Law note · Louisiana
Louisiana Data Privacy Act (Act No. 502), sensitive and biometric data
Sensitive data under the LDPA includes personal data revealing racial or ethnic origin, religious belief, a mental or physical health diagnosis, sexuality, or citizenship or immigration status; genetic or biometric data processed to uniquely identify an individual; a known child's personal data; and precise geolocation data.
Biometric data means data generated by automatic measurement of an individual's biological characteristics used to identify a specific individual, such as a fingerprint, voiceprint, or eye retina or iris scan.
The definition excludes a physical or digital photograph, or data generated from a photograph, video, or audio recording, but claws that exclusion back whenever the data is generated to identify a specific individual, so a voiceprint or faceprint deliberately extracted from a recording for identification purposes remains biometric and sensitive data regardless of the recording's own origin or public status.
A person selling sensitive data under the Act's revenue-from-sale applicability threshold must first obtain the consumer's consent.
What it asks of an app
- Treat an identifier deliberately extracted from a photograph, video, or audio recording to identify a specific Louisiana resident as biometric and sensitive data under the LDPA, notwithstanding the recording's own public or non-public origin.
- Obtain a Louisiana consumer's consent before selling sensitive data, if you meet the LDPA's revenue-from-sale applicability threshold.
- Treat genetic data, health diagnosis information, racial or ethnic origin, religious belief, sexuality, immigration status, a known child's data, and precise geolocation as sensitive data requiring heightened handling.
When LexLint raises it
Declared activities: processes_biometrics, processes_voice, crawls_web, trains_models
Primary source: official Louisiana Act No. 502 (2026 Regular Session) text, as signed, Louisiana Legislature