Law note · Louisiana
Louisiana Data Privacy Act (Act No. 502), applicability and controller duties
The Louisiana Data Privacy Act, enacted as Act No. 502 of the 2026 Regular Session (formerly SB 386) and signed by Governor Landry on May 29, 2026, applies to a person or entity doing business in Louisiana that meets any one of three independent thresholds: annual gross revenue exceeding $25 million, annually buying, receiving, selling, or sharing for commercial purposes the personal data of 75,000 or more consumers, households, or devices, or deriving 50% or more of annual revenue from selling personal data.
Exemptions include state agencies and political subdivisions, GLBA-regulated financial institutions, nonprofits, higher-education institutions, and HIPAA-covered entities and business associates, plus a separate household or personal-activity carve-out. Controllers and processors carry General Data Protection Regulation (GDPR) and VCDPA-style duties, including data protection assessments, processor contracts, and purpose limitation, under Sec. 1780.4. The Act takes effect January 1, 2027.
What it asks of an app
- Determine whether you do business in Louisiana and meet at least one of the LDPA's three independent thresholds ($25 million annual gross revenue, 75,000 or more consumers, households, or devices processed annually, or 50% or more of revenue from selling personal data) before relying on any exemption.
- Confirm whether a sector exemption applies. The LDPA excludes state agencies and political subdivisions, GLBA-regulated financial institutions, nonprofits, higher-education institutions, and HIPAA-covered entities and business associates.
- Prepare to comply beginning January 1, 2027; the LDPA is enacted but not yet in force.
When LexLint raises it
Declared activities: crawls_web, trains_models, deploys_chatbot, automated_outreach, processes_biometrics, processes_voice
Primary source: official Louisiana Act No. 502 (2026 Regular Session) text, as signed, Louisiana Legislature