity in violation of the Unfair Trade Practices Act and from representing that the platform has adequate safety features.

Pending Privacy Legislation

Alongside Act 502, the 2026 Regular Session carried Senate Bill 394 by Senator Rick Edmonds, which would permit parents to sign a restricted waiver of student privacy rights in order to expedite tuition payments for LA GATOR students enrolled full time in nonpublic schools approved by the Board of Elementary and Secondary Education. The bill was introduced on March 9, 2026 with the rules suspended for expedited processing and is pending in the Senate Education Committee. Its subject matter sits directly against R.S. 17:3914, the section that declares student personally identifiable information constitutionally protected and attaches criminal penalties to its disclosure. On the Data Privacy Act itself the next scheduled steps are statutory rather than legislative: the enforcement provisions and the Attorney General’s website-publication duty under R.S. 51:1780.5(B) begin with the Act on January 1, 2027, and the notice-and-cure window in subsection D closes on July 31 of that year.

Federal Privacy Laws That Apply in Louisiana

Federal privacy law applies in Louisiana by sector, whatever the state has enacted: HIPAA to health information, the Gramm-Leach-Bliley Act to financial institutions, FERPA to student education records, the Fair Credit Reporting Act to consumer reports, COPPA to children under 13, and Section 5 of the FTC Act to privacy claims that do not match practice.

The LDPA sits alongside those rules rather than displacing them: the Louisiana Attorney General enforces the state law, while the federal regulators continue to reach the sectors and activities they cover. The state-law counterpart to section 5 is the Unfair Trade Practices and Consumer Protection Law (La. R.S. 51:1401 et seq.), which the Louisiana Attorney General enforces against businesses whose stated data practices differ from their actual ones.

Louisiana Privacy Law FAQ