Louisiana

Act 440 (HB 142), age verification for material harmful to minors

Commercial entities whose websites contain a substantial portion (one third or more) of material harmful to minors must perform reasonable age verification of Louisiana visitors. A 2024 amendment added Attorney General enforcement alongside the original private right of action.

Act 481 (HB 570), App Store Accountability Act, as delayed by Act 185 (HB 977)

Requires app store providers to verify a user's age category, link minor accounts to a parent account, and obtain parental consent before minors can download apps or make in app purchases. Signed in June 2025 with an original effective date of July 1, 2026; Act 185 of 2026 (HB 977, signed May 15, 2026) repealed and reenacted the act with targeted changes and delayed its effective date one year to July 1, 2027.

Database Security Breach Notification Law, definitions

Louisiana's pre-existing Database Security Breach Notification Law (La. R.S. 51:3071 to 51:3077), first enacted 2005 (effective January 1, 2006) and last substantively amended 2018, is independent of the LDPA and already in force.

Personal information is an individual's name combined with a Social Security number, driver's license or state ID number, financial account or card number with an access code, passport number, or biometric data used to uniquely authenticate identity when accessing a system or account (a narrower, authentication-scoped biometric definition than the LDPA's, with no recording-derived exclusion or clawback of its own), and excludes publicly available government-record information.

Database Security Breach Notification Law, notice duty

Notice to affected Louisiana residents is required in the most expedient time possible and without unreasonable delay, no later than 60 days after discovery, with written reasons for any delay owed to the Attorney General. No notice at all is required if, after investigation, there is no reasonable likelihood of harm, subject to a five-year document-retention duty for that determination.

Louisiana Data Privacy Act (Act No. 502), applicability and controller duties

The Louisiana Data Privacy Act, enacted as Act No. 502 of the 2026 Regular Session (formerly SB 386) and signed by Governor Landry on May 29, 2026, applies to a person or entity doing business in Louisiana that meets any one of three independent thresholds: annual gross revenue exceeding $25 million, annually buying, receiving, selling, or sharing for commercial purposes the personal data of 75,000 or more consumers, households, or devices, or deriving 50% or more of annual revenue from selling personal data.

Exemptions include state agencies and political subdivisions, GLBA-regulated financial institutions, nonprofits, higher-education institutions, and HIPAA-covered entities and business associates, plus a separate household or personal-activity carve-out. Controllers and processors carry General Data Protection Regulation (GDPR) and VCDPA-style duties, including data protection assessments, processor contracts, and purpose limitation, under Sec. 1780.4. The Act takes effect January 1, 2027.

Louisiana Data Privacy Act (Act No. 502), consumer rights

The LDPA gives a Louisiana consumer the right to confirm and access their personal data, correct inaccuracies, delete data, obtain a portable copy, and opt out of targeted advertising, sale of personal data, and profiling producing a legal or similarly significant effect.

A controller must respond without undue delay and no later than 45 days after receipt, with one additional 45-day extension available if the controller notifies the consumer of the extension and its reason within the initial period. An appeal of a denial must be answered within 60 days, and a denial must include an online mechanism to reach the Attorney General. Any contract provision waiving or limiting a consumer's rights under this section is void and unenforceable as against public policy.

Database Security Breach Notification Law, unfair trade practice deeming

A violation of the Database Security Breach Notification Law is deemed an unfair act or practice under R.S. 51:1405(A), with no carve-out of the Unfair Trade Practices and Consumer Protection Law's own private-action provision. This is the opposite private-right-of-action answer from the LDPA in the same title of the same code: the LDPA expressly excludes R.S. 51:1409 and 1409.1, while this breach statute's deeming clause carries no such exclusion.

The specific amendment that added subsection (J)'s deeming clause was not independently dated this pass, so no effective_date is recorded for this instrument beyond the statute's current codified text.

Louisiana Data Privacy Act (Act No. 502), Attorney General enforcement

The Louisiana Attorney General has exclusive authority to enforce the LDPA. A violation constitutes an unfair and deceptive trade practice under the Unfair Trade Practices and Consumer Protection Law (UTPCPL), R.S. 51:1401 et seq., but the Act expressly excludes the UTPCPL's own private-action provisions, R.S. 51:1409 and 1409.1, foreclosing a private right of action under the LDPA.

From January 1 to July 31, 2027, before bringing an action the Attorney General must give a person 30 days' written notice identifying the specific provisions violated, and may not initiate an investigation if the person cures the violation and confirms the cure in writing within that period.

Unfair Trade Practices and Consumer Protection Law, private right of action for a breach-notice violation

R.S. 51:1409(A) lets any person who suffers an ascertainable loss from an unfair or deceptive practice declared unlawful by R.S. 51:1405 bring an individual action for actual damages, trebled if the practice was knowingly used after Attorney General notice, plus attorney fees and costs.

Because the Database Security Breach Notification Law's own deeming clause, R.S. 51:3074(J), routes a breach-notice violation into R.S. 51:1405(A) without excluding this section, a Louisiana resident harmed by a breach-notice violation can sue directly under this provision.

Louisiana Data Privacy Act (Act No. 502), sensitive and biometric data

Sensitive data under the LDPA includes personal data revealing racial or ethnic origin, religious belief, a mental or physical health diagnosis, sexuality, or citizenship or immigration status; genetic or biometric data processed to uniquely identify an individual; a known child's personal data; and precise geolocation data.

Biometric data means data generated by automatic measurement of an individual's biological characteristics used to identify a specific individual, such as a fingerprint, voiceprint, or eye retina or iris scan.

The definition excludes a physical or digital photograph, or data generated from a photograph, video, or audio recording, but claws that exclusion back whenever the data is generated to identify a specific individual, so a voiceprint or faceprint deliberately extracted from a recording for identification purposes remains biometric and sensitive data regardless of the recording's own origin or public status.

A person selling sensitive data under the Act's revenue-from-sale applicability threshold must first obtain the consumer's consent.

Act 456 (SB 162), Secure Online Child Interaction and Age Limitation Act

Required social media platforms with 5 million or more worldwide account holders to verify the age of Louisiana users and obtain parental consent for account holders under 16. Its original July 1, 2024 effective date was delayed one year to July 1, 2025 by Act 656 of 2024. A federal court held the act unconstitutional and permanently enjoined enforcement on First Amendment grounds in December 2025, and Louisiana has docketed its appeal at the Fifth Circuit.